Privacy Policy

Lekki Peninsula Phase 1 Residents Association (LERA)

Who are we?

Lekki Phase 1 Residents Association (“LERA”, “We”, “Us”, or “Our”) is a

community-based association with Our registered address at 18 Admiralty Way, Lekki

Phase 1, Lagos. Our business involves community and membership management,

aimed at ensuring peaceful, secure, and organized living for residents within Lekki

Phase 1, Lagos (Our “Service”). If you have any questions about this Privacy Policy or

how and why We process your Personal Data, please contact Us at

privacy@lekkiphase1.org.

Our Privacy Policy has been prepared to meet the requirements of the extant Nigeria

Data Protection Act (the “NDPA”). We are committed to protecting the confidentiality

and privacy of all personally identifiable information (“Personal Data”) entrusted to Us

through this website (“Website”). Our Privacy Policy, together with Our Terms of Use,

explains the type of Personal Data We collect, when, how and why We collect Personal

Data, lawful basis for processing the Personal Data, how We use the Personal Data, the

conditions under which We may disclose Personal Data to others and the efforts We

take to keep Personal Data secure, and your Rights as regards Personal Data collected

and processed. By registering for or using Our Services, you acknowledge that you

have read and agree to Our Privacy Policy, Terms of Use, and Community Rules, which

are incorporated herein by reference.

The terms ‘you’ and ‘your’ mean you as an individual or business, accessing Our

Website, registering as a resident or business member, applying for or using Our

Services or digital features. When We make decisions on how Personal Data is used in

connection with Our Services, We act as a Data Controller and will be responsible for

the obligations of a Data Controller under the NDPA in connection with the processing

of Personal Data. For example, We use this Privacy Policy and other notices to provide

you with information about Our use of Personal Data, as required by the NDPA. Where

We only use Personal Data requested by other Data Controllers, We would be acting as

Data Processors, and those other Data Controllers are similarly responsible for the

obligations of a Data Controller under the NDPA in connection with the processing of

those categories of Personal Data. If you are using Our Services through those other

Data Controllers, you should contact them if you have questions or concerns about the

processing of your Personal Data or compliance with the NDPA and other applicable

laws.

We may update and modify this Privacy Policy from time to time, to reflect changes in

Our operations, legal requirements, or community practices, so please do return to the

Website and review this Privacy Policy regularly. Unless otherwise stated, any updates

to this Privacy Policy become effective when We post the updates on the Website. Your

continued use of the Website for Our Services following an update to the Privacy Policy

means that you are aware of the updated Privacy Policy and have no objections to any

such updates. Please read the following carefully to understand Our views and

practices regarding the collection and processing of your Personal Data.

1. What Personal Data Do We Collect?

We may hold and use various types of Personal Data collected at the start of, and

during your relationship with Us. We will limit the collection and processing of the

Personal Data to what is necessary to achieve the purposes identified in this notice. The

information you provide to Us must be correct, accurate, complete, and not misleading.

Personal Data We collect includes:

Personal details: your full name, residential address, phone number, email

address, passport photograph;

Business details: business name, business address, business type, email

address;

Membership and residency information: details relating to your property or

residence within the community, such as house or flat number, block or estate

name, and resident status (owner, tenant, family member, etc.);

Payment information: records of membership dues, levies, and other

payments, including payment channel details or bank account references (We do

not store full card or banking details unless necessary for association

transactions);

Identification documents: such as Utility bills, lease agreement, property deed,

or government ID with address, CAC certificate, business license, tax ID, or

business permit;

identifiers assigned to your computer or mobile device (such as IP address,

device ID, or session cookies);

Usage and location data: information about how you use Our Website,

including visit dates, access logs, page interactions, and preferences;

Communication records: details of any correspondence with Us, including

enquiries, complaints, or participation in surveys, polls, or community feedback

forms;

Event and media information: photographs or videos taken during community

meetings, social events, or security operations, which may include your image;

Security and access data: such as entry or exit logs where access control

systems or security registers are used within the community; and

Optional demographic information: such as family size or interests, where

voluntarily provided for community planning or welfare purposes.

In some circumstances, We may also collect and process special categories of Personal

Data. This is to help ensure that Our Services are accessible and so that We can offer

appropriate levels of support where required.

2. How We Use Your Personal Data

We may use your Personal Data:

To create and manage your membership account, resident records, including

processing applications for membership, maintaining contact information, and

updating Our records;

Verify your identity and residency status;
For business listings on Our Website;
To collect, process, and manage payments such as membership dues, levies,

and any other applicable charges;

To organise, coordinate, and communicate about community events, meetings,

and activities, including registration, attendance, and participation;

To maintain and enhance community security and access control, including

managing resident identification and verifying authorised persons within the

community;

To communicate association activities, events, notices, updates, announcements,

newsletters, and other relevant information to members and residents;

To publish photographs, videos, or other media content captured during

community events (with your consent), for community updates or publicity

purposes;

To send marketing communications (with your consent);
To monitor and analyze usage patterns to improve user experience;
To maintain and develop Our systems, Services, and administrative records,

including testing, upgrading, and improving them;

To comply with legal, regulatory, or statutory obligations, including those related

to taxation, recordkeeping, and reporting to government authorities where

required;

To ensure the safety and integrity of the community operations, including

preventing unauthorised access, misuse, or fraudulent activity on Our platform or

facilities;

To respond to your enquiries or requests, and to provide support relating to your

membership or participation in community activities; and

For any other specific purpose which We notify you of at the time your Personal

Data is collected or for which you provide consent.

We may also monitor and retain records of communications (such as emails, SMS, or

calls) with members to ensure accurate recordkeeping, maintain service quality, and

prevent misuse or fraud.

3. How We Collect Your Personal Data

Directly from You: When you register, make payments, submit feedback,

correspond with Us via email, phone, in person, or through our Website or

resident portal, upload documents or verification materials, or sign up for

newsletters;

Through Your Usage and Participation: By observing how you access and use

Our Services, and through your involvement in community activities such as

attending meetings, events, or programs, participating in forum discussions, or

when photographs and videos are taken for community records and publications;

From Other Residents or Authorized Persons: When another resident or

authorized member provides your information for administrative purposes (e.g.,

emergency contact details or nominee information);

From Partner Organizations: With your consent or other lawful basis, including

direct marketing partners or eligibility assessments for partner products that may

be relevant to you;

From Public or Lawful Sources: Such as the Corporate Affairs Commission

records, or government registers used to verify residency or ownership; and

From Third-Party Organizations: Including affiliates who integrate with Our

Services, fraud prevention and investigation agencies providing information on

financial behavior, and third-party service providers engaged to support Our

operations, such as payment processors, email delivery, and hosting, or security

and access control providers.

4. Lawful Basis for Processing your Personal Data

We collect and use your Personal Data where it is necessary for Us to carry out Our

Services. Our grounds for processing your Personal Data are as follows:

4.1. Consent

We may process your Personal Data based on your explicit consent. This applies where

we:

Collect or publish your photographs, videos, or likeness in newsletters, social

media posts, or community publicity materials;

Send you optional community updates, invitations, or event announcements

beyond essential communications;

Collect information for surveys, feedback forms, or other voluntary participation

activities; and

Send you marketing or promotional materials about third-party services or

partners.

You may withdraw your consent at any time, and such withdrawal will not affect prior

lawful processing.

4.2. Contractual necessity

We process your Personal Data where it is necessary to enter into, or perform, our

obligations under a membership or resident relationship with you. Such processing

enables Us to fulfil our obligations to you as a member or resident. This may include

processing to:

register you as a member or resident of the community;
maintain and update your membership records;
manage and collect dues, levies, and relevant fees;
provide access to Our platform, meeting notices, and communications;
administer events, meetings; and
address your enquiries, complaints, or requests concerning your membership.

4.3. Legal obligation

We may process your Personal Data where it is required for compliance with a legal or

statutory obligation applicable to Us. This may include processing to:

Confirm your identity;
maintain accurate, auditable records of residents, members, payments, and Our

business activities as required by law;

Comply with tax laws and provide information to relevant government agencies;
Respond to enquiries and requests from public authorities or regulators, and

submit required reports;

Fulfill obligations related to community safety, security, public health, and the

protection and support of vulnerable members; and

Retain Personal Data for periods mandated by applicable laws and regulations.

4.4. Vital Interest

We may process your Personal Data where it is necessary to protect the life, physical

safety, or well-being of you or another person. This may include processing during:

Emergencies, incidents, or security alerts within the community; and
Health or safety situations where immediate communication or assistance is

required.

4.5. Public Interest

We may process your Personal Data where it is necessary for the performance of a task

carried out in the public interest, particularly where We undertake functions that promote

community welfare, public safety, or neighbourhood development.

4.6. Legitimate interest

We may process your Personal Data when We have a legitimate reason to do so. If We

do, it must not unfairly go against what is right and best for you. If We rely on Our

legitimate interest, We will tell you what that is. This may include processing to:

improve Our Services, operations, and communication channels;
promote and coordinating community engagement, events, meetings, and

volunteer activities;

monitor and ensure the security of residents, premises, and online systems;
prevent fraud, misuse, or violations of Our Terms of Use; and
maintain a record of activities relevant to the management and development of

the community.

monitor, review, and improve the content and appearance of Our website

includin,g without limitation, testing and upgrading;

conduct surveys and gather feedback to enhance community living experience;
manage contractors, service providers, and vendors related to community

maintenance and services; and

facilitate emergency response, health, and safety measures within the

community.

5. Who Do We Share Your Personal Data with

We may share your Personal Data with third-party companies who provide services to

you, on Our behalf, and/or third-party companies who provide Services to Us. This may

require these organisations to access and process your Personal Data. These may

include:

Government agencies: for compliance with statutory, tax, or law enforcement

obligations;

Payment service providers and banks: to process membership dues, levies, or

other authorised payments.

Accountants/auditors: for financial reporting, audits, and compliance;
Communications service providers: offering mail, email, and SMS services for

sending community notices, newsletters, and other official messages;

Survey and feedback providers: to collect feedback and improve community

operations and services.

IT service providers: for hosting, maintenance, and securing Our website,

member portal, and communication systems;

Event organisers, photographers, or media contractors: for managing or

documenting community events and activities, where residents’ images may be

captured and shared in line with applicable consent.

Data security providers: for debugging and system improvement purposes, and

to ensure data protection.

Legal service providers: to obtain legal advice, enforce our rights, or defend

against legal claims;

Security or facility management contractors: who support estate access

control, security, and community safety.

Digital and direct marketing service providers: to communicate relevant

updates or promotional information where permitted by law and subject to your

consent;

If We undergo a restructuring, merger, or change in management, relevant

Personal Data may be transferred as part of that process. We do not sell or rent

residents’ Personal Data to any third party. All third parties engaged by the

Association are required to maintain appropriate confidentiality and security

standards.

We may also process your Personal Data using data analytics and artificial

intelligence tools provided by external third parties to manage risks, improve Our

Service.

6. International Transfer of Personal Data

To provide the Services, We or Our service providers may transfer your Personal Data

to countries outside Nigeria. For example, this may occur where Our website hosting,

payment processing, or communication tools are provided by service providers based in

other countries, including jurisdictions that have been recognized by the NDPA as

providing adequate data protection, or to countries whose data protection laws may

offer a lower level of protection than is available in Nigeria. In all cases, We will ensure

that appropriate safeguards are in place to protect your Personal Data in accordance

with the NDPA. The specific safeguards We implement will depend on the nature of the

transfer and the recipient, and may include the use of standard contractual clauses. If

you would like further information about these safeguards, please contact Us at

privacy@lekkiphase1.org.

7. Your Data Subject Rights

As a Data Subject, you have a number of rights:

The right to access the Personal Data We hold about you;
The right to rectify inaccurate Personal Data or complete it if it is incomplete;
The right to have your Personal Data deleted;
The right to request restriction of your Personal Data;
The right to obtain and make use of your Personal Data for your own purposes

across different Services ("portability");

The right to object to the processing of your Personal Data in certain

circumstances;

The right to object to decisions that are based solely on automated

decision-making, including profiling;

The right to withdraw consent at any time; and
Right to lodge complaints with the NDPC.

Please note that your data protection rights are subject to certain restrictions and

conditions and We may be required to retain a range of your Personal Data for legal

and regulatory reasons. If you think that any of the Personal Data We hold about you is

wrong or incomplete, you have the right to challenge it. To exercise any of these rights,

please contact us at privacy@lekkiphase1.org.

8. Sensitive Personal Data

We will not typically ask you for any 'special categories' of Personal Data. This is also

referred to as 'Sensitive Personal Data' and includes information revealing an

individual's political opinions, racial or ethnic origin, religious or philosophical beliefs, or

trade union membership, and genetic data, biometric data, data concerning health or

data concerning an individual's sex life or sexual orientation. If We process such

Sensitive Personal Data, We will do so (a) with your explicit consent, (b) to comply with

Our legal obligations to support you if you are, or become vulnerable, and (c) to

establish, take, or defend any legal action.

9. How Long We Keep Your Data

We will retain your Personal Data for as long as required by applicable laws and

regulations. Where no specific legal or regulatory retention period applies, your

Personal Data will be retained only for as long as is necessary to fulfil the lawful

purposes for which it was originally collected or for related and compatible purposes.

Specifically:

Account information will be retained for the duration of your active membership.
Payment records will be retained for seven (7) years to comply with tax and

accounting obligations.

Communication records will be retained for up to two (2) years.
Analytics data will generally be retained for 18 to 24 months.
Legal documents may be retained indefinitely where required by law.

When Personal Data is no longer required for these purposes, it will be securely deleted

or anonymized in accordance with our Data Retention Policy and applicable data

protection laws, after which your Personal Data will no longer be retrievable through a

Data Subject Access Request (“DSAR”). We may extend the retention period where

necessary to establish, exercise, or defend legal claims. Personal Data may also be

retained for longer periods for statistical or research purposes, in which case it will be

permanently anonymized to prevent identification.

10. How Do We Protect Your Personal Data?

We are committed to managing your Personal Data in line with the NDPA and best

practices. We employ all reasonable efforts to keep your Personal Data secure by

taking appropriate technical and organisational measures against any unauthorised or

unlawful processing of Personal Data and against its accidental loss, destruction, or

damage. We protect your Personal Data using physical, technical, and organisational

measures to reduce the risks of loss, misuse, unauthorised access, disclosure, and

alteration. We also use industry-recommended security protocols to safeguard your

Personal Data. Other security safeguards include, but are not limited to, data

encryption, firewalls, and physical access controls to Our buildings and files. Our

privacy assessment indicates that your use of Our Services is unlikely to compromise

data protection.

11. Do We Use Automated Processing?

We may use your Personal Data in automated processes to make decisions about you,

to enhance efficiency, security, and service quality. You have the right not to be subject

to a decision based solely on automated processing, if this will have a legal or other

significant effect on you (certain exceptions apply).

Membership Verification and Access Control: Personal Data such as your

name, resident ID, phone number, or access tag data is automatically processed

to verify membership status and enable secure access to association premises.

Online Platform and Service Administration: Automated systems manage

access, ensuring seamless digital services.

Event Registration and Participation: Automated tools handle event RSVPs,

send reminders, and record attendance to facilitate community event

management.

Communications and Updates: Personalized announcements, newsletters, and

emergency notifications are automatically sent based on your communication

preferences.

Fraud Detection and Prevention: Automated monitoring identifies suspicious

activities or transactions, safeguarding community assets and services.

Automated Compliance Checks: Systems monitor adherence to community

rules and alert management about potential violations to support orderly conduct.

Automated Grievance and Complaint Handling: Initial intake, categorization,

and routing of complaints are supported by automated systems to expedite

responses.

Resident Engagement and Personalization: Messages and offers are tailored

by automated systems according to resident preferences and behavior to

improve the community experience.

If you do not agree with any decisions made as a result of the foregoing, you have the

right to appeal the outcome of these automated decisions and ask for them to be

reconsidered manually. We may require additional relevant information to be provided

by you before human oversight of a specific decision will take place.

12. Access to Your Personal Data via a Data Subject Access Request (DSAR)

You have the right to request access to the Personal Data We hold about you. To make

a DSAR, please email privacy@lekkiphase1.org with the subject line “DSAR” or for

urgent privacy matters, "URGENT - Privacy Request", or write to:

Data Protection Officer.

Lekki Phase 1 Residents Association (LERA).

18 Admiralty Way, Lekki Phase 1, Lagos 105102, Lagos

We may need to verify your identity before processing your request. We will respond

within one (1) month of receipt of your request and verification of your identity. Requests

are free of charge unless they are manifestly unfounded or excessive, in which case We

may charge a reasonable fee or refuse to comply. If you are not satisfied with Our

response, you can contact the NDPC.

13. Cookies

We may use cookie technology on Our Website to collect some of the Personal Data

detailed in this Privacy Policy. Cookies are small text files stored on your device or

internet browser when you visit Us. We use cookies mainly to improve the performance

of Our Website and Our Services. The Cookie Policy made available on this Website

explains in more detail what types of cookies We use, why We use them and how to

identify and disable them.

14. Third-Party Advertising Links or Content

Our Website may contain links to other sites that are not operated by Us. We allow third

parties, including advertising networks and other advertising service providers, to collect

information about your online activities through cookies, pixels, local storage, and other

technologies. These third parties may use this information to display advertisements on

Our Website and elsewhere online tailored to your interests, preferences, and

characteristics. We have no control over, and assume no responsibility for the content,

privacy policies, or practices of any third-party sites or services. Some third parties

collect information about users of Our Website to provide interest-based advertising on

Our Website and elsewhere, including across browsers and devices. These third

parties may use the information they collect on Our Website to make predictions about

your interests in order to provide you with ads (from Us and other companies) across

the internet. We strongly advise you to review the Privacy Policy of every site you visit.

15. Children’s Privacy

We do not knowingly collect Personal Data from children under the age of 18. Our

Website and Services are not addressed to minors. If you are a parent or guardian and

you learn that your children have provided Us with Personal Data, please contact Us. If

We become aware that We have collected Personal Data from a child under the age of

18 without verifiable parental consent, We will take steps to remove that information

from Our servers.

16. Complaints

If you have any complaints about Our use of your Personal Data, please send an email

with the details of your complaint to privacy@lekkiphase1.org or use the contact details

above. We will investigate and respond to any complaints We receive. You also have

the right to lodge a complaint with the NDPC. For further information on your rights and

how to complain to the NDPC, please refer to the NDPC Website at

https://ndpc.gov.ng/.