Privacy policy

1. INTRODUCTION

Bookteller Nigeria Limited (“Bookteller”, “we”, “our” or “us”) is committed to protecting the privacy, confidentiality and security of the personal data entrusted to us by our customers, hotel partners, website visitors and other individuals who interact with our services.

This Privacy Policy explains how we collect, use, store, disclose, protect and otherwise process personal data when you visit our website, use our hotel reservation services, communicate with us, make or manage a booking, or engage with us in any other business capacity.

Bookteller operates a hotel booking and reservation platform that connects travellers with participating hotels and accommodation providers. Our services facilitate the discovery of accommodation, the presentation of hotel rates and availability, the submission and management of reservations, and the delivery of booking notifications to guests and hotels.

We also provide hotel marketing and booking technology services through which participating hotels can promote their properties, manage direct booking opportunities and receive reservation enquiries or notifications.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (“NDPA”), applicable regulations and other relevant data protection requirements.

We have obtained a certificate of compliance from the Nigeria Data Protection Commission (NDPC). We remain committed to maintaining appropriate data protection practices and meeting our continuing legal and regulatory obligations.

By using our website or services, you acknowledge that you have been provided with this Privacy Policy. Where consent is the appropriate lawful basis for a particular processing activity, we will seek that consent separately where required. Using our services does not automatically constitute consent to every form of data processing described in this Policy.

2. WHO WE ARE

The data controller responsible for the processing described in this Policy is:

Company Name: Bookteller Nigeria Limited
Country of Registration: Nigeria
Business Address: Chevy View Estate, Lekki, Lagos, Nigeria
Privacy Contact: legal@bookteller.ng
Website: https://bookteller.ng

For privacy-related enquiries, requests or complaints, please contact us using the details above and indicate that your message concerns data protection or privacy.

Where Bookteller processes personal data on behalf of a hotel or another business under that organisation’s documented instructions, our role may instead be that of a data processor. The applicable responsibilities will depend on the specific service and processing arrangement.

3. SCOPE OF THIS POLICY

This Privacy Policy applies to personal data processed through our websites, booking interfaces, digital applications and related services, as well as information collected through customer support, hotel partnerships, email, SMS, telephone calls and other business communications.

It covers, where applicable:

• Guests who search for accommodation or make hotel reservations.

• Individuals who contact us with enquiries, complaints or support requests.

• Hotel owners, managers, employees and authorised representatives.

• Visitors to our websites and users of our booking services.

• Business contacts, suppliers and service providers.

• Individuals whose personal data is provided to us in connection with a reservation or other legitimate business activity.

This Policy should be read alongside any additional privacy notice presented when you use a specific service, where applicable.

4. PERSONAL DATA WE COLLECT

The information we collect depends on how you interact with Bookteller and which services you use. We aim to collect only information that is relevant and reasonably necessary for the purpose concerned.

4.1 Guest and reservation information

When you make a reservation or submit a booking enquiry, we may collect:

• Full name.

• Email address.

• Telephone or mobile number.

• Nationality, where requested and relevant to the reservation.

• Hotel or accommodation selected.

• Check-in and check-out dates.

• Number of guests and rooms requested.

• Room type and other booking preferences.

• Reservation reference, booking status and related correspondence.

• Special requests or other information voluntarily supplied for the stay.

We may also process additional information where it is necessary to fulfil a specific booking request or comply with applicable law.

4.2 Hotel partner information

When a hotel registers, lists its property or uses our hotel marketing or booking technology services, we may collect:

• Hotel or business name.

• Property address and contact information.

• Name and contact details of the hotel owner, manager or authorised representative.

• Business email address and telephone number.

• Property descriptions, room details, rates, availability and booking policies.

• Information about reservations, booking performance and customer enquiries.

• Account credentials and account administration information.

• Business, contractual and billing information relevant to the services provided.

Where a hotel uses a subscription-based booking system, we may process account, subscription and service configuration information necessary to administer that service.

4.3 Payment-related information

Depending on the booking arrangement, we may process information about a reservation's payment status, payment method, transaction reference or other details needed to administer the booking.

Where guests pay the hotel directly or pay on arrival, Bookteller may process the booking information needed to communicate the relevant payment arrangement.

Where online payments are enabled through an external payment gateway, payment information may be collected and processed by that gateway through its payment interface. The payment provider's own privacy policy and terms will also apply.

We do not claim to collect or store complete payment card details unless a specific service arrangement requires it and the necessary safeguards are in place.

4.4 Communications and customer support

When you contact us, we may collect your email correspondence, messages, enquiries, complaints, feedback and information reasonably necessary to resolve your request.

Where customer support communications are recorded, we will handle any recordings in accordance with applicable law and provide appropriate notice where required.

4.5 Technical and website usage information

When you visit our website or use our digital services, certain technical information may be collected, depending on the technologies enabled. This may include:

• Internet Protocol (IP) address.

• Browser type and device information.

• Operating system and technical identifiers.

• Pages visited and interactions with our website.

• Date, time and duration of website visits.

• Referral information and basic diagnostic logs.

• Cookie identifiers and website preferences, where applicable.

We use this information to operate our services, maintain security, understand website performance, troubleshoot technical problems and improve the user experience.

4.6 Information received from hotels and other sources

We may receive reservation-related information from participating hotels, authorised business partners, service providers or other sources where this is necessary and lawful.

For example, a hotel may provide information about the acceptance, rejection, amendment or fulfilment of a reservation.

Where information is obtained from another source, we will take reasonable steps to ensure that the processing is lawful and that appropriate privacy information is provided where required.

5. HOW WE USE PERSONAL DATA

We process personal data for specific and legitimate business purposes, including:

1. Hotel reservations: To submit, communicate, confirm, manage, amend or cancel reservations and booking enquiries.

2. Booking notifications: To send guests and participating hotels relevant booking confirmations, acceptance or rejection notices, reminders and updates.

3. Guest support: To answer questions, resolve booking problems, handle complaints and provide customer service.

4. Hotel services: To onboard participating properties, maintain hotel listings, communicate rates and availability, and deliver agreed booking or marketing services.

5. Booking technology: To operate hotel booking interfaces, account dashboards, reservation management features and related functionality.

6. Payments and records: To communicate payment arrangements, reconcile relevant transaction information and maintain appropriate business records.

7. Service improvement: To analyse website usage, identify technical issues and improve our services, where the relevant processing is lawful.

8. Security and fraud prevention: To protect our systems, investigate suspicious activity, prevent misuse and support the integrity of reservations.

9. Business communications: To respond to hotel partnership enquiries, administer agreements and communicate about services requested by business customers.

10. Marketing: To send relevant promotional messages, product updates or offers where permitted by law and, where required, based on your consent.

11. Legal and regulatory obligations: To comply with applicable laws, lawful requests, recordkeeping requirements and regulatory obligations.

12. Disputes and enforcement: To establish, exercise or defend legal claims and address disputes connected with our services.

We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless the further processing is otherwise permitted by applicable law.

6. LAWFUL BASES FOR PROCESSING

Under the NDPA, personal data must be processed on an appropriate lawful basis. Depending on the circumstances, Bookteller may rely on one or more of the following:

6.1 Performance of a contract or steps requested before entering a contract

We may process personal data to facilitate a reservation, communicate with a hotel, provide an agreed service, administer a hotel account or take steps requested by an individual before entering into a contract.

6.2 Compliance with a legal obligation

We may process personal data where necessary to comply with applicable legal, tax, accounting, regulatory or other statutory obligations.

6.3 Legitimate interests

We may process personal data where necessary for a legitimate interest pursued by Bookteller or a relevant third party, provided that the individual's rights and freedoms do not override that interest.

Such interests may include maintaining platform security, preventing fraud, improving services, managing business relationships and defending legal claims.

Where we rely on legitimate interests, we will consider the nature of the processing and its potential impact on the individuals concerned.

6.4 Consent

We may rely on consent for processing activities where consent is the appropriate lawful basis, including certain marketing communications or non-essential cookies where required.

You may withdraw your consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6.5 Protection of vital interests or other lawful grounds

Where applicable, we may process personal data on another lawful basis recognised by the NDPA, including where necessary to protect vital interests or where another legally recognised ground applies.

We will identify and apply the appropriate lawful basis for the relevant processing activity.

7. DISCLOSURE AND SHARING OF PERSONAL DATA

Bookteller does not sell personal data as a business model. We may, however, disclose personal data where necessary to provide our services, fulfil a booking, operate our systems or comply with the law.

The recipients may include the following.

7.1 Participating hotels and accommodation providers

When you submit a reservation or booking enquiry, we may share relevant details with the selected hotel so that it can assess availability, accept or reject the reservation, communicate with you and prepare for your stay.

The information shared may include your name, contact details, reservation dates, room requirements, booking reference and relevant requests.

The hotel may process this information under its own privacy policy and legal responsibilities. Once the hotel receives your information, its use of that information may be outside Bookteller's direct control.

Guests should review the privacy policy of the hotel concerned where appropriate.

7.2 Technology and hosting providers

We may use third-party providers to host our website, maintain our booking systems, deliver email and SMS notifications, provide customer support, store business records, maintain security and support other essential technical functions.

These providers may process personal data on our behalf under appropriate contractual, confidentiality and security arrangements.

7.3 Payment service providers

Where online payments are supported, relevant information may be shared with payment gateways, payment service providers or financial institutions to process or verify transactions.

Where a hotel uses its own payment gateway account, the payment provider may collect and process payment information directly under its own terms and privacy policy.

7.4 Marketing and booking distribution partners

Where a hotel has authorised the relevant service, we may transmit property information, rates, availability or other necessary data to booking distribution channels and technology partners, including applicable Google hotel-related services.

Personal data relating to a guest will only be shared with such partners where necessary for the relevant service and supported by an appropriate lawful basis.

Hotel property information, such as room rates and availability, is not necessarily personal data. However, personal data included in booking or account information will be handled in accordance with this Policy and applicable law.

7.5 Professional advisers and business partners

We may disclose relevant information to lawyers, accountants, auditors, insurers and other professional advisers where necessary for legitimate business, legal or compliance purposes.

7.6 Government authorities and law enforcement

We may disclose personal data where required by law, a valid legal process, a competent regulatory authority or another lawful obligation.

We may also disclose information where reasonably necessary to investigate suspected fraud, protect our rights, safeguard individuals or address a serious security incident, subject to applicable law.

7.7 Corporate transactions

If Bookteller undergoes a merger, restructuring, acquisition, financing or transfer of business assets, relevant personal data may be disclosed to the parties involved where lawful and subject to appropriate safeguards.

We will not disclose personal data to unrelated third parties merely because they request it. Any disclosure must have a legitimate purpose and an appropriate legal basis.

8. OUR ROLE AND THE ROLE OF HOTELS

Bookteller facilitates connections and reservations between guests and participating hotels. Our precise data protection responsibilities depend on the service being provided.

For reservation facilitation and our own platform operations, Bookteller may determine the purposes and means of processing certain personal data and act as a data controller.

For certain hotel technology services, Bookteller may process personal data on behalf of a hotel according to that hotel's instructions and act as a data processor.

Participating hotels may independently determine how they use guest information for accommodation, check-in, guest communication, service delivery, legal compliance and other hotel operations.

Each party is responsible for complying with the data protection obligations applicable to its role.

This Policy does not remove or reduce any rights that individuals have under applicable data protection law.

9. INTERNATIONAL TRANSFERS OF PERSONAL DATA

Some of our technology providers or business partners may store or process information outside Nigeria.

Where personal data is transferred internationally, Bookteller will take the steps required by applicable data protection law, including assessing the transfer arrangement and ensuring that an appropriate legal mechanism and safeguards are in place.

Depending on the circumstances, these measures may include an applicable adequacy decision, appropriate contractual protections or another lawful transfer mechanism.

We will not assume that a transfer is lawful merely because a third-party service provider is available for use.

10. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies to support essential website functions, remember preferences, understand website traffic, maintain security and improve performance.

Cookies may include:

• Essential cookies: Necessary for core website functions, security or requested services.

• Preference cookies: Used to remember choices or settings.

• Analytics cookies: Used to understand website traffic and interactions.

• Marketing cookies: Used for advertising or marketing measurement where such technologies are enabled.

Non-essential cookies will be used in accordance with applicable law, including obtaining consent where required.

You may manage available cookie preferences through the website's cookie controls, where provided, or through your browser settings. Blocking certain cookies may affect some website functions.

We will provide further information about specific cookies and their purposes where required.

11. MARKETING COMMUNICATIONS

We may send service-related messages needed to administer your reservation or account, such as booking confirmations, reservation status updates, important service notices and responses to enquiries.

These operational messages are distinct from promotional communications.

We may send promotional emails, SMS messages or other marketing communications where permitted by law and, where required, with your consent.

You may opt out of promotional communications by using the unsubscribe mechanism provided or by contacting us at legal@bookteller.ng.

Opting out of marketing will not prevent us from sending essential messages relating to an existing booking, account, legal obligation or requested service.

12. DATA RETENTION

Bookteller retains personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected, meet applicable legal obligations, resolve disputes, maintain appropriate business records or establish and defend legal claims.

Retention periods depend on the type of information and the reason for processing it.

For example:

• Reservation records: Retained for the administration of bookings, customer support, dispute resolution and applicable recordkeeping obligations.

• Hotel account and contractual records: Retained while the business relationship remains active and for any additional period required for legitimate legal or business purposes.

• Customer support correspondence: Retained for as long as necessary to resolve the enquiry and maintain relevant service or complaint records.

• Marketing preferences: Retained as necessary to manage subscriptions, consent records and opt-out requests.

• Technical and security logs: Retained for a period appropriate to security, troubleshooting, fraud prevention and operational requirements.

• Financial and transaction records: Retained for the period required by applicable accounting, tax, legal and regulatory obligations.

We will establish and apply appropriate retention periods for the categories of data we process. Where personal data is no longer required, we will securely delete it, anonymise it or otherwise dispose of it in accordance with applicable law and our retention procedures.

Data may need to be retained despite a deletion request where a lawful obligation or other recognised legal ground requires its continued retention.

13. DATA SECURITY

We recognise that personal data must be protected against unauthorised access, disclosure, alteration, loss, destruction and misuse.

Bookteller takes appropriate technical and organisational measures designed to protect the personal data under our control. Depending on the nature of the processing, these measures may include:

• Restricting access to authorised personnel.

• Applying appropriate account access and authentication controls.

• Using secure communication channels and service configurations where available.

• Maintaining appropriate administrative and operational safeguards.

• Working with service providers subject to suitable security requirements.

• Monitoring systems and investigating suspected security incidents.

• Providing relevant privacy and security guidance to personnel.

• Maintaining procedures for handling personal data breaches.

No website, electronic transmission or storage system can be guaranteed to be completely secure. However, we take reasonable steps to reduce risks and respond appropriately when security concerns arise.

Where a personal data breach occurs, we will assess the incident and take the notification and remedial measures required by applicable law.

14. DATA SUBJECT RIGHTS

Subject to the conditions, exceptions and limitations provided by applicable law, you may have the following rights in relation to your personal data:

14.1 Right to be informed: To receive clear information about how your personal data is collected and processed.

14.2 Right of access: To request confirmation of whether we process your personal data and, where applicable, obtain access to that data.

14.3 Right to rectification: To request correction of inaccurate or incomplete personal data.

14.4 Right to erasure: To request deletion of personal data where the legal requirements for erasure are satisfied.

14.5 Right to restrict processing: To request that certain processing activities be restricted in circumstances recognised by law.

14.6 Right to object: To object to certain processing activities where the law provides that right, including applicable direct marketing processing.

14.7 Right to data portability: To receive certain personal data in a structured, commonly used and machine-readable format, or request its transfer to another controller where the legal conditions apply.

14.8 Right to withdraw consent: To withdraw consent where we rely on consent as the lawful basis for processing.

14.9 Rights relating to automated decision-making: To exercise applicable rights concerning decisions made solely through automated processing where those decisions have the legal or similarly significant effects described by law.

14.10 Right to lodge a complaint: To raise concerns with Bookteller and, where appropriate, lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

These rights are not absolute. We may be unable to fulfil a request in full where a lawful exemption applies, where doing so would adversely affect another person's rights, or where we are legally required to retain or process certain information.

Where permitted or required by law, we will explain the outcome of a request and the reasons for any limitation.

15. HOW TO EXERCISE YOUR RIGHTS

To exercise a data protection right or raise a privacy concern, contact us at:

Email: legal@bookteller.ng
Subject line: Data Protection Request

Please describe the nature of your request and provide sufficient information for us to identify the relevant records and respond appropriately.

We may request reasonable additional information to verify your identity or confirm your authority to act on behalf of another individual. Any information requested for verification will be handled for that purpose and in accordance with applicable law.

We will review and respond to requests within the period required by applicable law. Where a request cannot be fulfilled, or where an extension or further information is permitted or required, we will communicate with you as appropriate.

There is no charge for exercising your rights where the law requires the request to be handled free of charge. Applicable law may permit a reasonable fee or refusal in certain circumstances, such as manifestly unfounded or excessive requests.

16. COMPLAINTS AND PRIVACY GRIEVANCES

If you believe that Bookteller has processed your personal data unlawfully, disclosed it without proper authorisation, failed to protect it adequately or otherwise infringed your privacy rights, please contact us at legal@bookteller.ng.

Please include a description of your concern and sufficient details to help us investigate it.

We will assess the complaint, take appropriate steps to investigate, and seek to resolve the matter in accordance with our internal procedures and applicable legal requirements.

If you are dissatisfied with our response, or wish to raise a complaint with the supervisory authority, you may contact the Nigeria Data Protection Commission through its official website:

Nothing in this Policy prevents you from exercising any complaint or remedy available to you under applicable law.

17. CHILDREN'S PERSONAL DATA

Our hotel booking services are primarily intended for individuals who are legally capable of entering into the relevant booking or service arrangements.

We do not knowingly collect children's personal data for independent marketing or unrelated purposes without an appropriate lawful basis and the safeguards required by law.

Where a parent, guardian or adult making a reservation provides information about a child as part of a legitimate accommodation request, we will process only the information reasonably necessary for the relevant purpose and in accordance with applicable law.

If you believe that a child's personal data has been provided to us improperly, please contact us so that we can assess the matter and take appropriate action.

18. THIRD-PARTY WEBSITES AND SERVICES

Our website or communications may contain links to third-party websites, hotel websites, payment services, mapping services or other external platforms.

These services may have their own privacy policies, cookie practices and terms of use. Bookteller does not control every aspect of the privacy or security practices of independent third parties.

When you leave our website or interact directly with an external service, you should review the privacy information provided by that service.

This does not affect any responsibility Bookteller has under applicable law for personal data that we process or for third-party processing arrangements for which we are legally responsible.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our business operations, technology, services, legal requirements or data protection practices.

Where appropriate, we will publish the updated version on our website and revise the “Last Updated” date.

Where a change requires specific notification or consent under applicable law, we will take the necessary steps.

We encourage you to review this Policy periodically to remain informed about how we handle personal data.

20. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or want to raise a privacy-related concern, please contact:

Bookteller Nigeria Limited
Chevy View Estate, Lekki, Lagos, Nigeria
Email: legal@bookteller.ng
Website: https://bookteller.ng

Please use the subject line “Data Protection Request” or “Privacy Complaint” to help us direct your enquiry appropriately.

Bookteller Nigeria Limited is committed to handling personal data responsibly, respecting the rights of individuals and continually improving its data protection practices in accordance with applicable law.