Privacy Policy

1. Who we are and what this notice covers

Heights Hotels operates the Victoria Island and Lekki properties in Lagos, Nigeria. We are the data controller for personal information we receive and use to handle website visits, enquiries and reservation communications.

This notice covers our website and enquiries made through WhatsApp or telephone. It explains our approach under the Nigeria Data Protection Act 2023. If a different activity requires additional personal information, the relevant information about that processing should be provided separately.

2. Information we receive

• Contact and enquiry information: your name, telephone number, email address and the questions or messages you send our team.
• Reservation communications: your preferred property, requested stay dates, room preferences, number of guests and other details you share to arrange or manage a booking.
• Technical website information: information generated by website requests, such as an IP address, browser or device information, requested pages, request times and error or security logs.

Please share only information that is relevant to your enquiry. If a request involves sensitive personal information, such as health details needed to explain an accommodation requirement, ask our team what is necessary before sharing it.

3. Where information comes from

We receive information from you when you contact us, from a person authorised to arrange a stay on your behalf, and through the technical operation of our website and communication services. If you provide another person's details, please make sure you are authorised to do so and share this notice with them.

Information needed to respond to an enquiry or arrange a reservation helps us provide that service. If it is not supplied, we may be unable to answer the relevant question or complete the requested arrangements.

4. How and why we use information

• Enquiries and bookings: to answer questions, discuss availability and rates, confirm reservation details, manage changes and provide related support. Where applicable, this is necessary to take steps you request before entering a contract or to perform a booking agreement.
• Legal obligations: to keep records or respond to requests where Nigerian law requires us to do so.
• Legitimate interests: to operate and secure the website, prevent misuse, maintain relevant communications and resolve complaints or disputes. We consider these interests alongside your rights and reasonable expectations.
• Consent: where the law requires your consent for a particular use of information, we will seek it for that purpose. You may withdraw it by contacting us; withdrawal does not affect processing that was lawful before you withdrew consent.

Visiting the website or reading this notice does not itself give consent to every use of your personal information.

5. WhatsApp and external services

Bookings are arranged directly with the hotel team through WhatsApp. Our website's booking buttons open WhatsApp with a suggested enquiry message. Information you choose to send to our team is handled by Heights Hotels for the purposes described in this notice.

WhatsApp also processes information to operate its own service under its WhatsApp Privacy Policy. Our notice describes how Heights Hotels uses information it receives; WhatsApp's notice explains its separate practices.

Map links open external services. Please review the notices of those services when you use them.

6. Session cookies and Google Fonts

The website uses a necessary session cookie when a session is needed, including for security and staff sign-in. The session cookie is configured to expire after 12 hours. You can clear or block cookies in your browser settings, although this may affect features that rely on a session.

Our typefaces are delivered through Google Fonts. Your browser connects to Google to request the font files, sharing technical information such as your IP address and request headers. You can read more in the Google Fonts privacy information.

7. Sharing information and international processing

Relevant information may be accessed by authorised staff at the property handling your enquiry and by service providers supporting website hosting, email or business communications, where needed to provide those services. We may also disclose information to professional advisers or public authorities where legally required, or where lawfully necessary to establish, exercise or defend legal rights.

We limit disclosures to information relevant to the purpose. Some service providers may process information outside Nigeria. Where Heights Hotels transfers personal information internationally, the transfer must meet the requirements of the Nigeria Data Protection Act 2023, including an applicable adequacy basis, appropriate safeguards or another lawful transfer basis. External services such as WhatsApp explain their own international processing in their notices.

8. Retention and security

We retain information only for as long as necessary for the purpose for which it was received. Relevant factors include whether an enquiry leads to a booking, the time needed to handle your request or a complaint, applicable record-keeping obligations, and the need to resolve a legal claim or dispute. When information is no longer needed, it should be deleted or anonymised, subject to applicable legal obligations.

We use appropriate technical and organisational measures to safeguard personal information and limit access to people who need it for their work. Retention and security practices of independent communication services are also governed by their own policies.

9. Your data protection rights

Under the Nigeria Data Protection Act 2023, and subject to the conditions and exceptions that apply to each right, you may:

• Ask for information about our processing and access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure or restriction of processing where applicable.
• Object to processing based on legitimate interests.
• Request data portability where applicable.
• Withdraw consent where processing relies on it.
• Complain to the Nigeria Data Protection Commission (NDPC).

To make a privacy request, contact the relevant property by telephone or WhatsApp using the details below and describe what you need. For a WhatsApp message, begin with “Privacy request”. We may ask for proportionate information to verify your identity and locate the relevant records. We will respond within applicable legal time limits and explain any lawful reason that prevents us from fulfilling a request.

10. Changes to this notice

We may update this notice when our services, processing activities or legal requirements change. The date at the top of the page identifies the latest revision. Where an intended change requires further notice or consent, we will provide it as required by law.

11. Contact and complaints

For a privacy question, request or concern about information held by Heights Hotels, contact us using the details below.

You may also raise a concern with the Nigeria Data Protection Commission (NDPC) through its official website. You do not have to complete our internal complaints process before contacting the Commission.