What we collect, and what we do not

The short version

Nothing inside a Hiding Place pod is recorded. The only personal data this website collects is what you type into a form, and we use it to reply to you.

We are the data controller for that information. We handle it under the Nigeria Data Protection Act 2023, which is regulated by the Nigeria Data Protection Commission.

What happens inside a pod

There are no cameras, no microphones and no biometric readers inside any pod we make. We do not log who used a pod, when, or for how long against a named person.

A pod's lock reports whether it is currently occupied. That signal exists for two reasons: so the cleaning cycle can start when the pod empties, and so the indicator above the door can show whether it is free. It is a yes or no about a pod, not a record about a person.

Where pods are operated by a client — a hospital, an employer, a terminal — any booking system is theirs, and their own privacy notice governs it. We do not receive their booking data.

What this website collects

Quote enquiries

Name, email address, organisation, phone number, your message, and the pod and setting you select. Used to reply to you and prepare a site survey.

Newsletter and waitlists

Email address and which page you signed up from, so a Haven waitlist can be told apart from a Hotel one.

Analytics

Pages viewed, approximate location derived from your IP address, and technical details about your browser and device.

Error reports

Technical details when something on the site breaks, which may include a replay of the session in which the error occurred.

Why we are allowed to hold it

The NDPA requires a lawful basis for processing personal data. Ours are these:

• Quote enquiries: to take steps at your request before entering a contract, and our legitimate interest in responding to people who ask us to.
• Newsletter and waitlists: your consent, given when you submit the form, which you can withdraw at any time.
• Analytics and error reporting: our legitimate interest in knowing which pages are read and when the site is broken.

Consent, and taking it back

Where we rely on consent, the NDPA requires it to be freely given, specific, informed, unambiguous and capable of being withdrawn. We do not pre-tick boxes, and we do not make a quote conditional on joining a mailing list.

Every newsletter carries an unsubscribe link. You can also write to us and we will remove you, without asking why.

Who else processes it

Supabase

Stores form submissions. Enquiry tables cannot be read by the public website.

PostHog

Product analytics, on the EU region by default.

Sentry

Error monitoring and session replay on errors.

Vercel

Hosting and content delivery.

Transfers outside Nigeria

Some of those providers store data outside Nigeria. The NDPA permits transfer where the destination provides an adequate level of protection or an appropriate safeguard is in place, and we rely on the contractual terms offered by each provider.

If you would rather your enquiry was not handled this way, email us directly instead of using the form and we will deal with it by correspondence.

Health settings

Where pods are installed in a hospital or clinic, section 26(1) of the National Health Act 2014 makes all information about a user of a health establishment confidential, including their health status, treatment and stay. Section 29 requires access controls that prevent unauthorised access to records.

We designed the pods so that this is not our problem to solve: because no occupancy is recorded against a person, using a pod on a ward creates no patient record for anyone to protect. Health information remains with the health establishment, and we neither receive nor process it.

How long we keep it

• Quote enquiries: for the life of the commercial conversation and up to two years afterwards, so we can pick up where we left off.
• Newsletter and waitlist addresses: until you unsubscribe.
• Analytics and error data: on the retention schedule of the provider, typically no more than twelve months.

Your rights

Under the NDPA you can ask us to confirm what personal data we hold about you and give you a copy, correct anything inaccurate, delete it, restrict or object to how we use it, or provide it in a portable form.

Write to us and we will action it. We aim to respond within thirty days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission.

If something goes wrong

The NDPA requires a personal data breach to be reported to the Commission within 72 hours of becoming aware of it, and affected people to be told where the breach is likely to put their rights at risk. That is what we will do.

Changes

If we change how we handle personal data we will update this page and change the review date at the top. Material changes will go to anyone on our mailing list.