Privacy Policy

1. Introduction

Bookwik Limited ("Bookwik," "we," "us," or "our") operates Bookwik, an online booking and business management platform that connects customers with appointment-based businesses such as salons, spas, clinics, and hospitality providers.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have under the Nigeria Data Protection Act 2023 (the "NDPA") and other applicable laws. It applies to everyone who uses the Platform — visitors, customers who book services, and businesses (including their owners and staff).

For the purposes of the NDPA, Bookwik Limited is the data controller responsible for the personal data described in this Policy.

2. Who We Are and How to Contact Us

Bookwik Limited
Lagos, Nigeria

For any privacy-related questions, to exercise your data protection rights, or to contact our Data Protection Officer (DPO), email us at privacy@bookwik.app. For general support, contact support@bookwik.app.

3. Personal Data We Collect

We collect only the personal data needed to operate the Platform. Specifically:

3.1 Information You Provide

As a customer, when you book or pay for a service, we collect:

• Your name, phone number, and email address
• Booking details — the service and staff member booked, appointment date and time, notes, reference images, and (for mobile or home services) your service address
• For hospitality bookings — guest count, check-in and check-out dates, total price, and any caution (security) fee
• Reviews you leave, including your rating and comments
• Payment information — we record the payment transaction reference, payment amount, and payment status for each booking. We never see or store your payment card number, card expiry, or CVV — card details are entered directly into our payment processor's secure checkout

As a business owner, when you register your business, we collect:

• Your account details — name, email address, and phone number
• Business profile information — business name, category, contact email and phone, address, images and logo, timezone, and map location
• Staff records — names, contact details, and availability schedules
• Services, pricing, and your booking, cancellation, and refund policies
• Bank details — bank name, account number, and account name, used solely to pay you

KYC (Know Your Customer) verification. To verify your business before it goes live on the Platform, we collect:

• Business type, CAC (Corporate Affairs Commission) registration number, TIN (Tax Identification Number), and business registration date
• Owner/director name, phone number, and email address
• Your website and social media links, if provided
• Uploaded verification documents — CAC certificate, TIN certificate, proof of address, utility bill, government-issued photo ID, and other supporting documents

Referrals. If you participate in our referral program, we collect the bank details needed to pay your referral rewards.

Support inquiries. When you contact us, we collect your name, email address, the subject of your inquiry, and the content of your message.

3.2 Information We Collect Automatically

• Device and browser information — device type, operating system, browser version, screen size, and language
• IP address and approximate location derived from it
• Pages visited, features used, and usage events (e.g., bookings created, payments completed) collected through PostHog
• Error logs and performance data

3.3 Information From Third Parties

• Google — we use Google's geocoding service to turn a business address into map coordinates and directions. Bookwik has no Google sign-in: business accounts are email and password, and customers leave reviews from a one-time link we email them
• Bachs (bachs.io) — our payment processor: payment status, transaction references, and payout destination information needed to settle funds to your bank account

4. Sensitive Personal Data

Some of the data we process is "sensitive personal data" under Section 26 of the NDPA — in particular, the government-issued photo ID, proof of address, and other documents you upload for KYC verification.

We process this data only for the purpose of verifying your business identity and preventing fraud, on the basis of your consent and our legal obligation to verify businesses using the Platform. Sensitive data is subject to heightened safeguards: it is encrypted at rest, accessible only to a restricted set of personnel who need it for verification, and deleted when it is no longer needed (see Section 9).

5. How We Use Your Personal Data and Our Legal Bases

We process personal data only where the NDPA gives us a lawful basis to do so:

• To provide the Platform and process your bookings — creating and managing appointments, sending confirmations and reminders (basis: performance of a contract with you)
• To process payments and payouts — initializing payments with our payment processor, recording transactions, and settling funds to businesses (basis: performance of a contract)
• To verify businesses and prevent fraud — reviewing KYC submissions, screening for fraudulent or suspicious activity (basis: our legitimate interest in keeping the Platform safe, and our legal obligations)
• To provide customer support — responding to inquiries and resolving disputes (basis: performance of a contract and our legitimate interest in serving you)
• To improve the Platform — analyzing anonymized and aggregated usage data to fix bugs and improve features (basis: our legitimate interest in improving our services, and consent where required by law)
• To comply with the law — keeping records required by Nigerian tax, anti-money-laundering, and other regulations (basis: legal obligation)
• To send marketing communications — only if you have opted in, and you may opt out at any time (basis: consent)

We do not use automated decision-making, including profiling, that produces legal effects concerning you or significantly affects you. Availability calculations and booking confirmations are operational functions, not profiling.

6. How We Share Your Personal Data

We share personal data only in the following circumstances:

• With the business you book with. When you book through the Platform, the business receives your name, contact details, and booking information so they can prepare for and deliver your appointment. The business is an independent data controller of its own client records, and their processing of your data is governed by their own privacy practices
• With payment processors. Bachs (bachs.io) processes payments and payouts on our behalf, and its handling of payment data is governed by its own privacy policy. We share only what is needed to complete a transaction — never card details
• With service providers. Hosting providers, email delivery services, analytics providers (PostHog), and Google (for mapping) process data on our behalf under data processing agreements that require them to protect your data
• With legal authorities. Where required by Nigerian law or a valid legal request, such as a court order or regulatory demand
• In a business transaction. If Bookwik is merged with or acquired by another company, your data may be transferred as part of that transaction, subject to the protections in this Policy

We do not sell your personal data. We do not rent, trade, or otherwise monetize your personal data.

7. International Data Transfers

Some of our service providers — including Bachs, Google, PostHog, and our cloud hosting providers — may process or store data in countries outside Nigeria. Where personal data is transferred out of Nigeria, we rely on the mechanisms permitted by Section 43 of the NDPA, including adequacy determinations, appropriate safeguards such as standard contractual clauses or binding corporate rules, or your explicit consent where applicable.

8. Cookies and Tracking Technologies

We use essential cookies for authentication and session management — for example, to keep you signed in to your business dashboard or reviewer session. These cookies are necessary for the Platform to function.

We also use PostHog, an analytics service, which sets cookies to help us understand how the Platform is used. Where analytics cookies are not strictly essential, we obtain your consent before they are set, and you can withdraw consent or manage cookies at any time through your browser settings.

9. Data Retention

We retain personal data only for as long as necessary for the purposes in this Policy:

• Account and business data — for as long as your account is active and as needed to provide the services. When you delete your business account, your content and client data are removed from our active systems within 30 days, as described in our Business Terms. Anonymized, aggregated data may be retained for analytics
• Booking and payment records — retained for record-keeping and to comply with Nigerian financial, tax, and accounting obligations, for up to 7 years after the relevant transaction
• KYC documents — retained for as long as your business is verified on the Platform and for a reasonable period afterward to meet verification, fraud-prevention, and legal obligations. Documents are deleted once they are no longer needed for these purposes
• Support inquiries — retained for as long as needed to resolve your inquiry and for our legitimate record-keeping purposes
• Analytics and usage data — retained in a form that identifies you only as long as needed for the purposes described in this Policy, and otherwise aggregated or anonymized

When retention periods expire, personal data is securely deleted or anonymized so that it can no longer be linked to you.

10. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and encryption of sensitive data at rest
• Role-based access controls so that only authorized personnel can access personal data, with KYC and financial data restricted to the smallest group that needs it
• Payment card data never touches our servers — card details are entered directly into our payment processor's secure checkout
• Regular security reviews, audit logging of sensitive actions, and tested backup and recovery procedures
• Confidentiality obligations on all employees, contractors, and processors who handle personal data
• A data breach response plan, including the notification procedures described in Section 13

11. Your Rights Under the NDPA

Under the NDPA, you have the following rights regarding your personal data:

• Right to be informed — to know what data we collect and how we use it (this Policy)
• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to have inaccurate or incomplete data corrected
• Right to erasure ("right to be forgotten") — to request deletion of your personal data where there is no lawful basis to keep it
• Right to restriction of processing — to ask us to limit how we process your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format and transfer it to another controller where technically feasible
• Right to object — to object to processing based on our legitimate interests, including direct marketing
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal
• Right not to be subject to automated decision-making — as noted in Section 5, we do not make automated decisions that produce legal effects about you

To exercise any of these rights, email our DPO at privacy@bookwik.app. We will respond within 30 days of receiving a verifiable request, and requests are processed free of charge unless they are manifestly unfounded or excessive. We may need to verify your identity before processing your request, and we may retain limited data where the law requires us to do so.

12. Children's Privacy

Bookwik is not intended for children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@bookwik.app and we will take steps to delete it.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach, as required by Section 40 of the NDPA. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

14. Compliance and Accountability

Bookwik Limited complies with its obligations as a data controller under the NDPA, including registering with the Nigeria Data Protection Commission (NDPC) and maintaining records of processing activities. We carry out Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to data subjects, such as our KYC verification process.

15. Complaints

If you believe we have not handled your personal data in accordance with the NDPA, you may lodge a complaint with the Nigeria Data Protection Commission:

Nigeria Data Protection Commission (NDPC)
1919 Cadastral Zone C06, Mbora District,
Opposite Efab City Estate, Life Camp, FCT Abuja, Nigeria
Email: info@ndpc.gov.ng
Website: ndpc.gov.ng

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify you by email or through the Platform before the changes take effect. Continued use of the Platform after the changes take effect constitutes acceptance of the updated Policy.

17. Contact

For privacy-related questions, to exercise your rights, or to contact our Data Protection Officer, email privacy@bookwik.app.

Bookwik Limited
Lagos, Nigeria