Privacy Policy

LAND REPUBLIC LIMITED PRIVACY POLICY

Last Updated: April 11, 2026 | Version: 2.0 | Data Controller: Land Republic Limited

1. WHO WE ARE AND HOW TO CONTACT US

1.1 Identity of the Data Controller

Land Republic Limited ("Land Republic", "we", "us", or "our") is the Data Controller responsible for your personal data. We are incorporated under the Companies and Allied Matters Act (CAMA) 2020. Our registered address is 10A Lanre Olumide Street, Idado Estate, Lekki Phase II, Lagos, Nigeria.

As the Data Controller, Land Republic determines the purposes for which and the means by which your personal data is processed, in accordance with the Nigeria Data Protection Act (NDPA) 2023.

1.2 Data Protection Officer

Land Republic has designated a Data Protection Officer (DPO) responsible for overseeing compliance with the NDPA 2023 and this Privacy Policy. The DPO can be contacted at: support@landrepublic.co (mark the subject line: DATA PROTECTION OFFICER). All data protection queries, rights requests, and complaints may be addressed to the DPO.

1.3 Scope of This Policy

This Privacy Policy applies to all personal data collected by Land Republic through: (a) the website at www.landrepublic.co and all associated subdomains ("the Website"); (b) offline interactions including in-person consultations, phone calls, and physical documentation; (c) transactions facilitated through authorised agents, Land Hackers, and Sales Assistants; and (d) any other interaction between you and Land Republic in connection with our property services.

2. LEGAL FRAMEWORK AND PRINCIPLES

Land Republic processes personal data in strict accordance with the following data protection principles established under the Nigeria Data Protection Act 2023:

• Lawfulness, fairness, and transparency: personal data is processed only on a valid legal basis and in a manner that is transparent to you.
• Purpose limitation: personal data is collected for specified, explicit, and legitimate purposes and is not processed in a manner incompatible with those purposes.
• Data minimisation: only personal data that is adequate, relevant, and limited to what is necessary in relation to the purpose of processing is collected.
• Accuracy: reasonable steps are taken to ensure that personal data is accurate and kept up to date.
• Storage limitation: personal data is retained only for as long as is necessary for the purpose for which it was collected, or as required by law, whichever is longer.
• Integrity and confidentiality: personal data is processed with appropriate technical and organisational security measures to protect it against unauthorised access, loss, destruction, or damage.
• Accountability: Land Republic takes responsibility for compliance with these principles and can demonstrate such compliance to the Nigeria Data Protection Commission (NDPC).

3. WHAT PERSONAL DATA WE COLLECT AND WHY

The categories of personal data we collect, their sensitivity level, and the legal basis for processing each category depend on your relationship with us: browsing the Website generates only Usage Data, while purchasing a property triggers collection across all high-sensitivity categories.

3.1 Data We Do NOT Collect

Land Republic does not collect or process the following categories of special category data unless explicitly required by law and with appropriate safeguards: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, or data concerning health, sex life, or sexual orientation. If you voluntarily disclose such information in correspondence with us, we will not record or use it for any purpose and will delete it promptly.

3.2 Data Received From Third Parties

Land Republic may receive personal data about you from the following third-party sources:

• Authorised agents, Land Hackers, or Sales Assistants who introduce you to Land Republic as a prospective buyer.
• Payment processors and financial institutions, confirming payment status and account details.
• Publicly available sources, including the Corporate Affairs Commission (CAC) database, Land Registry records, and court records, for due diligence purposes.
• Regulatory authorities, including the EFCC and NFIU, where they share information relevant to compliance obligations.

4. HOW AND WHY WE USE YOUR PERSONAL DATA

Land Republic uses your personal data for purposes including service delivery, account management, contract performance, marketing (with consent), legal compliance, and security. Land Republic will only use your personal data for a purpose other than those listed where: (a) the new purpose is compatible with the original purpose; (b) you have given fresh consent; or (c) it is required by law. We will notify you before using your data for any materially different purpose.

5. WHO WE SHARE YOUR DATA WITH

Land Republic does not sell, rent, or trade your personal data to any third party for that party's independent commercial purposes. We share your personal data only to the extent strictly necessary for stated purposes.

5.1 Data Processing Agreements

All third-party service providers who process personal data on our behalf are engaged under written Data Processing Agreements (DPAs) that require them to: process data only on Land Republic's documented instructions; implement appropriate security measures; not engage sub-processors without Land Republic's authorisation; assist Land Republic in fulfilling data subject rights requests; and delete or return personal data upon termination of the engagement. These requirements are imposed in accordance with Section 36 of the NDPA 2023.

5.2 Business Transfers

In the event that Land Republic is involved in a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity as part of the transaction. Where this occurs, Land Republic will: notify you via the Website and by email at least 14 (fourteen) days before the transfer where practicable; ensure the acquiring entity commits to honouring this Privacy Policy or provides you with a new privacy policy of equivalent standard; and allow you to exercise your rights before the transfer is completed.

6. INTERNATIONAL DATA TRANSFERS

Land Republic's primary operations and data storage are based in Nigeria. However, some of our service providers may process or store personal data on servers located outside Nigeria.

In accordance with Section 43 of the NDPA 2023, Land Republic ensures that any transfer of personal data outside Nigeria takes place only where at least one of the following safeguards is in place:

• The destination country has been assessed by the NDPC as providing an adequate level of data protection.
• The transfer is governed by standard contractual clauses approved by the NDPC or the data protection authority of the destination country.
• The recipient has binding corporate rules in place that have been approved by the NDPC.
• The transfer is necessary for the performance of a contract between you and Land Republic, or for the implementation of pre-contractual measures taken at your request.
• The transfer is necessary for the establishment, exercise, or defence of legal claims.

Where none of the above safeguards is available for a specific transfer, Land Republic will obtain your explicit consent for that transfer and will inform you of the possible risks.

7. DATA RETENTION

Land Republic retains personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable Nigerian law, whichever is longer.

The following mandatory retention requirements under Nigerian law take precedence over our standard retention periods:

• Transaction and financial records: 7 (seven) years from the date of the transaction, pursuant to FIRS regulations and the Money Laundering (Prevention and Prohibition) Act 2022.
• KYC and identity verification records: 5 (five) years after the end of the business relationship, pursuant to AML regulations.
• Legal proceedings records: retained until final resolution of the proceedings plus any applicable appeal period.
• NDPC investigation records: retained for as long as required by the NDPC in connection with any investigation.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with Land Republic's data destruction procedures.

8. COOKIES AND TRACKING TECHNOLOGIES

8.1 What We Use and Why

Land Republic uses cookies and similar tracking technologies (including web beacons, pixel tags, and session storage) to enable the Website's functionality, improve user experience, analyse Website performance, and, where you consent, deliver relevant property marketing.

• Browser Cookies: small text files placed on your device by the Website. May be session cookies (deleted when you close your browser) or persistent cookies (remain until their expiry date or you delete them).
• Web Beacons and Pixel Tags: small electronic images embedded in web pages and emails that enable us to track whether a page has been viewed or an email has been opened, and to count unique visitors.
• Session Storage: temporary data stored in your browser that is deleted when you close the browser tab. Used for maintaining your session on the Website.

Note: Land Republic no longer uses Flash Local Shared Objects (Flash Cookies). Adobe Flash was permanently discontinued in December 2020.

8.2 Cookie Categories and Consent

We categorise our cookies accordingly, and apply the appropriate legal basis for each category under the NDPA 2023. Non-essential cookies are only activated after you provide express, informed, and freely given consent through the cookie consent mechanism on the Website.

8.3 Your Cookie Rights

You may manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of the Website. You may also control cookies through your browser settings; however, disabling strictly necessary cookies will impair the Website's core functionality.

9. MARKETING COMMUNICATIONS

Land Republic will send you marketing communications about our properties, services, promotions, and events only where you have given your express consent to receive them.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the "Unsubscribe" link in any marketing email we send you.
• Replying "STOP" to any marketing SMS.
• Updating your marketing preferences in your account settings on the Website.
• Emailing support@landrepublic.co with the subject line: UNSUBSCRIBE.

Withdrawal of marketing consent will take effect within 5 (five) business days.

10. YOUR DATA PROTECTION RIGHTS

Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights in respect of your personal data held by Land Republic: the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, and rights related to automated decision-making.

To exercise any of the above rights, please contact our Data Protection Officer at support@landrepublic.co with the subject line: DATA RIGHTS REQUEST, providing your full name, contact details, the right you wish to exercise, and sufficient information to identify the personal data concerned.

Land Republic shall respond to all data rights requests within 30 (thirty) days of receipt. No fee is charged for processing data rights requests unless they are manifestly unfounded or excessive.

11. DATA SECURITY AND BREACH NOTIFICATION

11.1 Security Measures

Land Republic implements appropriate technical and organisational security measures to protect personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of personal data in transit (TLS/SSL) and at rest using industry-standard algorithms.
• Role-based access controls ensuring that personal data is accessible only to personnel who require it for their specific functions.
• Regular security assessments, penetration testing, and vulnerability scanning of Website systems.
• Staff data protection training and confidentiality obligations for all personnel handling personal data.
• Physical security controls for offices and infrastructure where personal data is stored or processed.
• Incident response procedures for detecting, investigating, and responding to data security incidents.

Despite these measures, no internet transmission or electronic storage system can be guaranteed to be 100% secure.

11.2 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected data subjects, Land Republic shall:

• Notify the Nigeria Data Protection Commission (NDPC) within 72 (seventy-two) hours of becoming aware of the breach, in accordance with Section 40 of the NDPA 2023.
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• Maintain a written record of all data breaches, their effects, and remedial actions taken.

If you become aware of or suspect a data breach involving your personal data held by Land Republic, please notify us immediately at support@landrepublic.co (subject line: DATA BREACH NOTIFICATION).

12. CHILDREN'S PRIVACY

Land Republic's website and property services are directed exclusively to individuals who are 18 years of age or older. Land Republic does not knowingly collect, process, or store personal data of any person under the age of 18.

If you are a parent or guardian and you believe that a minor in your care has provided personal data to Land Republic without your consent, please contact us immediately at support@landrepublic.co. We will investigate and take appropriate action within 5 (five) business days of your notification.

13. AUTOMATED DECISION-MAKING AND PROFILING

Land Republic does not currently make automated decisions that produce legal or similarly significant effects on you without human review. Where Land Republic uses profiling (such as analysing browsing behaviour to personalise property recommendations), this is based on your consent and does not constitute automated decision-making in the legally significant sense. You may opt out of profiling at any time by updating your cookie preferences or contacting the DPO.

14. LINKS TO THIRD-PARTY WEBSITES

The Website may contain links to third-party websites, services, and platforms that are not operated by Land Republic. Land Republic has no control over and accepts no responsibility for the content, privacy practices, or data protection compliance of any third-party website. Land Republic strongly encourages you to review the privacy policy of every website you visit before providing any personal data.

15. CHANGES TO THIS PRIVACY POLICY

Land Republic reserves the right to update this Privacy Policy at any time. Where a change is material, Land Republic will notify you by: (a) email to the address associated with your account; and (b) a prominent notice on the Website, at least 14 (fourteen) days before the change takes effect.

16. CONTACT US AND HOW TO EXERCISE YOUR RIGHTS

All queries, data rights requests, marketing opt-outs, breach notifications, and regulatory complaints should be directed to: support@landrepublic.co

Where you are not satisfied with our response to a data protection complaint, you have the right to escalate your complaint to the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng at any time.

ISSUED BY THE AUTHORITY OF LAND REPUBLIC LIMITED

Data Controller: Land Republic Limited | Last Updated: April 11, 2026 | Version 2.0

This Privacy Policy supersedes all prior versions and constitutes Land Republic Limited's complete disclosure of its data protection practices.