Privacy Notice

Wavela Experiences Limited ("Wavela", "we", "us", or "our") operates an online marketplace and hospitality technology platform (the "Platform") that facilitates the discovery, booking and management of hospitality, tourism and lifestyle experiences, including short-term accommodation rentals, curated experiences, events, excursions, Water-Based Services and other related services.

For the purposes of applicable data protection laws, Wavela is the Data Controller in respect of Personal Data collected through the Platform, except where otherwise expressly stated.

We determine the purposes and means of processing Personal Data collected through the Platform and ensure that such processing is carried out in accordance with applicable law.

This Privacy Notice applies to Personal Data collected through: the Wavela website; the Wavela mobile applications; Partner onboarding processes; Guest bookings and reservations; Water-Based Service bookings; communications with Users; customer support interactions; marketing and promotional activities; and any other services made available through the Platform.

This Privacy Notice applies to all Users of the Platform, including Guests, Partners, property owners, boat operators and Water-based Service providers, corporate clients, and visitors to the Platform.

By accessing or using the Platform, creating an Account, making a Booking, listing a Property or Experience, engaging with a Water-Based Service, communicating with Wavela, or otherwise providing Personal Data to us, you acknowledge that you have read and understood this Privacy Notice and that your Personal Data will be processed in accordance with its terms.

In this Privacy Notice, the following words and expressions have the meanings set out below:

We may collect Personal Data that you voluntarily provide to us, including your full name; email address; telephone number; residential or business address; date of birth, account login credentials; profile photographs; identity verification documents; government-issued identification numbers; payment and billing information; booking preferences; communications and correspondence; reviews; ratings and feedback; and any other information you choose to provide.

Where you make a Booking through the Platform, we may collect – reservation details; dates of travel or accommodation; number of occupants or passengers; special requests; emergency contact information; transaction information; booking history; and communications with Partners.

Where you register as a Partner, Experience Provider or Water-Based Service Provider, we may collect – business name; registration and incorporation details; tax identification information; bank account details; proof of ownership or authority to list; licences, permits and certifications; insurance information; operational and compliance information; and information relating to Listings and services offered through the Platform.

We may collect certain technical information including: IP address; browser type; device identifiers; operating system information; application usage data; location information where enabled; log data; referral URLs; and analytics information relating to your use of the Platform.

We collect Personal Data through various means, including:

• when you create an Account on the Platform;
• When you complete your profile or submit verification documents;
• when you make, modify or cancel a Booking;
• when you create or manage a Listing;
• when you communicate with other Users through the Platform;
• when you contact customer support or submit enquiries;
• when you participate in promotions, surveys, competitions or marketing campaigns;
• when you submit reviews, ratings or feedback;
• when you interact with our website, mobile applications or advertisements; and
• through third-party service providers, business partners, payment processors, identity verification providers, analytics providers and publicly available sources where permitted by law.

We may also generate or derive information from the data we collect, including statistical, analytical and behavioural insights relating to Platform usage, booking patterns and service performance.

Wavela Processes Personal Data only where there is a lawful basis for doing so under Applicable Data Protection Laws.

We may Process Personal Data for the following purposes:

• creating and managing User Accounts;
• facilitating Bookings, reservations and transactions;
• verifying User identity and preventing fraud;
• onboarding and managing Partners;
• facilitating communications between Guests and Partners;
• processing payments, refunds and chargebacks;
• providing customer support and dispute resolution services;
• maintaining the security, integrity and functionality of the Platform;
• conducting audits, investigations and compliance reviews;
• complying with legal and regulatory obligations;
• improving, developing and optimising the Platform and related services;
• conducting analytics, research and business intelligence activities;
• sending administrative communications relating to Accounts, Bookings and services;
• marketing Wavela's services where permitted by law; and
• exercising or defending legal claims.

We may rely on one or more of the following legal bases when Processing Personal Data:

• the performance of a contract with you;
• compliance with a legal obligation;
• our legitimate business interests, which shall not override your rights and freedoms;
• your consent, where consent is required by law; and
• the establishment, exercise or defence of legal claims.

Where Processing is based on consent, you may withdraw your consent at any time, provided that such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal.

We may share Personal Data with third parties where reasonably necessary for the operation of the Platform or as otherwise permitted by law.

Personal Data may be disclosed to:

• Guests, Partners and other Users where necessary to facilitate a Booking or service;
• property owners, hosts, experience providers and Water-Based Service providers involved in fulfilling a Booking;
• payment processors and financial institutions;
• identity verification providers and fraud prevention service providers;
• cloud hosting, technology infrastructure and software service providers;
• analytics, marketing and customer relationship management providers;
• professional advisers including lawyers, auditors, consultants and insurers;
• regulators, law enforcement agencies and governmental authorities;
• courts, tribunals and dispute resolution bodies; and
• any purchaser, investor, successor or acquirer in connection with a merger, acquisition, restructuring, financing or sale of assets.

Where a Booking involves a property or Water-based Service, Wavela may share information reasonably required for the fulfilment, administration, safety and management of the Booking.

Wavela does not sell Personal Data to third parties for their independent marketing purposes.

We may disclose Personal Data where we reasonably believe such disclosure is necessary to:

• comply with applicable law;
• enforce our contractual rights;
• protect the rights, property or safety of Wavela, its Users or third parties;
• investigate fraud, security incidents or unlawful conduct; or
• respond to lawful requests from public authorities.

Personal Data may be transferred to, stored in or accessed from jurisdictions outside Nigeria where such transfer is necessary for the operation of the Platform or the provision of services.

Where Personal Data is transferred internationally, Wavela shall implement appropriate safeguards required under Applicable Data Protection Laws, including:

• contractual safeguards
• adequacy-based transfer mechanisms
• Regulatory approvals where required; and
• appropriate technical and organisational security measures.

By using the Platform, you acknowledge that certain service providers engaged by Wavela may process Personal Data in multiple jurisdictions.

Wavela uses cookies, software development kits (SDKs), web beacons, pixels and similar technologies to improve the functionality, performance and security of the Platform.

These technologies may be used to authenticate Users, maintain user sessions, remember preferences and settings, analyse Platform usage, improve performance and functionality; detect fraud and security threats; and deliver relevant marketing and advertising content.

Certain cookies are necessary for the operation of the Platform and cannot be disabled without affecting functionality.

Where required by law, Wavela will obtain your consent before deploying non-essential cookies or similar technologies.

Users may manage cookie preferences through browser settings or through any cookie preference tools made available on the Platform.

Wavela retains Personal Data only for as long as reasonably necessary to fulfil the purposes described in this Privacy Notice, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the nature of the Personal Data; legal, regulatory, tax and accounting obligations; dispute resolution requirements; fraud prevention and security needs; and operational and business requirements.

We may retain certain information following account closure where necessary to comply with legal obligations, resolve disputes, enforce agreements, investigate misconduct, or maintain appropriate business records.

Where Personal Data is no longer required, Wavela shall securely delete, anonymise or otherwise dispose of such data in accordance with applicable legal requirements.

Wavela implements appropriate technical, organisational and administrative measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, misuse or other unlawful forms of processing.

Such measures may include:

• Encryption technologies
• Access controls and authentication mechanisms
• Network and system security controls
• Monitoring and logging systems
• Secure data storage practices
• Employee confidentiality obligations
• Periodic security assessments and reviews

While Wavela takes reasonable steps to protect Personal Data, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure. Accordingly, Wavela cannot guarantee absolute security of Personal Data.

Users are responsible for maintaining the confidentiality of their Account credentials and for taking reasonable precautions to protect their devices and personal information.

Where Wavela becomes aware of a Personal Data breach, Wavela shall take appropriate steps to investigate, contain and remediate the breach and, where required by law, notify affected individuals and relevant regulatory authorities.

Subject to applicable law, you may have the right to:

• obtain confirmation as to whether Wavela processes your Personal Data;
• request access to Personal Data held about you;
• request correction of inaccurate, incomplete or outdated Personal Data;
• request deletion of Personal Data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to the processing of Personal Data on grounds relating to your particular situation;
• withdraw consent where processing is based on consent;
• request portability of Personal Data where applicable;
• request information regarding the processing of your Personal Data; and
• lodge a complaint with a competent data protection authority.

Requests relating to Personal Data may be submitted to Wavela using the contact details set out in this Privacy Notice.

Wavela may require reasonable verification of identity before responding to any request relating to Personal Data.

Wavela reserves the right to refuse or limit requests where permitted by law, including where compliance would adversely affect the rights and freedoms of others, compromise security, or conflict with legal obligations.

Wavela shall endeavour to respond to valid requests within the timeframe prescribed by applicable law.

Wavela may use automated systems, algorithms and analytical tools to support operational, security and business functions, including:

• Fraud detection and prevention
• Identity verification
• Transaction monitoring
• Risk assessment
• Content moderation
• Customer support workflows
• Recommendation and personalization services

Such automated processing is intended to improve Platform security, user experience and operational efficiency.

We do not make decisions based solely on automated processing where such decisions would produce legal or similarly significant effects on an individual, except where authorised by law or where appropriate safeguards are implemented.

Users may contact Wavela to request further information regarding automated processing activities where applicable.

The Platform is not intended for use by individuals under the age of eighteen (18) years.

We do not knowingly collect Personal Data directly from children.

If we become aware that Personal Data has been collected from a child without appropriate authorisation or legal basis, we shall take reasonable steps to delete such information or otherwise comply with applicable legal requirements.

Parents, guardians or legal representatives who believe that a child has provided Personal Data to Wavela may contact us using the details set out in this Privacy Notice.

Wavela may send Users communications relating to its products, services, promotions, events, experiences, partnerships and other offerings where permitted by law.

Marketing communications may be delivered by email, SMS, telephone, push notification, in-app message or other communication channels.

Where required by law, Wavela shall obtain your consent before sending direct marketing communications.

You may opt out of receiving marketing communications at any time by:

• following the unsubscribe instructions included in the communication;
• adjusting your communication preferences within your Account; or
• contacting Wavela directly.

Opting out of marketing communications will not prevent Wavela from sending service-related, transactional, legal, security or administrative communications.

The Platform may contain links to third-party websites, applications, social media platforms or services that are not owned or controlled by Wavela.

This Privacy Notice does not apply to the privacy practices of any third party.

Wavela is not responsible for the content, security, privacy practices or policies of third-party services.

Users are encouraged to review the Privacy Notice and terms applicable to any third-party service before providing Personal Data.

Wavela may amend, update or revise this Privacy Notice from time to time to reflect changes in law, regulatory requirements, technology, business practices or Platform functionality.

Updated versions of this Privacy Notice shall be published on the Platform together with the applicable effective date.

Where required by law, Wavela shall provide additional notice of material changes through appropriate communication channels.

Continued use of the Platform following the effective date of any revised Privacy Notice shall constitute acknowledgement of the updated Privacy Notice.

If you believe that Wavela has processed your Personal Data in a manner that violates Applicable Data Protection Laws, you may contact Wavela in the first instance using the contact details provided in this Privacy Notice.

If you remain dissatisfied with Wavela's response, you may lodge a complaint with the Nigeria Data Protection Commission or any other competent supervisory authority having jurisdiction over the processing of your Personal Data.

Nothing in this Privacy Notice restricts any statutory rights or remedies available to you under Applicable Data Protection Laws.

Wavela may designate a Data Protection Officer or Data Protection Contact Person from time to time. Details of such appointment will be made available through the Platform where applicable.

If you have any questions, concerns, requests or complaints regarding this Privacy Notice or the processing of your Personal Data, please contact us.