Privacy Notice
How HotelOpX collects, uses, and protects personal data — under the Nigeria Data Protection Act 2023 and the NDPR 2019.
Last updated: 12 August 2026
Who we are
HotelOpX provides hotel management software to hospitality businesses in Nigeria. Our role depends on whose data it is:
- Controller —for people who contact us through this website, and for the staff of businesses that subscribe. We decide why and how that data is used.
- Processor —for hotel guest data held in the platform. The hotel decides how it is used; we only act on their instructions. If you are a guest, contact the hotel directly — though we will help them respond.
What we collect and why
| Purpose | Data | Lawful basis | Kept for |
|---|---|---|---|
| Responding to a demo or sales enquiry | Name, email, phone, company name, property size, your message | Consent — you tick the box on the contact form | 24 months from submission, then deleted automatically |
| Providing the HotelOpX platform to a hotel that subscribes | Staff names, emails, work phone numbers, role, payroll and attendance records | Contract — necessary to deliver the service the hotel has bought | For the life of the subscription, plus 7 years for payroll and tax records as Nigerian law requires |
| Processing hotel guest bookings on behalf of our customers | Guest name, contact details, identification document, stay history, folio charges | Contract and legal obligation — the hotel is the data controller; HotelOpX is its processor | 3 years after the guest's last stay, then identifying fields are redacted automatically |
| Keeping the platform secure and investigating abuse | IP address, browser user agent, login attempts, audit logs | Legitimate interest — preventing fraud and unauthorised access | 12 months |
Retention
We do not keep personal data longer than we need it. Retention is enforced automatically, not by hand: a nightly job removes enquiry records past 24 months and redacts guest records 3 years after their last stay, including deleting any identification document held in storage.
Where a longer period is required by law — payroll and financial records must be kept for 7 years — we keep only what the law requires and remove the rest.
Your rights
- •Access — ask for a copy of the personal data we hold about you
- •Rectification — have inaccurate details corrected
- •Erasure — ask us to delete your data where we have no overriding obligation to keep it
- •Restriction — ask us to pause processing while a concern is resolved
- •Portability — receive your data in a machine-readable format
- •Objection — object to processing based on legitimate interest
- •Withdraw consent — at any time, without affecting processing already carried out
To exercise any of these, email privacy@hotelopx.com. We respond within 30 days. If you are not satisfied, you may complain to the Nigeria Data Protection Commission (NDPC).
Who else processes your data
We use the following providers. Each is bound by a data processing agreement and may only act on our instructions.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, file storage and outbound email | United States | Standard Contractual Clauses |
| Vercel | Website and dashboard hosting | United States | Standard Contractual Clauses |
We do not sell personal data, and we do not share it for advertising.
If something goes wrong
If a data breach occurs that is likely to affect your rights, we notify the NDPC within 72 hours of becoming aware of it, and we tell affected people directly without undue delay. We maintain an internal breach response procedure covering detection, containment, assessment, notification, and review.
Data Protection Officer
Our Data Protection Officer is responsible for overseeing how we handle personal data and is your point of contact for any question or complaint.
- dpo@hotelopx.com
- Privacy
- privacy@hotelopx.com
- Regulator
- Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
We review this notice at least annually and whenever our processing changes materially. Where a change affects you, we will tell you before it takes effect.