Effective Date: 21 November 2025

Version: 2.0

1. INTRODUCTION AND SCOPE

This Privacy Policy governs the collection, processing, storage, and transfer of personal data by RealStay (hereinafter "the Application," "we," "our," or "us") in connection with our mobile application services. This Policy constitutes a binding legal agreement between RealStay and each user (hereinafter "you" or "data subject").

We are committed to processing personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA), the Nigeria Data Protection Commission (NDPC) General Application and Implementation Directive (GAID) 2025, and where applicable, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Policy applies to all personal data processed through the Application, including data collected during registration, property listing, booking transactions, messaging, and general usage.

2. DEFINITIONS

For purposes of this Policy:

• Personal Data: Any information relating to an identified or identifiable natural person, including but not limited to name, national identification number, location data, online identifier, or factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
• Processing: Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.
• Data Controller: RealStay, which determines the purposes and means of the processing of Personal Data.
• Data Processor: Any third-party entity that processes Personal Data on our behalf pursuant to a written Data Processing Agreement.
• Sensitive Personal Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health status, sexual life, or criminal convictions.

3. LEGAL BASIS FOR PROCESSING

We process Personal Data based on one or more of the following lawful grounds as prescribed under Article 26 of the NDPA and Article 6 of the GDPR:

a) Contractual Necessity: Processing required to perform our obligations under the Terms of Service, including facilitating bookings and managing user accounts. b) Consent: Explicit, informed, specific, and unambiguous consent obtained through affirmative action for specific processing activities, including marketing communications and data analytics. c) Legal Obligation: Processing necessary for compliance with applicable laws, regulations, or court orders. d) Legitimate Interests: Processing necessary for our legitimate business interests, including fraud prevention, service improvement, and platform security, provided such interests are not overridden by your fundamental rights and freedoms. A Legitimate Interest Assessment (LIA) has been conducted for each such processing activity.

4. PERSONAL DATA COLLECTED AND PROCESSED

4.1 User Registration Data

We collect the following Personal Data during account registration:

• Full legal name (first and last name)