Privacy policy

Last updated: [Owner to fill: publication date]

Civitas is software that gated residential estates use to run dues, visitor passes, the gatehouse, maintenance and estate communications. This policy explains what personal information Civitas stores, why it stores it, who can see it, and how you can have it deleted.

1. Who we are

Civitas is provided by Veridian Limited, [Owner to fill: registered address and RC number].

Civitas is used by estates: residents' associations, estate management companies and their committees. Your estate decides to use Civitas, registers residents and staff, and runs its own records. Civitas stores and processes that information on the estate's behalf. [Owner to confirm with counsel: controller and processor roles under the Nigeria Data Protection Act 2023, and whether a Data Protection Officer must be named here]

Privacy questions: [Owner to fill: privacy contact email].

2. What we store

Most of this is entered by your estate's committee when they register you. The rest is created as you use the app.

About you

• Name: title, first name and last name.
• Phone number and email address. These are how you sign in and how sign-in codes and receipts reach you.
• Your home in the estate: house number and street of each unit you live in, whether you are the unit's primary (billing) resident or a household member, and when you moved in or out.
• Staff and committee roles, if you hold one (for example chairman, treasurer, facility manager or gate guard), and, for facility managers, which phone is enrolled to sign in.
• Vehicle plate numbers on estate entry cards and card requests.

Visitors and deliveries

• Visitor passes you create: the visitor's name and, if you give them, their phone number and vehicle plate, plus when the pass is valid and how many times it can be used.
• Gate records: when a visitor was checked in and out, at which gate, and which guard logged it.
• Deliveries: courier name, rider's phone number, a description of the item, handling instructions, and the name, phone number and unit of anyone you nominate to collect it.

A visitor's or courier's details are about someone other than you. Only enter them with that person's knowledge.

Payments

• Your unit's account: dues, levies, fines and fees charged to the unit; payments made against them, with the amount, date, method and payment reference; and any proof-of-payment file you upload for a bank transfer.
• Card and online payments go through Paystack. To start a payment, Civitas sends Paystack the amount, your email address (for the receipt) and a reference. You enter your card or bank details on Paystack's own page. Civitas never receives or stores card numbers or bank credentials. Paystack's handling of payment data is covered by Paystack's privacy policy.

Estate life

• Maintenance requests: the category, your description, and any photo you attach.
• Community board notices: the text and any image you post.
• Facility bookings, group memberships and announcement acknowledgements.
• Polls and elections: each vote is recorded against the voter, which is how the system stops anyone voting twice.
• Panic alerts: who raised the alert, the house number, and when it was raised and resolved.

Notifications and sign-in

• Push notification registrations. When you allow notifications, your browser or phone gives us a delivery address for its push service (for example Google's or Apple's). We store it so we can send you alerts, and we delete it when you turn notifications off or delete your account.
• Notifications sent to you, and whether they were delivered.
• Sign-in codes, stored only as a one-way hash and valid for 5 minutes.
• Sign-in events: a record that you signed in, and when. Your estate uses this to see how many residents use the app.
• Your IP address is used briefly, in memory, to limit repeated sign-in attempts. It is not saved to our database. [Owner to confirm: request-log retention at the hosting provider]

Records kept by the estate

• An audit trail of actions taken in the system, such as payments recorded, residents enrolled or offboarded, and gate events. It is append-only: entries can't be edited or removed after they are written, so it is kept free of contact details.
• Estate documents such as by-laws, house rules and minutes, uploaded by the committee.

3. Camera and photos

• QR scanning at the gate. The gatehouse tablet, and the check-in screen used at estate elections, use the device camera to read the QR code on a visitor pass, entry card or ballot. The code is decoded on the device itself. Camera images are not uploaded or stored.
• Photos you choose to attach. The resident app opens your camera or photo library only when you choose to attach a photo, for example to a maintenance request, a notice or a proof of payment. Only the picture you pick is uploaded.

4. On your device

The app keeps your sign-in session and a few preferences, such as light or dark mode and alerts you've dismissed, in your browser's or phone's local storage. Signing out removes the session.

Civitas has no advertising and no third-party analytics or tracking. We don't sell personal information or share it for advertising.

5. Why we use it

• To sign you in and confirm you belong to your estate.
• To let your visitors, deliveries and vehicles in at the gate.
• To bill and receipt estate dues and fees, and keep the estate's accounts.
• To send alerts: announcements, panic alerts, dues reminders and updates on your requests.
• To run the estate: maintenance, bookings, notices, polls and elections.
• To keep the system secure and keep an audit trail the estate can rely on.

[Owner to confirm with counsel: the lawful basis for each purpose under the NDPA 2023, e.g. contract with the estate, legitimate interests, legal obligation]

6. Who can see it

• Your estate's committee and staff see the information their role needs. Each estate's data is kept separate from every other estate's.
• Gate staff see what they need to admit your visitors, deliveries and vehicles.
• Other residents see what you choose to post, such as community notices.
• Civitas staff can access estate data when needed to support the estate, fix problems or meet a legal requirement.
• Authorities, where we are legally required to disclose information.

7. Service providers

Civitas uses these companies to run the service. Each processes information only to provide its part of it.

Because the database is in the United States, your information is transferred outside Nigeria. [Owner to confirm with counsel: the safeguard relied on for cross-border transfer under the NDPA 2023]

8. How it is protected

• Residents' and staff members' phone numbers and email addresses, and the plate numbers on entry cards, are encrypted in the database (AES-256-GCM). Sign-in lookups use a keyed one-way hash, so the plain number isn't needed to find your account. Visitor and delivery contact details are not encrypted this way.
• Every estate's records are isolated by the database itself (row-level security), not only by the application.
• There are no passwords to steal. You sign in with a one-time code that expires in 5 minutes, and repeated attempts are blocked.
• Payment records are append-only. A recorded payment can't be silently edited or deleted, only corrected by a visible reversing entry.
• All traffic to Civitas is encrypted in transit (HTTPS).

9. How long it is kept

• Your account is kept while your estate has you registered. When the committee offboards you, your access ends. Deleting your account (section 10) removes your personal details from the app. What the estate may keep afterwards is set out in the next three points.
• Payment records are kept for as long as the estate uses Civitas, because they are the estate's financial records. They are recorded against the unit. After your account is deleted, anything that showed your name shows a reference instead, such as "Closed account CA-7F3K2Q".
• Your name, after you delete your account, is kept only if you had a financial link to the estate: you were at some point the primary occupant of a unit, the person who answers for its dues, or you held a finance role such as treasurer. The estate then keeps your name with its financial records for 6 years, so that past dues and payments can still be reconciled. [Owner to confirm: the period Nigerian law requires an association to keep accounting records] It is stored encrypted, apart from the rest of the app, and only the chairman and treasurer can read it. It is erased automatically when the period ends. If you were only a member of a household, nothing is kept.
• Your phone number and email, after you delete your account, are kept only if your unit owed money at that moment, so the estate can follow up the balance. They are erased as soon as the unit is no longer in debt, and after 90 days at the latest. If nothing was owed, they are erased at once.
• Visitor contact details are removed automatically once the estate's visitor-data retention period has passed: 180 days unless the estate has set a different period (anything from 30 to 730 days). The clock starts when a visitor pass expires, or when a parcel is collected or cancelled. At that point the visitor's phone number and vehicle plate are cleared, as are the courier's phone number and the name and phone number of anyone nominated to collect a parcel. The visitor's name and the times they came and went stay in the gate log for as long as the estate uses Civitas. Entries on the estate's visitor watchlist stay while the watchlist entry is active.
• Sign-in codes stop working after 5 minutes.
• The audit trail is kept permanently and can't be edited. It records what was done and when, not contact details. When a committee member corrects someone's name, phone or email, the entry notes which details changed, not what they were changed to.
• Backups of the database are kept for [Owner to fill: backup / point-in-time-restore window], then overwritten.
• If an estate stops using Civitas, its data is [Owner to fill: what happens to an estate's data at the end of its contract, and how quickly].

10. Your rights, and deleting your account

You can ask to see the personal information held about you, have it corrected, object to how it's used, or have it deleted.

• Correct your details: ask your estate committee. The chairman or facility manager can update your name, phone and email.
• Delete your account: in the app, go to Home → Account → Delete my account, or use civitas.ng/delete-account.html. It takes effect straight away, and before you confirm it shows what the estate will keep in your case. Deleting is never refused or delayed because money is owed, and it does not cancel what is owed. That page lists exactly what is erased and what the estate keeps.
• Anything else, or if you can't sign in: email [Owner to fill: privacy contact email]. We may confirm your identity with your estate committee first.

If you're unhappy with how your information is handled, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

11. Children

Civitas accounts are created by estates for adult residents and staff. The app isn't directed at children, and we don't knowingly create accounts for anyone under 18. [Owner to confirm: minimum age, if household members under 18 are ever registered]

12. Changes and contact

When this policy changes, the date at the top changes with it. [Owner to fill: how estates and residents are told about significant changes]

Veridian Limited, [Owner to fill: postal address]. Email: [Owner to fill: privacy contact email].