Privacy notice
This notice explains how ELALAN Construction Company Limited ("ELALAN", "we", "us" or "our") collects, uses, stores, shares and protects personal data when you create or use the ELALAN customer account, communicate with us, express interest in a property, make or manage a reservation, join a waitlist, manage allocation preferences, become assigned to a property, make payments, submit documents, attend events or otherwise use connected customer services.
Information shown in the portal may be connected across your verified identity, property journey, reservation, allocation, billing, payment, document, communication and support records so that ELALAN can present one consistent customer history.
1. Who we are and scope
ELALAN Construction Company Limited operates this customer account and determines the purposes for which customer personal data is processed in connection with ELALAN property and customer services. This notice applies to the portal at portal.elalan.com and to information processed through the account workflows that support it.
Our head office is at 9 Macgregor Road, Ikoyi, Lagos, Nigeria. You can contact us at info@elalan.com or through the portal contact page.
We process personal data in accordance with applicable Nigerian data-protection requirements, including the Nigeria Data Protection Act 2023 and applicable guidance issued by the Nigeria Data Protection Commission (NDPC).
2. Personal data we collect
Account and identity information
- Name, display name, title, pronouns where provided, date of birth, preferred language, locale and time zone.
- Email addresses and telephone numbers, verification status, primary-contact choices and contact labels.
- Residential, correspondence and billing addresses.
- Company and job-title information where you choose to provide it.
- Identity and KYC records, which may include national identity documents, passports, driver licences, proof of address, photographs/selfies, issuing country, expiry information and verification results.
Account-security and technical information
- Authentication and verification status, two-factor or one-time verification events, password-reset events and security records.
- Session identifiers, sign-in history, IP address, device/browser information, user agent, timestamps and session status.
- Security and request metadata used to detect abuse, protect account access, prevent fraud and investigate errors.
Property-journey information
- Properties and projects you browse, save or express interest in.
- Reservation records, selected units, availability checks, reservation status, notes and journey history.
- Allocation preferences, preference rank, selected alternative units and preference notes.
- Waitlists, selected units, status, date joined and any note you provide.
- Property assignments, unit codes, property accounts, allocation/assignment history and customer next actions.
Financial and transaction information
- Payment plans, instalment schedules, billing records, amounts due, payment references, balances and transaction status.
- Payment proof files and information you submit, including transfer evidence, amount, date and payment reference.
- Payment clarifications, responses, confirmations and reconciliation history.
- Where payment instructions are displayed, the account may connect your billing record to the relevant payment instructions. The portal is not intended to store your online-banking password or PIN.
Documents, support and engagement
- Letters, receipts, statements, project updates, customer documents, document-view state and download activity where recorded.
- Support enquiries, contact requests and information you provide when asking for assistance.
- Event registrations, promotion interactions, announcements, news/content interactions and related customer activity.
- Communication preferences, channels, purposes/topics, preferred delivery time, quiet hours, pause settings, do-not-contact choices and consent history.
- Engagement-session information used to understand whether featured account content was displayed, opened or dismissed. The portal currently uses a pseudonymous browser-storage visitor identifier and session identifier for this feature.
Information from other sources
We may receive or verify information from ELALAN project, property, finance, customer-service and identity systems; authorised representatives acting for you; banks or payment-service providers involved in a transaction; professional advisers; and service providers supporting account delivery. Where required, we will provide the information prescribed by applicable law about the source and processing.
3. How and why we use personal data
| Purpose | Typical information | Typical lawful basis |
|---|---|---|
| Create, verify and secure your account | Identity, contacts, credentials/status, session and device information | Contract, legitimate interests, legal obligations |
| Identity/KYC verification and fraud prevention | Identity documents, photographs, addresses, verification results | Legal obligations, legitimate interests, contract where applicable |
| Property discovery and customer journey | Interests, reservations, unit availability, preferences, waitlists, assignments | Contract or steps at your request, legitimate interests |
| Billing, payment administration and reconciliation | Plans, schedules, billing records, proofs, confirmations, account balances | Contract, legal obligations, legitimate interests |
| Documents, notices and customer support | Documents, messages, support records, transaction history | Contract, legal obligations, legitimate interests |
| Optional marketing and promotions | Contact channels, topic consent, property interests and engagement | Consent where required; other lawful bases only where permitted |
| Security, diagnostics and service improvement | Logs, device/session data, error/request metadata, usage/engagement events | Legitimate interests, legal obligations |
The lawful basis depends on the specific activity. Where we rely on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal. We do not treat silence or inactivity as consent.
4. Communications and marketing
Your account supports email, SMS, WhatsApp Business, in-app, push and voice communication preferences. You may also set topic-level choices, a preferred channel, preferred delivery time, quiet hours, a pause period and a do-not-contact preference.
Security, verification, legal, reservation, payment, document and other essential service messages may still be sent where necessary to provide the service, protect your account, satisfy a legal obligation or complete a transaction. Optional marketing is separate. You can change or withdraw optional marketing choices through Communication consent and Communication preferences.
See the Marketing policy for more detail.
5. Sharing and service providers
We may disclose personal data only where reasonably necessary for the stated purpose, including to authorised ELALAN personnel and internal systems, companies supporting ELALAN customer or property operations, identity/KYC providers, hosting and storage providers, communications providers, payment and reconciliation providers, professional advisers, transaction counterparties where relevant, regulators and law-enforcement authorities where legally required.
We expect processors and service providers handling personal data for ELALAN to act only on authorised instructions, apply appropriate confidentiality and security measures, and use the information only for the contracted purpose.
We do not describe an internal transfer between connected ELALAN systems as a sale of your personal data. ELALAN does not sell customer personal data for unrelated third-party advertising.
See the Data sharing policy for recipient categories and safeguards.
6. International transfers
Some technology, communications, cloud or support providers may process information outside Nigeria. Where personal data is transferred internationally, ELALAN will use a transfer basis and safeguards required by applicable Nigerian data-protection law, taking account of adequacy, contractual or other recognised protection mechanisms and the nature of the information transferred.
7. How long we keep information
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, tax, fraud-prevention, transaction, dispute and record-keeping obligations.
Retention varies by record type. For example, an active customer account, live reservation, assigned property, payment plan or unresolved support matter may require ongoing records. After the relationship ends, some records may still need to be kept to evidence a property transaction, payment, consent decision, security event or legal obligation. When information is no longer required and no other lawful basis applies, it will be deleted, anonymised or otherwise disposed of securely.
8. Security
ELALAN uses technical and organisational safeguards appropriate to the account and information involved. The current portal architecture includes server-side authenticated sessions, HTTP-only session cookies, CSRF protection, restricted customer routes, verification workflows, session controls, access-controlled service calls, security logging and role/customer-context checks.
No internet service can guarantee absolute security. You should protect your password, verification messages and devices, sign out on shared devices, and contact us promptly if you believe your account has been compromised.
If a personal-data breach occurs, ELALAN will assess the risk and make notifications or communications required by applicable law.
9. Automated processing and account decisions
The portal automatically combines system records to display availability, reservation status, payment status, customer next actions, navigation counts and relevant content. It may also record engagement with featured content and use system rules to determine what account content or actions should be shown.
Where an automated decision would produce legal or similarly significant effects, ELALAN will apply the safeguards required by applicable law, including human intervention or a means to challenge the decision where required. Property availability, assignment, payment confirmation and other transaction-critical states remain subject to the authoritative ELALAN business record and applicable review process.
10. Your privacy rights
Subject to applicable law and any lawful limitations, you may have the right to:
- be informed about how your personal data is processed;
- request access to personal data held about you;
- request correction of inaccurate, outdated, incomplete or misleading data;
- request deletion where the data is no longer necessary and no other lawful basis requires retention;
- request restriction of processing in applicable circumstances;
- object to processing based on applicable grounds, including objecting at any time to direct marketing;
- withdraw consent where processing is based on consent;
- request data portability where the right applies;
- challenge certain solely automated decisions and request human intervention where applicable; and
- lodge a complaint with the Nigeria Data Protection Commission.
You can update many profile and communication records directly from your account. For rights that cannot be completed safely through self-service, contact ELALAN. We may need to verify your identity before fulfilling the request.
11. Contact, complaints and changes to this notice
For privacy questions or requests, contact ELALAN at info@elalan.com, use Contact ELALAN, or write to ELALAN Construction Company Limited, 9 Macgregor Road, Ikoyi, Lagos, Nigeria.
If you believe your data-protection rights have been infringed, you may also lodge a complaint with the Nigeria Data Protection Commission. Information about the Commission and data-subject rights is available from the official NDPC website.
We may update this notice when our services, legal obligations or processing practices change. Where a change is material, we will provide an appropriate notice and, where required, request a new decision or acknowledgement for the applicable policy version.