Data sharing policy

Data sharing policy

This policy explains when ELALAN may disclose or make customer personal data available to another team, system, company or organisation. It supplements the Privacy notice.

1. Our sharing principles

When ELALAN shares personal data, we aim to apply the following principles:

• purpose limitation — disclose data for a defined customer, transaction, security, legal or operational purpose;
• data minimisation — disclose only the fields reasonably needed;
• authorisation — restrict access to approved personnel, systems and service providers;
• security and confidentiality — use appropriate technical, contractual and organisational safeguards;
• accountability — retain appropriate records of processing, permissions, service arrangements or transfer grounds; and
• customer transparency — explain material recipient categories and honour applicable privacy rights.

2. Sharing within ELALAN customer and property operations

The portal connects several operational functions so that the same verified customer can move through one property journey. Personal data may therefore be made available to authorised personnel or systems responsible for:

• account access, identity verification and security;
• property/project catalogue and availability management;
• interests, reservations, waitlists, allocation preferences and assignments;
• property accounts, payment plans, billing, reconciliation and confirmations;
• document management and project/customer updates;
• notifications, communication consent and customer engagement; and
• customer service, audit, legal, compliance and fraud investigation.

Internal access should be role-appropriate and customer/context scoped rather than unrestricted.

3. Authorised service providers

ELALAN may use processors or service providers for functions such as:

• cloud hosting, infrastructure, backup, storage and security;
• email, SMS, WhatsApp Business, push or voice communication delivery;
• identity/KYC document processing or verification support;
• payment processing, bank/payment-reference handling and reconciliation support;
• document/file delivery, malware screening or content infrastructure;
• customer-support tooling, diagnostics, monitoring and incident response; and
• professional technology, compliance, audit or legal services.

Where a provider acts on ELALAN's instructions, we expect it to process the information only for the authorised service, apply appropriate safeguards, maintain confidentiality and support ELALAN's data-protection obligations.

4. Property, payment and professional transaction recipients

Depending on the property and transaction, it may be necessary to share relevant data with parties involved in delivering or documenting the transaction, such as authorised project/property administrators, finance teams, banks or payment providers, insurers where applicable, lawyers, auditors, valuers, consultants, facility or post-completion service providers, and other professional advisers.

The information shared should be limited to what is needed for the relevant step—for example, a payment provider may need a customer/payment reference and amount, while a legal adviser may require transaction and identity documents relevant to preparing or reviewing a property document.

5. Legal, regulatory and protective disclosures

ELALAN may disclose personal data where required or permitted by law, court order, regulatory request or lawful process, or where reasonably necessary to establish, exercise or defend legal claims, investigate fraud, protect safety, secure the account, enforce contractual rights or cooperate with competent authorities.

Where legally permitted, we will consider the scope and validity of a request and disclose only the information reasonably required.

6. Marketing and third-party advertising

ELALAN may use communications providers to deliver marketing that you have chosen to receive. Those providers receive only the information needed to route and record the communication.

ELALAN does not sell customer personal data for unrelated third-party advertising. If ELALAN ever proposes a materially different sharing arrangement for third-party marketing, it will update the applicable notice and obtain any consent required by law before that processing begins.

7. International processing and transfers

A technology or communications provider may operate infrastructure outside Nigeria. Where personal data is transferred from Nigeria to another country, ELALAN will use a basis permitted under applicable Nigerian data-protection law and assess the safeguards available for the transfer.

Depending on the circumstances, safeguards may include an adequacy basis, contractual protections, binding rules, approved transfer mechanisms or another lawful condition recognised under the Nigeria Data Protection Act.

8. Safeguards, access control and records

The portal architecture is designed to keep browser requests within the authenticated customer context. Server-side services resolve the logged-in customer rather than trusting a customer identifier supplied by the browser for sensitive actions. Connected services use authenticated service calls, and protected pages are covered by route middleware and account-readiness controls.

ELALAN may also use confidentiality terms, processor agreements, access restrictions, security controls, logging, retention limits and incident-management requirements appropriate to the recipient and information involved.

9. Your rights and questions about recipients

You may ask ELALAN for information about the categories of recipients to whom your personal data has been or may be disclosed, subject to applicable law and legitimate confidentiality/security limitations.

You may also exercise applicable rights described in the Privacy notice, including access, correction, objection, restriction, erasure and withdrawal of consent where applicable.

Questions about data sharing can be sent to info@elalan.com or through Contact ELALAN.