Privacy Policy

Crovix Global Technologies Ltd ("Crovix", "we", "us") operates the Crovix Haven platform, which includes:

• Resident & Visitor Mobile App — the iOS and Android application used by estate residents and their visitors to manage gate access, receive announcements, pay service charges, and raise incident reports.
• Guard / Scanner Terminal App — the mobile application used by security personnel to scan visitor QR passes and log gate entries and exits.
• Estate Admin Portal — the web-based dashboard used by estate management committees, facility managers, and their designated staff to configure the estate, manage residents, and monitor operations.
• Partner Platform — the web portal used by Crovix referral and channel partners to track estate referrals and manage commission records.
• This Website — haven.crovix.tech, used to market the platform and accept estate subscription applications.

This Privacy Policy explains what personal data we collect across each of these surfaces, why we collect it, how we use and protect it, and the rights available to you. Your use of the platform is also governed by our Terms of Service.

Crovix Haven is operated by Crovix Global Technologies Ltd ("Crovix"), which acts as the data controller for the personal information described in this Privacy Policy unless otherwise stated.

• Registered name: Crovix Global Technologies Ltd
• Privacy enquiries: privacy.haven@crovix.tech
• Security disclosures: security.haven@crovix.tech

Estate administrators act as independent data controllers for the personal data they collect about their residents in the course of estate management. Crovix processes such data on the estate's behalf as a data processor, under appropriate contractual arrangements and in accordance with applicable law.

• Estate Subscribers / Administrators — individuals or organisations that subscribe to Crovix Haven on behalf of a residential estate.
• Residents — occupants and unit owners in an onboarded estate who use the mobile app.
• Visitors — guests of residents who receive or present a digital gate pass.
• Security Personnel (Guards) — gate security staff who use the scanner terminal app.
• Staff Accounts — estate admin staff added to the admin portal by the estate management.
• Referral Partners — registered agents and organisations on the Crovix Haven Partner Platform.
• Website Visitors — anyone browsing haven.crovix.tech.

4.1 Resident & Visitor Mobile App

• Identity data: full name, profile photo (optional), unit number.
• Contact data: phone number, email address.
• Access data: gate entry and exit timestamps, visitor pass codes, QR scan logs.
• Financial data: service charge payment records and receipts. We do not store payment card details — card payments are processed by Paystack, our payment gateway partner. Please review Paystack's Privacy Policy for how they handle card data.
• Communications: messages sent via estate announcement channels and incident reports submitted through the app.
• Device data: device model, operating system version, and push notification token used to deliver estate alerts and emergency notifications via Firebase Cloud Messaging.
• Location data: coarse GPS location may be used when generating or validating a gate-access pass. We do not track your continuous background location.

4.2 Guard / Scanner Terminal App

• Identity data: name, staff ID, role.
• Operational data: QR scans performed, timestamps, gate selected, number plates captured (if applicable).
• Device data: device model and OS version for offline-sync diagnostics.

4.3 Estate Admin Portal

• Account data: name, email address, phone number, role, login timestamps.
• Estate configuration data: estate name, address, zone definitions, gate configuration, onboarding documents submitted during application.
• Resident & unit data: uploaded or entered roster information for residents, including unit assignments.
• Operational data: billing records, incident logs, announcement history, gate activity reports.
• Usage data: actions taken inside the portal for audit-trail purposes.

4.4 Partner Platform

• Identity & business data: name, organisation name, email, phone, bank account details for commission payouts.
• Referral data: estates referred, conversion status, commission records.
• Login & access data: login timestamps and IP addresses for security purposes.

4.5 This Website

• Application data: name, email, phone, and estate details submitted through the subscription application form.
• Usage data: anonymised analytics on pages visited, browser type, and referral source (if analytics tooling is active).

• To provision and operate your estate on the Haven platform.
• To authenticate users and control access to the appropriate portal or app.
• To enable gate access control — generating, validating, and logging visitor passes.
• To deliver estate announcements, emergency alerts, and push notifications.
• To process service charge payments and generate financial records.
• To manage referral commissions for partners.
• To support fraud prevention, security monitoring, and platform abuse detection.
• To respond to support requests, complaints, and incident reports.
• To improve the platform based on aggregated, anonymised usage patterns.
• To comply with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation (NDPR), and other applicable laws.

• Contract performance: processing necessary to deliver the Haven subscription your estate has signed up for.
• Legitimate interests: security monitoring, fraud prevention, and platform improvement — where these do not override your rights.
• Consent: push notifications and optional data uses where we explicitly request your consent.
• Legal obligation: retaining records as required by Nigerian tax, financial, and corporate law.

We do not sell personal data. We share data only in the following limited circumstances:

• Within your estate: estate administrators can view resident, visitor, and gate-activity data for their estate only. Residents can see their own data and their visitor pass history.
• Service providers — third-party processors engaged to operate the platform, each bound by data processing agreements:
  • Payment processing: Paystack (card payments, bank transfer, USSD)
  • Push notifications: Firebase Cloud Messaging (Google)
  • Cloud hosting & infrastructure: providers such as DigitalOcean and Cloudflare, whose servers may be located outside Nigeria (see Section 8)
  • SMS delivery: licensed SMS gateway providers for account and billing notifications
  • Analytics: anonymised, aggregated analytics tooling if active — no personally identifiable data is shared
• Partners: referral partners see only the activation status of estates they referred, not resident or operational data.
• Law enforcement: where required by valid legal process under Nigerian law or other applicable jurisdiction.
• Business transfers: in the event of a merger, acquisition, or asset sale, data may be transferred to the successor entity under equivalent protections.

Your information may be processed on cloud infrastructure located outside Nigeria, including within the European Economic Area and the United States, as part of our use of hosting, notification, and security service providers.

Where such transfers occur, we implement appropriate contractual, technical, and organisational safeguards to protect your personal information — including standard contractual clauses and vendor data processing agreements consistent with the requirements of the Nigeria Data Protection Act 2023.

If you have questions about the specific safeguards applicable to a particular transfer, contact us at privacy.haven@crovix.tech.

Our website and web-based portals may use cookies and similar technologies (such as local storage and session tokens) to operate core features, remember preferences, maintain authenticated sessions, and understand how the platform is used.

• Essential cookies: required for login sessions and security features. These cannot be disabled without breaking core functionality.
• Preference cookies: remember your settings (such as display preferences) across sessions.
• Analytics cookies: collect anonymised information about page visits and usage patterns to help us improve the platform. These are only active if analytics tooling is enabled.

You can manage or disable non-essential cookies through your browser settings. Disabling essential cookies will prevent you from logging in to the admin portal or partner platform.

• Active estate accounts: data is retained for the duration of the subscription and for 12 months after termination to allow for disputes and final billing.
• Gate access logs: retained for 24 months by default, unless a shorter period is configured by the estate administrator in accordance with applicable law.
• Visitor pass records: retained for 12 months.
• Financial records: retained for 7 years in compliance with Nigerian financial regulations.
• Partner commission records: retained for the duration of the partner relationship and 3 years thereafter.
• Website application forms: retained for 6 months if no subscription results, or converted to the estate record upon activation.

We implement technical and organisational measures appropriate to the sensitivity of the data we process:

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256.
• Passwords are stored using industry-standard one-way hashing algorithms and are never stored in plain text.
• Each estate's data is logically isolated from all other estates.
• Access to production systems is restricted to authorised Crovix engineers, protected by multi-factor authentication.
• We conduct regular security reviews of our infrastructure and application code.

No system can guarantee absolute security. In the event of a data breach that is likely to result in high risk to individuals, we will notify affected parties and the relevant regulatory authority in accordance with applicable law.

To report a security vulnerability or suspected breach, contact security.haven@crovix.tech.

Subject to applicable law, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your data, subject to legal retention obligations.
• Portability: receive your data in a commonly used machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: withdraw consent at any time where processing is consent-based, without affecting the lawfulness of prior processing.
• Complaint: lodge a complaint with the Nigeria Data Protection Commission (NDPC) or another competent supervisory authority in your jurisdiction if you believe your data has been handled unlawfully.

To exercise any of these rights — including account deletion or deletion of specific personal data — visit our Data Rights & Account Deletion page, or contact us at privacy.haven@crovix.tech. We will respond within 30 days. Personal account data can be deleted on request by the account holder; requests concerning estate-controlled records (e.g. the authoritative resident, access, or financial records an estate administrator manages on their residents' behalf) may need to be submitted by or through the estate administrator, and certain records may be retained where legitimate, legal, or security reasons apply.

Crovix Haven does not make legally significant decisions about individuals solely through automated processing without human involvement. Automated processes on the platform — such as visitor pass validation, subscription state transitions, and billing notifications — are operational functions that do not produce legal or similarly significant effects on individuals. Any action with material consequences (such as estate suspension or blacklisting) involves human review and authorisation.

The Crovix Haven platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child's data has been collected, please contact us at privacy.haven@crovix.tech and we will take steps to delete it.

Our platform may contain links to third-party websites or services (e.g. the Crovix corporate website, payment gateway portals). This policy does not apply to those sites. We encourage you to review their privacy policies independently.

We may update this policy periodically. When we do, we will revise the effective date at the top of this page and increment the version number. For material changes, we will notify estate administrators via email or in-app notice at least 14 days before the changes take effect. Your continued use of the platform after the revised date constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, request access to or deletion of your personal information, or submit a privacy-related complaint, please contact us:

• Account or data deletion: Data Rights & Account Deletion
• Privacy enquiries: privacy.haven@crovix.tech
• Security issues: security.haven@crovix.tech
• Customer support: support.haven@crovix.tech
• Company: Crovix Global Technologies Ltd
• Website: haven.crovix.tech
• Corporate Website: crovix.tech