1. Introduction

Eko Hotels & Suites values you as our guest and is committed to protecting your privacy. This Privacy Notice explains how we collect, use, share and protect your personal data, and the rights you have. It reflects the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive issued under it by the Nigeria Data Protection Commission (NDPC).

In this notice, "Eko Hotels & Suites", "we", "us" and "our" refer to Eko Hotels Limited, the data controller identified in Section 2.

2. Who We Are

Eko Hotels & Suites operates the hotels, restaurants, event venues and other facilities presented on this website. The data controller responsible for your personal data is Eko Hotels Limited, Plot 1415, Adetokunbo Ademola Street, Victoria Island, Lagos, Nigeria.

You can contact us about privacy matters using the details in Section 19.

3. Scope of This Notice

This notice applies to personal data we process about:

• guests and customers who make, hold or use reservations or purchase our services;
• visitors to and users of this website and our online services;
• organisers of and attendees at meetings, conferences, weddings and other events;
• representatives of our suppliers, contractors and business partners;
• visitors to our properties, including people recorded by visitor logs or CCTV;
• job applicants and employees; and
• anyone else who shares personal data with us.

4. Personal Data We Collect

Depending on how you interact with us, we may collect:

5. How We Collect Personal Data

• Directly from you, when you make a reservation, complete a form, subscribe to our newsletter, use our chat service, contact us by phone or email, check in, or give us feedback.
• Automatically, through cookies and similar technologies when you use our website (see Section 10 and our Cookie Policy).
• From third parties, such as online travel agencies, travel agents, booking and reservation platforms, corporate clients and event organisers.
• At our properties, through visitor logs, CCTV and other security systems.

6. How We Use Personal Data

We use personal data to:

• manage reservations and registration, including pre-arrival communication, payments and deposits;
• provide our services during your stay or visit, including check-in and check-out, concierge, housekeeping, Wi-Fi, dining, spa, fitness and recreation;
• plan and deliver meetings, events and weddings;
• respond to enquiries, requests and complaints;
• operate, secure and improve our website and online services;
• send marketing communications where permitted (see Section 9);
• keep our guests, staff, visitors and properties safe, and respond to incidents and emergencies;
• recruit staff; and
• comply with our legal and regulatory obligations and establish, exercise or defend legal claims.

7. Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so, namely where:

• it is necessary for a contract with you, such as a reservation, or to take steps at your request before entering into one;
• it is necessary to comply with a legal obligation, such as guest registration or tax requirements;
• it is necessary to protect vital interests, yours or someone else's, for example in an emergency;
• it is necessary for our legitimate interests, such as security, fraud prevention and improving our services, where those interests are not overridden by your rights and freedoms; or
• you have given consent, for example to marketing communications or non-essential cookies. You can withdraw consent at any time without affecting processing carried out before you withdrew it.

We process sensitive personal data only where the law permits, for example with your explicit consent or where necessary to protect vital interests.

8. Reservations and Booking Services

Online room reservations made through this website are handled by a third-party booking platform. The details you enter when you book are collected through that platform in order to process your reservation. Eko Hotels Limited does not store payment-card details entered online. Payment-card information entered online is processed by the relevant booking and payment service providers.

The terms that apply to your booking, including rate conditions and cancellation terms, are shown during the booking process and in your booking confirmation. If you book through an online travel agency or another third party, that party will also process your personal data under its own privacy notice.

9. Marketing Communications

We send marketing communications, such as offers and news about our hotels and events, only where you have agreed to receive them or as otherwise permitted by law. You can opt out at any time by contacting us (see Section 19) or by using any unsubscribe option provided in the message. Opting out will not affect service messages about your bookings.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies, some of which are provided by third parties. Strictly necessary technologies are used to operate and secure the website. All other technologies are used only with your consent, which you can give, refuse or change at any time using Cookie Settings in the website footer. For full details, please see our Cookie Policy.

11. Sharing Personal Data

We may share personal data with:

• service providers who act on our behalf, including website hosting and management, booking and reservation systems, payment processors, chat and guest-messaging providers, and IT and security providers;
• online travel agencies and travel partners, where you book through them;
• event organisers and corporate clients, where you attend an event or travel under their arrangements;
• professional advisers, such as auditors, lawyers and insurers;
• public authorities, regulators and law enforcement agencies, where required by law; and
• a successor or purchaser in connection with a business reorganisation or sale.

We take steps to ensure that service providers process personal data only on our instructions and protect it appropriately.

12. International Transfers

Some of our service providers may process personal data outside Nigeria. Where personal data is transferred outside Nigeria, Eko Hotels Limited will ensure that the transfer is carried out in accordance with the Nigeria Data Protection Act 2023 and applicable requirements of the Nigeria Data Protection Commission.

13. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting and reporting requirements. When it is no longer needed, we securely delete it or anonymise it so that it can no longer be linked to you.

14. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, and we check your identity when you contact us about your personal data. If a personal data breach occurs, we will notify the NDPC and affected individuals where the law requires.

15. Your Data Protection Rights

Subject to the law, you have the right to:

• find out whether we process your personal data and request a copy of it;
• have inaccurate or incomplete personal data corrected;
• have your personal data erased in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing, including processing for direct marketing;
• withdraw your consent at any time, where processing is based on consent;
• receive personal data you have provided to us in a structured, commonly used and machine-readable format, and have it transferred to another organisation where applicable; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you, except as permitted by law.

To exercise any of these rights, please contact us using the details in Section 19. We may need to verify your identity before we respond.

16. Children

Our website and online services are not directed at children. Where we process a child's personal data, for example when a child stays with a parent or guardian, we collect it from the parent or legal guardian, and where we rely on consent, we obtain the consent of the parent or legal guardian.

17. CCTV and Property Security

We operate CCTV at our properties for the safety and security of our guests, staff and visitors, and to prevent and detect crime. Recordings are kept for the period set out in Section 13 and may be disclosed to law enforcement agencies where required by law.

18. Third-Party Websites and Services

Our website contains links to, and features provided by, third parties. These include social media pages, our online booking platform, maps, chat and virtual tours. These third parties have their own privacy notices, and we are not responsible for their practices. Please review their notices before providing them with personal data.

19. Contact and Privacy Enquiries

For questions about this notice or to exercise your rights, please contact:

20. Complaints to the NDPC

If you have concerns about how we use your personal data, please contact us first so that we can try to resolve them. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC). Details are available at www.ndpc.gov.ng.

21. Changes to This Notice

We may update this notice from time to time to reflect changes in our practices or in the law. When we do, we will update the effective date at the top of this notice. Where changes are significant, we will take reasonable steps to bring them to your attention, for example by a notice on our website.