Transcorp Hotels Plc (“Transcorp Hotels”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your Personal Data in compliance with the Nigeria Data Protection Act (NDPA) 2023, other applicable data protection laws, and global best practices.

1. Scope of Policy

This Privacy Policy applies to your use of our website, interactions with our personnel, and any services offered by Transcorp Hotels. By accessing our services, you agree to the practices described in this policy.

2. Key Definitions

• Affiliated Third Parties: Companies with shared ownership, management, or strategic partnerships, including advisers, consultants, bankers, vendors, or subcontractors.
• Personal Data: Any information relating to an identifiable person, including name, email, address, IP address, payment details, etc.
• Sensitive Personal Data: Includes information on racial origin, political opinions, health status, sexual orientation, or trade union membership.
• Processing: Any operation involving Personal Data, such as collection, storage, use, sharing, or deletion.
• Data Controller: The entity responsible for determining how Personal Data is processed.
• NDPA: Nigeria Data Protection Act, 2023.
• NDPC: Nigeria Data Protection Commission

3. Our Guiding Principles on Data Processing

In processing your personal data, we adhere strictly to the principles of data processing as set out under S.24 of the NDPA. Our obligations include ensuring that personal data is:

1. Processed in a fair, lawful, and transparent manner.
2. Collected for specified, explicit, and legitimate purposes, and not further processed in ways incompatible with these purposes.
3. Adequate, relevant, and limited to the minimum necessary for the purposes for which it was collected or further processed.
4. Retained for no longer than is necessary to achieve the lawful purposes for which it was collected or further processed.
5. Accurate, complete, not misleading, and, where necessary, kept up to date.
6. Processed securely to ensure data confidentiality, integrity, and availability while preventing unauthorized access, loss, destruction, or damage.

We are committed to accountability, demonstrating a duty of care to you, and upholding data confidentiality, integrity, and availability.

4. Data Collection

We collect and process the following categories of Personal Data:

• Identity Data: Name, title, date of birth, gender.
• Contact Data: Address, email, phone number.
• Payment Data: Card details, billing information.
• Technical Data: IP address, browser type, device details.
• Usage Data: Information about how you interact with our website.
• Marketing Data: Preferences for marketing communication.

How Data is Collected:

• Directly from you (e.g., when you complete forms, subscribe to newsletters, or contact us).
• Automatically (e.g., through cookies and similar technologies). Refer to our Cookies Policy for details.

We do not intentionally collect Sensitive Personal Data unless required for a specific purpose and with your explicit consent.

5. Purpose of Data Processing

Your Personal Data is processed for the following purposes:

• To improve your experience on our website.
• To analyze traffic and website usage patterns.
• To respond to your inquiries, feedback, and service requests.
• To provide information about our services, activities, or promotions (with your consent).
• To fulfill contractual obligations.
• To comply with legal and regulatory requirements.
• To ensure data security and prevent unauthorized access.

We ensure that your data is only processed for compatible purposes. If we need to use your data for a different purpose, we will notify you and seek your consent.

6. Legal Basis for Processing

We process your Personal Data based on the following legal grounds:

• Consent: Where you have given clear and explicit consent. You have the right to withdraw your consent at any time.
• Contractual Obligations: To fulfill obligations under a contract.
• Legal Compliance: To comply with applicable laws and regulations.
• Legitimate Interest: To pursue our legitimate business interests, provided it does not override your fundamental rights.
• Vital Interest: Based on the principles stated in the NDPA

7. Data Subject Rights

Under the NDPA 2023, you have the following rights:

• Access: Request access to your Personal Data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your Personal Data, subject to legal or regulatory retention requirements.
• Objection: Object to the processing of your data in certain circumstances.
• Data Portability: Receive a copy of your data in a structured format.
• Right in Relation to Automated Decision Making: Entitles you to human intervention in automated decisions.
• Right to be Informed: Understand how and why your data is being processed.
• Withdraw Consent: Withdraw previously given consent at any time.
• Complain: Lodge complaints with the Nigeria Data Protection Commission (NDPC).

To exercise your rights, complete the Subject Access Request (SAR) Form and send it to us at privacy@transcorphotelsplc.com.

8. Data Sharing

In carrying out our mandate effectively, we may require the use of professional service providers within or outside Nigeria. We may also share personal data with Regulatory Authorities and Transcorp Group. We do not sell your Personal Data and ensure that professional service providers we work with provide adequate data protection measures.

9. Data Security

We have implemented robust measures to protect your Personal Data from unauthorized access, alteration, disclosure, or destruction, including:

• Encrypted storage and secure servers.
• Access control policies.
• Regular security audits.

In the event of a data breach, we will notify the NDPC within 72 hours and inform affected individuals, as required.

10. Cross-Border Data Transfers

Your Personal Data may be transferred to and processed in countries outside Nigeria. We ensure that any such transfer complies with NDPA by implementing adequate safeguards such as standard contractual clauses and requiring equivalent data protection standards.

11. Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Factors influencing retention periods include:

• Legal and regulatory obligations.
• The nature and sensitivity of the data.
• The risk of harm from unauthorized use or disclosure.

12. Cookies Policy

We use cookies to enhance your browsing experience. Cookies are small text files stored on your device. They help us:

• Understand website usage patterns.
• Deliver relevant advertisements and content.
• Improve site functionality.

You can manage your cookie preferences through your browser settings. Note that disabling cookies may limit certain functionalities. Read our Cookies Policy here

13. Reservation and Booking

For reservations and bookings, users may be directed to Aura by Transcorp Hotel’s website, a digital hospitality platform. Guest information will be processed and retained in accordance with Aura by Transcorp Hotel’s privacy policies and as permitted by applicable laws.

Additionally, when making a reservation through the Transcorp Hilton Abuja website, certain guest information will be collected, processed and retain solely for the purpose of fulfilling the reservation, as outlined in the Transcorp Hilton Abuja’s Privacy Policy. 

14. Subject Access Request Procedure

To exercise your data rights:

1. Complete the Subject Access Request (SAR) Form.
2. Send the form to privacy@transcorphotelsplc.com.
3. We will acknowledge receipt within 5 business days and may request additional information for verification.
4. We aim to fulfill requests within one month, subject to complexity and volume.

15. Updates to this Policy

We may update this policy periodically. Changes will be communicated via our website or email. Please review this policy regularly to stay informed of updates.

16. Contact Us

For questions, requests, or complaints regarding this Privacy Policy, please contact us at:

• Email: privacy@transcorphotelsplc.com
• Address: 1 Aguiyi Ironsi Street, Maitama, FCT, Abuja, Nigeria

This Privacy Policy was last updated on 10th October 2024.