Last updated: 15 November 2026.
Introduction
This Privacy Notice explains how Syllola Infra Tech Ltd collects, uses, stores, discloses and protects personal data when individuals visit or interact with our websites:
- www.syllola.io
- spec.syllola.io
It also explains the rights available to individuals in relation to their personal data and how those rights may be exercised.
Syllola is currently preparing to launch its services. At this stage, the websites receive registrations of interest and enquiries. When additional services, including property verification and completion-layer services, become operational, this Privacy Notice will be reviewed and updated before any new categories of personal data are collected or used for additional purposes.
This Notice provides information in accordance with applicable data protection legislation, including the Nigeria Data Protection Act 2023 (NDPA), the General Data Protection Regulation (GDPR), where applicable, and the UK GDPR, where applicable.
Our approach to privacy
Syllola is committed to respecting the privacy and confidentiality of individuals who interact with its websites.
Our approach is to:
- collect only personal data reasonably necessary for the stated purposes;
- use personal data for specified and legitimate purposes;
- avoid selling personal data or sharing it with third parties for their independent marketing purposes;
- avoid using advertising trackers, tracking pixels or session-recording tools unless this Notice is updated to disclose them;
- avoid using IP addresses to infer an individual's precise location;
- provide appropriate security measures for personal data;
- retain personal data only for as long as reasonably necessary; and
- ensure that individuals can exercise their applicable data protection rights.
Where we use cookies or analytics technologies, we will explain their purpose and obtain consent where required by law.
1. Who is responsible for your personal data?
Syllola Infra Tech Ltd, RC 9911117, a company incorporated in Nigeria and trading as Syllola, is the data controller for the personal data covered by this Privacy Notice, except where another organisation independently determines the purposes and means of its own processing.
As a data controller, Syllola determines why and how personal data is processed and is responsible for complying with applicable data protection obligations.
For questions, requests or complaints concerning personal data, you may contact us through:
Email: [email protected]
Telephone: +234 704 447 3665
Please use the subject heading “Privacy” when sending a privacy-related enquiry.
2. Personal data we collect, purposes and lawful bases
We collect personal data only where it is reasonably necessary for the purposes explained in this Notice.
The categories of personal data and the lawful bases for processing are set out below.
2.1 When you register your interest
When you submit a registration-of-interest form, we may collect:
- your name;
- your email address;
- your country of residence;
- the type of service or assistance in which you are interested;
- the Nigerian State in which the relevant property is located, where you choose to provide it; and
- any additional information you voluntarily include in your message.
We use this information to:
- record your expression of interest;
- verify your email address;
- respond to questions or requests included in your registration;
- provide information about the launch or availability of Syllola's services, where permitted; and
- maintain records of registrations and manage communications.
Lawful basis: Depending on the purpose, we may rely on your consent or on taking steps at your request before entering into a contract.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Where we send information about our launch or services, we will ensure that the communication is consistent with the consent or other lawful basis relied upon and with applicable electronic marketing requirements.
2.2 When you send us an enquiry or message
When you contact us through our website or by email, we may collect:
- your name;
- your email address;
- the subject or topic of your enquiry; and
- the contents of your message and any information you voluntarily provide.
We use this information to:
- receive and respond to your enquiry;
- provide information you have requested;
- address complaints or concerns;
- follow up where reasonably necessary; and
- maintain appropriate business communication records.
Lawful basis: We may rely on our legitimate interests in responding to enquiries and managing communications. Where your enquiry relates to a service you wish to obtain, we may also rely on taking steps at your request before entering into a contract.
We will consider your rights and interests when relying on legitimate interests and will not continue processing on that basis where your interests or fundamental rights and freedoms override our legitimate interests.
2.3 Website security and prevention of automated abuse
We may use technical information to identify, prevent and manage automated abuse, spam, unauthorised submissions and other security threats affecting our websites.
For this purpose, we may process information such as submission frequency, timestamps, network information and a pseudonymised or hashed identifier derived from a network address.
Where such an identifier is generated, we will take reasonable steps to minimise the information retained and restrict access to it.
A hashed or pseudonymised identifier may still constitute personal data where it can reasonably be linked to an identifiable individual. We will therefore treat such information in accordance with applicable data protection requirements.
Lawful basis: Our legitimate interests in maintaining the security, integrity and proper functioning of our websites.
Retention: Any short-lived security identifiers will be retained only for the period reasonably necessary for the security purpose. That period is two (2) hours.
2.4 Website operation and technical information
When you visit our websites, certain technical information may be received automatically through your browser and the systems used to deliver the websites.
This may include:
- your IP address;
- browser type and version;
- device and operating system information;
- request timestamps;
- pages or resources requested; and
- technical and security logs.
This information may be processed by our hosting, security and infrastructure providers to deliver website content, maintain availability, detect malicious activity and troubleshoot technical issues.
We do not intentionally use this information to infer your precise location or build individual advertising profiles.
Lawful basis: Our legitimate interests in operating, maintaining and securing our websites.
2.5 Website analytics
Where analytics tools are used, we may collect information about the pages visited and how visitors interact with our websites.
Our analytics arrangement provides aggregated website-usage information, rather than individual behavioural profiles.
Where analytics cookies or similar technologies are not strictly necessary for the operation of the website, we will seek your consent before using them, as required by applicable law.
Lawful basis: Your consent, where required.
You may refuse or withdraw consent to non-essential analytics without losing access to the ordinary functions of the website.
2.6 The validator on spec.syllola.io
The validator on spec.syllola.io allows users to check the integrity or authenticity of a Verified Property Record (VPR).
Validation takes place locally within the user’s browser.
The record and any files selected by the user are not uploaded to Syllola’s servers merely because the user performs a local validation.
The validator does not use analytics cookies or track individual validation activity.
However, ordinary website infrastructure may still process technical request information necessary to deliver the validator.
2.7 Information collected for future services
When Syllola begins providing property verification, due-diligence, payee verification, completion-layer or other services, additional personal data may be required.
Such information may include, depending on the service:
- identity and contact information;
- property ownership or transaction information;
- information contained in documents submitted for verification;
- information relating to sellers, developers, representatives or other relevant persons;
- professional details of appointed practitioners;
- information returned by authorised verification providers; and
- information necessary to document inspections and verification activities.
We will update this Privacy Notice before collecting or processing new categories of personal data for these additional purposes, where required.
Where necessary, we will provide supplementary privacy information at the point of collection.
We will also identify the applicable lawful basis, relevant recipients, retention periods and any additional safeguards required for the particular service.
3. Cookies and similar technologies
Cookies are small files placed on your browser or device when you visit a website.
Syllola uses cookies only where necessary for website functionality or where appropriate consent has been obtained.
3.1 Consent cookie
The consent cookie, identified as syl_consent, remembers your cookie preference for a period of six (6) months.
It may record whether you accepted or rejected non-essential analytics cookies.
3.2 Analytics cookies
Where non-essential analytics cookies are used, they will be activated only after the visitor has provided the required consent.
If you reject analytics cookies, the website should continue to operate without the analytics function.
3.3 Managing your cookie preferences
Where a cookie preference tool is available, you may change or withdraw your consent through the “Cookie Settings” option displayed on the website.
You may also manage or delete cookies through your browser settings.
Please note that disabling strictly necessary cookies may affect certain website functions.
3.4 Third-party tracking
Syllola does not use advertising pixels, session-recording tools or third-party advertising trackers.
If this position changes, this Privacy Notice and the relevant consent mechanism will be updated where required.
4. How long we keep your personal data
We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal, regulatory and record-keeping requirements.
The retention periods for the current pre-launch website are:
4.1 Unconfirmed registrations
Registrations that have not been confirmed will be deleted after thirty (30) days.
Where email confirmation is required, the confirmation link will expire after seven (7) days.
4.2 Confirmed registrations
Confirmed registrations will be retained for twelve (12) months from the date of confirmation, unless:
- the individual withdraws consent and no other lawful basis justifies continued retention;
- the individual becomes a customer and the information is required for the resulting relationship; or
- continued retention is required or permitted by law.
4.3 Enquiries and messages
Messages received through the website or by email will be retained for as long as reasonably necessary to respond to the enquiry, manage any follow-up and satisfy legitimate record-keeping requirements.
The maximum retention period is twelve (12) months after the last substantive communication, unless a longer period is reasonably required by law, an ongoing dispute or another lawful purpose.
4.4 Security records
Short-lived security identifiers generated for form-abuse prevention are deleted within two (2) hours.
4.5 Cookie preferences
Cookie preference information will be retained for the period necessary to remember your choice, which is six (6) months.
4.6 Deletion procedures
Deletion of expired registrations and short-lived security records takes place automatically every day.
Syllola will also maintain appropriate procedures for handling valid requests for erasure and other data-subject rights.
5. Where your personal data is stored and processed
Syllola uses third-party infrastructure and service providers to operate its websites and manage communications.
Our hosting and processing arrangements include:
- a database hosted within the European Union;
- an email delivery provider operating from or processing relevant information within the European Union;
- an analytics server located within the European Union, where analytics is enabled; and
- Cloudflare's network and infrastructure for website delivery, security and related technical services.
The websites may be delivered through Cloudflare’s global network. Depending on the technical arrangement, requests may be processed or routed through infrastructure located in different countries.
Members of Syllola’s team may access relevant personal data from Nigeria or the European Union where necessary for their duties.
Where personal data is transferred or made accessible across national borders, Syllola shall ensure that the transfer is undertaken in accordance with applicable data protection legislation.
For transfers governed by the Nigeria Data Protection Act 2023, Syllola shall comply with the applicable requirements under sections 41 to 43 of the Act.
Where the GDPR or UK GDPR applies, Syllola shall use a legally recognised transfer mechanism, such as an applicable adequacy decision or appropriate safeguards, where required.
Such safeguards may include approved standard contractual clauses or other recognised transfer mechanisms, together with any required transfer assessments.
You may contact us to request further information about the safeguards applicable to a particular transfer, subject to lawful restrictions.
Important: The countries in which our providers store or access data may differ from their principal business addresses. We will maintain an appropriate record of the actual processing and transfer locations.
6. Who we share your personal data with
Syllola does not sell personal data.
We do not share personal data with third parties for their independent advertising or marketing purposes.
We may share personal data with service providers where reasonably necessary to operate our websites, manage communications, maintain security or provide services requested by you.
Our service providers include:
6.1 Cloudflare
Cloudflare provides website hosting, content delivery, security, network protection and related infrastructure services.
6.2 Resend
Resend delivers registration confirmation emails and other website-generated communications.
6.3 Email provider
Our email provider processes messages sent to Syllola and communications exchanged with individuals.
6.4 Analytics provider
Where analytics is enabled and consent has been obtained where required, our analytics provider processes website-usage information.
6.5 Other service providers
We may engage additional service providers where reasonably necessary for website operation, security, communications or the provision of services.
Where a service provider processes personal data on our behalf, we will take appropriate steps to ensure that the provider is subject to suitable contractual, confidentiality and security obligations.
Some service providers may process personal data as independent controllers for particular activities. Where that is the case, their processing will be governed by their own applicable privacy arrangements.
6.6 Legal and regulatory disclosures
We may disclose personal data where reasonably necessary to:
- comply with a legal obligation;
- respond to a lawful court order or regulatory request;
- protect the rights, property or security of Syllola or another person; or
- establish, exercise or defend legal claims.
We will ensure that any disclosure is limited to what is legally required or reasonably necessary.
6.7 No sharing for third-party marketing
We do not provide personal data to banks, developers, installers, sellers or estate agents for their independent marketing purposes.
Where future services require disclosure to a financial institution, verification provider, professional practitioner or other relevant recipient, such disclosure will be made only where lawful, necessary and consistent with the applicable privacy information provided to the individual.
7. How we protect your personal data
Syllola takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing.
Depending on the nature of the information and the risks involved, these measures may include:
- encryption of data during transmission;
- access restrictions and role-based permissions;
- authentication and account-security controls;
- secure hosting and infrastructure arrangements;
- data minimisation and limited retention;
- appropriate confidentiality obligations for personnel and service providers; and
- security monitoring and incident-response procedures.
No method of electronic transmission or storage can be guaranteed to be completely secure. However, Syllola will take reasonable steps to maintain an appropriate level of security having regard to the nature of the personal data and the risks associated with its processing.
7.1 Personal data breaches
Where a personal data breach occurs, Syllola shall assess the incident and take appropriate steps to contain, investigate and mitigate its effects.
Where required by section 40 of the Nigeria Data Protection Act 2023, Syllola shall notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals.
Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, Syllola shall communicate the breach to the affected individuals in accordance with applicable law.
Where the GDPR or UK GDPR applies, Syllola shall comply with the relevant breach-notification requirements under that legislation.
8. Your data protection rights
Subject to applicable law and any relevant statutory exceptions, you may have the following rights in relation to your personal data:
8.1 Right of access
You may request confirmation as to whether Syllola processes your personal data and, where applicable, request access to that data and relevant information about its processing.
8.2 Right to rectification
You may request that inaccurate or incomplete personal data concerning you be corrected.
8.3 Right to erasure
You may request the deletion of your personal data where the applicable legal conditions for erasure are satisfied.
8.4 Right to restriction
You may request that the processing of your personal data be restricted in circumstances recognised by applicable law.
8.5 Right to object
You may object to certain processing activities, particularly where Syllola relies on legitimate interests as its lawful basis.
8.6 Right to data portability
Where the applicable legal requirements are satisfied, you may request that personal data you have provided to Syllola be supplied in a structured, commonly used and machine-readable format or transmitted to another controller, where technically feasible and legally required.
8.7 Right to withdraw consent
Where Syllola relies on your consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing undertaken before the withdrawal.
8.8 Rights relating to automated decision-making
Where applicable, you may have rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
Syllola does not make decisions about individuals solely by automated means that produce legal or similarly significant effects.
8.9 How to exercise your rights
To exercise any applicable right, contact us through:
Email: [email protected]
Telephone: +234 704 447 3665
Please use the subject heading “Privacy Request”.
We may request reasonable information to verify your identity before acting on a request, particularly where necessary to prevent unauthorised disclosure of personal data.
We will respond within the period required by the applicable data protection legislation. Where the GDPR or UK GDPR applies, the general response period is one (1) month, subject to any lawful extension.
Requests will ordinarily be handled without charge, except where applicable law permits a reasonable fee or refusal in circumstances involving manifestly unfounded or excessive requests.
9. Children’s personal data
Syllola’s services are intended for adults.
We do not knowingly design our current registration and enquiry processes to collect personal data from children under the age of eighteen (18).
If we become aware that personal data has been collected from a child in circumstances where such collection was not lawful, we will take appropriate steps to assess the matter and delete or otherwise deal with the information in accordance with applicable law.
If you believe that a child has submitted personal data through our website, please contact us at [email protected].
10. Complaints and regulatory authorities
If you have concerns about how Syllola collects, uses, stores or otherwise processes your personal data, we encourage you to contact us first so that we may investigate and address the concern.
You also have the right to lodge a complaint with the relevant data protection authority, where applicable.
These authorities may include:
- the Nigeria Data Protection Commission (NDPC), in relation to matters governed by Nigerian data protection law;
- the Information Commissioner's Office (ICO), where the UK GDPR or other applicable UK data protection law applies; and
- the relevant data protection supervisory authority in an EU Member State, where the GDPR applies.
The appropriate authority will depend on the applicable law and the circumstances of the processing.
11. Changes to this privacy notice
Syllola may update this Privacy Notice from time to time to reflect changes in its website operations, services, technology, legal obligations or data-processing practices.
Where changes are made, the updated Notice will be published on the relevant website together with a revised “Last Updated” date.
Where a material change affects the way we process personal data already collected, we will provide additional information or notify affected individuals where required by applicable law.
Where fresh consent is required for a new processing activity, we will obtain that consent before commencing the activity.
12. Contact us
For questions, requests or complaints relating to this Privacy Notice or the handling of your personal data, please contact:
Syllola Infra Tech Ltd
RC No.: 9911117
Email: [email protected]
Telephone: +234 704 447 3665
Website: www.syllola.io