Draft · awaiting legal review

Privacy policy

Last updated 26 September 2026. This is a draft for legal review; details in square brackets are still to be confirmed.

Stone Haus Boutique Hotel ("Stone Haus", "we", "us") respects your privacy. This policy explains what personal data we collect when you visit our website, contact us, book or stay with us, why we use it, who we share it with and the rights you have under the Nigeria Data Protection Act 2023 and the regulations of the Nigeria Data Protection Commission.

Who we are

Stone Haus is the data controller for the personal data described here.

Company: [registered company name and RC number to be confirmed]
Address: [street address to be confirmed], Victoria Island, Lagos, Nigeria
Privacy contact: [privacy email address to be confirmed]
Data protection officer: [name and contact to be confirmed]

What we collect

When you book: your name, email address and phone number; the dates, rooms and guests in your stay, including children's ages; your expected arrival time; any special requests you share; and the status of your payment. Card payments are handled by Paystack: we never see or store your full card details.
When you check in: the type and number of your identity document, as hotels in Nigeria are required to record. We encrypt it and delete it [30 days] after you check out.
When you contact us or join our opening list: your name, email address, phone number if you give it, your message, and the consent choices you make, with the time you made them.
When you use this website: with your consent, how you use the site, your device type and approximate location, through Google Analytics. We also keep a record of your cookie choices on your device. When you send a form, Cloudflare Turnstile checks that you are a person, not an automated program.
When you message us on WhatsApp: the messages you send. WhatsApp's own privacy policy also applies.

Why we use it

We only use your personal data where the law allows:

To take and manage your booking, including payments, changes, cancellations and refunds. We need this to perform our contract with you.
To register you at check-in and keep financial and tax records, because the law requires us to.
To answer your enquiries and plan your stay, as steps you ask us to take before a contract, or in our legitimate interest in replying to you.
To send you opening news and offers, only with your consent. You can withdraw it at any time with the unsubscribe link in every email or by writing to us.
To keep the website and booking system safe from fraud and abuse, in our legitimate interest in protecting our guests and our business.
To measure and improve the website, only if you allow analytics cookies.

We share personal data only with organisations that help us run the hotel and this website, under contracts that require them to protect it and use it only on our instructions:

Paystack processes payments and refunds.
Cloudflare protects our forms and stores website images.
Netlify hosts this website, and Railway hosts our booking system and its database.
Resend delivers our emails.
Sentry helps us find and fix technical errors.
Google provides website analytics, only if you consent.

If you book through a travel website such as Booking.com, we exchange the details needed to manage that booking with it. We disclose personal data to public authorities only where the law requires. We do not sell personal data.

International transfers

Some of these providers process data outside Nigeria, for example in the European Union, the United Kingdom or the United States. We transfer personal data only where the Nigeria Data Protection Act 2023 permits it, such as to countries with adequate protection or under appropriate safeguards like contractual clauses.

How long we keep it

Booking and financial records: [six years] after your stay, to meet tax and accounting duties.
Identity document details: [30 days] after you check out.
Enquiries: [12 months] after our last contact with you.
Opening list and marketing: until you unsubscribe or ask us to remove you.
Analytics data: [14 months].

Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

be told how we use your personal data, as this policy does;
ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data, where we have no legal reason to keep it;
ask us to restrict how we use your data, or object to our using it, including for direct marketing;
receive your data in a structured, commonly used format, or have it sent to another organisation;
withdraw your consent at any time, without affecting what we did before; and
not be subject to decisions made solely by automated means that significantly affect you.

To use any of these rights, write to [privacy email address to be confirmed]. We will reply as soon as we can and within 30 days. If you are unhappy with our reply, you can complain to the Nigeria Data Protection Commission.

Security

We protect personal data with encrypted connections, encryption of identity document numbers, access limited to the staff who need it, two-factor sign-in for staff accounts and a record of every change made in our booking system.

Children

This website is not intended for children. We collect children's ages only so we can book the right room and rate for your family.

Cookies

We explain the cookies and similar technologies we use, and how to change your choices, in our cookie policy.

Changes to this policy

We will update this policy when our practices change. The date at the top shows when it last changed.