DATA PROTECTION AND PRIVACY POLICY

Greyfield Hotels & Apartments

Effective Date: 13 October 2026
Last Updated: 13 October 2026

1. Introduction

Greyfield Hotels & Apartments (“Greyfield Hotels”, “we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, and security of the personal information entrusted to us by our guests, customers, website visitors, business partners, employees, and other individuals who interact with our services.

This Data Protection and Privacy Policy explains how we collect, use, store, disclose, protect, and otherwise process personal data when you visit our website, make a reservation, stay at our hotel or apartments, use our facilities, contact our team, or engage with our services.

We are committed to handling personal data in accordance with applicable Nigerian data protection laws, including the Nigeria Data Protection Act 2023, and other applicable legal requirements.

By using our website or engaging with our services, you acknowledge that you have had the opportunity to read this policy. Where consent is the appropriate legal basis for processing, we will request it as required by applicable law.

2. Who We Are

Greyfield Hotels & Apartments provides hotel accommodation, serviced apartments, hospitality services, dining, and related facilities.

Our contact details are as follows:

Business Name: Greyfield Hotels & Apartments
Website: greyfieldhotels.com
Address: 20 Irhirihi Road, Off Airport Road, GRA, Benin City, Edo State, Nigeria.
Telephone: +234 809 999 1303
WhatsApp: +234 809 999 1303
Email: info@greyfieldhotels.com

For questions, requests, or complaints concerning the processing of your personal data, please contact us using the details above and indicate that your enquiry concerns data protection or privacy.

3. Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data.

3.1. Identification Information

We may collect:

Full name.
Date of birth, where necessary.
Nationality, where required for legitimate hospitality, identification, or legal purposes.
Government-issued identification details where lawfully required.
Other identification information necessary to verify a reservation or comply with applicable legal obligations.

3.2. Contact Information

This may include:

Telephone number.
Email address.
Residential or correspondence address.
Emergency contact details, where necessary.
Contact preferences.

3.3. Reservation and Accommodation Information

When you make a booking or stay with us, we may collect:

Reservation reference and booking details.
Check-in and check-out dates.
Room or apartment preferences.
Number of guests.
Special requests and accommodation preferences.
Check-in and check-out records.
Relevant information concerning cancellations, modifications, refunds, or complaints.
Information about services purchased or used during your stay.

3.4. Payment and Transaction Information

When you make a payment for our services, we may process:

Payment amount and transaction reference.
Billing information.
Payment status.
Invoice and receipt details.
Relevant transaction records.

Payments made through third-party payment providers may be processed by those providers under their own privacy policies and security procedures.

We do not intend to collect or retain complete payment card details or security codes unless a specific, lawful, and appropriately secured payment arrangement requires it.

3.5. Communication Information

We may retain information contained in communications sent to us through:

Email.
Telephone calls, where records are lawfully maintained.
WhatsApp and other messaging channels.
Website contact forms.
Customer feedback and complaint submissions.
Social media channels operated by or on behalf of Greyfield Hotels.

This information helps us respond to enquiries, manage customer relationships, and improve our services.

3.6. Technical and Website Information

When you visit our website, we may collect certain technical information, including:

Internet Protocol (IP) address.
Browser type and version.
Device and operating system information.
Pages visited and interactions with website features.
Date and time of access.
Referral sources.
Cookie identifiers and related website usage information, where applicable.

The information collected will depend on the website technologies and analytics services actually in use.

3.7. CCTV and Security Information

For the safety and security of guests, employees, visitors, and property, CCTV cameras may operate in designated public and common areas of our premises.

Where applicable, CCTV systems may record images, video footage, and associated timestamps.

CCTV cameras will not intentionally be installed in private areas such as guest bedrooms, bathrooms, or changing facilities.

Access to surveillance footage will be restricted to authorised personnel and other parties with a legitimate and lawful reason to access it.

3.8. Sensitive Personal Data

In limited circumstances, we may process sensitive personal data, such as health-related information, where necessary to accommodate a guest’s needs, respond to an emergency, protect vital interests, or meet another lawful requirement.

We will process sensitive personal data only where an appropriate legal basis and any additional safeguards required by applicable law are satisfied.

We encourage guests to share only the information necessary for their particular request.

4. How We Collect Personal Data

We may collect personal data through the following methods:

Directly from you: When you make a reservation, complete a form, contact us, check in, make a payment, or provide feedback.
Through our website: When you browse our website, submit an enquiry, or use an available online booking feature.
Through communication channels: When you contact us by telephone, email, WhatsApp, or social media.
Through business partners: From travel agencies, booking platforms, corporate clients, or other intermediaries involved in your reservation.
Through payment providers: When transaction information is provided to us to confirm or reconcile a payment.
Through security systems: When you enter designated areas monitored by CCTV.
From other lawful sources: Where obtaining the information is necessary for a legitimate business purpose or legal obligation.

Where personal data is obtained indirectly, we will provide relevant privacy information where required by applicable law.

5. Why We Process Personal Data

We process personal data only for specified, legitimate, and lawful purposes.

These purposes may include:

5.1. Reservation and Guest Management

To:

Process and confirm reservations.
Manage check-in and check-out.
Allocate rooms and apartments.
Communicate booking details and changes.
Respond to accommodation requests.
Provide hospitality services.

5.2. Payment and Financial Administration

To:

Process or confirm payments.
Issue invoices and receipts.
Manage refunds and cancellations.
Maintain accounting records.
Detect and investigate suspected payment fraud.

5.3. Customer Service

To:

Respond to enquiries.
Address complaints and disputes.
Provide information about our facilities and services.
Manage guest feedback.
Maintain appropriate records of our interactions with customers.

5.4. Safety and Security

To:

Protect guests, employees, visitors, and property.
Prevent, detect, and investigate security incidents.
Manage access to designated areas.
Respond to emergencies.
Cooperate with competent authorities where legally required.

5.5. Legal and Regulatory Compliance

To:

Fulfil applicable legal and regulatory obligations.
Maintain required business and financial records.
Respond to lawful requests from competent authorities.
Establish, exercise, or defend legal claims.

5.6. Website Operation and Improvement

To:

Maintain website functionality.
Diagnose technical problems.
Monitor website performance.
Improve the user experience.
Understand website usage through analytics where lawfully configured.

5.7. Marketing and Promotional Communications

Where permitted by applicable law, we may use your contact details to send information about promotions, special offers, accommodation packages, events, or other services.

Where consent is required, we will obtain it before sending relevant marketing communications.

You may opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting us directly.

Opting out of marketing will not prevent us from sending essential communications relating to an existing reservation, payment, security matter, or legal obligation.

6. Legal Bases for Processing Personal Data

Under applicable data protection law, personal data must be processed on an appropriate legal basis.

Depending on the circumstances, Greyfield Hotels may rely on the following legal bases:

a. Contractual necessity: Processing necessary to make or manage a reservation, provide accommodation, deliver requested services, or take steps at your request before entering into a contract.

b. Legal obligation: Processing necessary to comply with applicable laws, regulations, or lawful requirements.

c. Consent: Processing based on your freely given, specific, informed, and unambiguous consent where consent is the appropriate legal basis.

d. Legitimate interests: Processing necessary for legitimate business interests, such as maintaining website security, preventing fraud, improving services, or protecting property, provided those interests do not override your rights and freedoms.

e. Vital interests: Processing necessary to protect your life or another person’s life in an appropriate emergency.

f. Other lawful grounds: Any additional legal basis recognised by applicable data protection law and relevant to the particular processing activity.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support functionality, remember preferences, analyse website usage, and improve performance.

Cookies may include:

Essential cookies: Necessary for core website functions, security, or services you request.

Preference cookies: Used to remember choices and settings.

Analytics cookies: Used to understand how visitors interact with the website, where such tools are implemented.

Marketing cookies: Used to support advertising or marketing measurement, where applicable and lawfully configured.

Where required by applicable law, we will obtain consent before placing non-essential cookies or activating related tracking technologies.

You may be able to manage cookie preferences through our website’s cookie settings or your browser settings. Blocking certain cookies may affect the functionality of some website features.

8. Disclosure of Personal Data to Third Parties

Greyfield Hotels does not sell guests’ personal data as a commercial product.

However, we may share personal data with carefully selected third parties where necessary, proportionate, and lawful.

These parties may include:

Payment processors and financial service providers.
Website hosting and technical support providers.
Online reservation and booking platforms.
Hotel management or customer relationship management service providers.
Email, communication, and messaging service providers.
Accountants, auditors, lawyers, and professional advisers.
Security providers and authorised personnel.
Government agencies, law enforcement authorities, courts, or regulators where disclosure is legally required or otherwise lawfully justified.
Other service providers engaged to support our operations.

We will take reasonable steps to ensure that third parties receiving personal data are subject to appropriate confidentiality, security, and data protection obligations.

Where a third party processes personal data on our behalf, we will take appropriate steps to ensure that the processing is governed by suitable contractual and legal safeguards.

We will not disclose personal data to unrelated parties for their independent marketing purposes without an appropriate legal basis.

9. International Transfers of Personal Data

Some of our service providers, website technologies, booking platforms, or cloud-hosting services may store or process personal data outside Nigeria.

Where personal data is transferred internationally, Greyfield Hotels will take steps to ensure that the transfer complies with applicable Nigerian data protection law.

Depending on the circumstances, this may involve assessing the destination country’s level of protection, implementing appropriate contractual safeguards, or relying on another lawful transfer mechanism.

You may contact us for further information about relevant international transfers and the safeguards applicable to them.

10. Data Retention

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including contractual, operational, security, accounting, and legal purposes.

Retention periods may vary depending on the category of information and the circumstances.

For example:

Reservation records: Retained for the period necessary to administer bookings, address disputes, and satisfy applicable recordkeeping obligations.
Payment and accounting records: Retained for the periods required by applicable financial, tax, and other legal obligations.
Customer communications: Retained for the time necessary to respond to enquiries, manage our relationship with you, and maintain appropriate business records.
Marketing information: Retained while relevant to the applicable marketing purpose and legal basis, subject to withdrawal of consent or objection where applicable.
CCTV footage: Retained for a limited period consistent with our security requirements and applicable law, unless footage must be preserved for an investigation, incident, or legal proceeding.
Technical logs: Retained for a period appropriate to security, troubleshooting, and website administration.

When personal data is no longer necessary, we will take reasonable steps to delete it, securely destroy it, or anonymise it, subject to applicable legal obligations and lawful grounds for continued retention.

11. How We Protect Personal Data

We recognise the importance of protecting personal data against unauthorised access, disclosure, alteration, loss, destruction, and misuse.

Subject to the nature of the information and the risks involved, we implement appropriate technical and organisational safeguards, which may include:

Restricting access to personal data to authorised personnel.
Using appropriate password and access-control measures.
Protecting systems against malware and unauthorised access.
Maintaining confidentiality obligations for relevant staff and service providers.
Using secure transmission methods where appropriate.
Taking reasonable steps to protect physical records and storage systems.
Reviewing security practices and addressing identified weaknesses.
Maintaining procedures for identifying, assessing, and responding to personal data breaches.

No website, electronic transmission, or storage system can be guaranteed to be completely secure. Nevertheless, we will take reasonable and appropriate measures to safeguard the personal data entrusted to us.

Where a personal data breach occurs, we will assess the incident and take the notifications, mitigation measures, and other actions required by applicable law.

12. Your Data Protection Rights

Subject to applicable law and any relevant limitations, you may have the following rights concerning your personal data.

12.1. Right to Be Informed

You have the right to receive clear information about how and why your personal data is processed.

12.2. Right of Access

You may request confirmation of whether we process your personal data and request access to relevant information.

12.3. Right to Rectification

You may request the correction or completion of personal data that is inaccurate or incomplete.

12.4. Right to Erasure

In circumstances provided for by applicable law, you may request the deletion of your personal data.

This right is not absolute. We may need to retain certain information to comply with legal obligations or establish, exercise, or defend legal claims.

12.5. Right to Restrict Processing

You may request the restriction of processing in circumstances recognised by applicable law.

12.6. Right to Object

You may object to certain processing activities where the law grants you that right.

You have the right to object to the processing of your personal data for direct marketing purposes, as applicable under the law.

12.7. Right to Data Portability

Where the applicable legal requirements are satisfied, you may request a copy of qualifying personal data in a structured, commonly used, and machine-readable format or request its transfer to another controller where technically feasible and legally required.

12.8. Right to Withdraw Consent

Where we rely on consent, you may withdraw that consent at any time.

Withdrawal will not affect processing lawfully carried out before your consent was withdrawn.

12.9. Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions made solely through automated processing that produce legal or similarly significant effects.

12.10. Right to Lodge a Complaint

If you believe that we have processed your personal data unlawfully or failed to respect your data protection rights, you may contact us or lodge a complaint with the Nigeria Data Protection Commission.

The exercise of these rights is subject to applicable law, including any relevant exceptions, restrictions, and verification requirements.

13. How to Exercise Your Rights

To submit a privacy request, contact us using the following details:

Email: info@greyfieldhotels.com
Telephone: +234 809 999 1303
Address: 20 Irhirihi Road, Off Airport Road, GRA, Benin City, Edo State, Nigeria.

Please include sufficient information to help us understand your request.

We may request reasonable information to verify your identity or authority to act on behalf of another person before disclosing or changing personal data.

We will respond within the period required by applicable law. Where a request cannot be fulfilled, we will explain the reasons where legally required.

There is no charge for exercising your rights in ordinary circumstances, although applicable law may permit a reasonable fee or refusal in certain cases, such as manifestly unfounded or excessive requests.

14. Children’s Personal Data

Greyfield Hotels recognises the importance of protecting children’s privacy.

We may process children’s personal data when necessary to facilitate family accommodation, manage a reservation, provide appropriate hospitality services, protect a child’s safety, or comply with applicable legal obligations.

Where the processing of a child’s personal data requires parental or guardian consent or other additional safeguards, we will take appropriate steps to comply with the law.

We do not knowingly collect children’s personal data for unrelated purposes or engage in unlawful profiling or marketing directed at children.

Parents and legal guardians who have questions about a child’s personal data may contact us using the details provided in this policy.

15. Third-Party Websites and Services

Our website may contain links to third-party websites, booking platforms, payment services, or social media platforms.

These services may operate under separate privacy policies and terms of use.

Greyfield Hotels is not responsible for the independent privacy practices of third-party websites that we do not control.

We encourage you to review the privacy policy of any third-party service before submitting personal information through that service.

16. Direct Marketing and Communication Preferences

We may contact you regarding reservations, payments, changes to bookings, service enquiries, safety notices, and other operational matters.

Where permitted by law, we may also send promotional messages about our accommodation, hospitality facilities, offers, and events.

You can opt out of promotional communications at any time by using the unsubscribe option provided or contacting info@greyfieldhotels.com.

Your marketing preferences will be respected in accordance with applicable law.

Opting out of promotional communications will not prevent us from sending essential service-related or legally required notices.

17. Personal Data Breaches

A personal data breach may involve the accidental or unlawful loss, alteration, destruction, disclosure of, or access to personal data.

If we become aware of a suspected or confirmed breach affecting personal data, we will take appropriate steps to investigate, contain, and mitigate the incident.

Where notification to the Nigeria Data Protection Commission or affected individuals is required, we will make the necessary notifications within the applicable legal timeframes.

We will also take reasonable steps to prevent a similar incident from occurring again.

18. Changes to This Policy

We may update this Data Protection and Privacy Policy from time to time to reflect changes in our business operations, website functionality, service providers, security practices, or applicable legal requirements.

The revised version will be published on our website with an updated revision date.

Where required by applicable law, we will provide additional notice or seek consent before implementing material changes that require it.

We encourage visitors and guests to review this policy periodically.

19. Contact Us

If you have questions about this policy, wish to exercise your data protection rights, or have a concern about how your personal data is handled, please contact Greyfield Hotels & Apartments.

Greyfield Hotels & Apartments

Website: greyfieldhotels.com
Email: info@greyfieldhotels.com
Telephone: +234 809 999 1303
WhatsApp: +234 809 999 1303
Address: 20 Irhirihi Road, Off Airport Road, GRA, Benin City, Edo State, Nigeria.

Please use the subject line “Data Protection and Privacy Enquiry” when contacting us by email.

We are committed to handling legitimate privacy enquiries responsibly and in accordance with applicable data protection requirements.

End of Policy