Cyforce Estate Security & Access Management System – Privacy Policy
Effective date: November 1, 2026
Cyforce Security Ltd. operates this estate access and community management service. This policy explains what personal information is collected, why it is used, who may access it, how it is protected and how residents can exercise their privacy rights. The estate management body acts as the data controller for estate-specific resident and visitor records where it determines the purposes of processing. Cyforce Security Ltd. and Cyforce Technologies Ltd. provide security and technology services as applicable.
1. Information we collect
- Resident and tenant names, phone numbers, email addresses, house numbers, resident category and household/representative relationships.
- Profile photographs and identity documents submitted for identity and occupancy verification, such as NIN documents, voter cards, driver licences or international passports.
- Visitor names, phone numbers, visit purpose, vehicle details and expected visit times.
- QR credential identifiers, entry and exit timestamps, gate, guard and device identifiers, and offline synchronisation records.
- Estate dues, payment references, submitted payment evidence, approval status and receipts.
- Community posts, meeting registrations, announcements and communications.
2. Purposes and lawful basis
Information is used to verify residents and authorised occupants, issue and revoke access passes, manage visitors, protect estate premises, maintain security logs, administer estate services and dues, send essential notices and meet legal obligations. Processing should be limited to what is necessary for these purposes and based on an appropriate lawful basis under applicable Nigerian data protection law, including the Nigeria Data Protection Act 2023.
3. QR passes and access logs
QR codes contain a randomised or signed credential reference and must not expose identity-document numbers or full identity records. Guards may see only the information needed to verify the person and make an access decision. Entry and exit events may be recorded offline on an authorised guard device and synchronised when connectivity returns. Offline records may be delayed; the central log will indicate synchronisation status.
4. Sharing and access
Access is role-based. Estate chairmen and authorised estate officers may review applications and administer residents. Guards may view limited verification details needed at the gate. System administrators and authorised technical personnel may access records only for support, security and administration. Information is not sold. Information may be disclosed where required by law, to protect people or property, or to authorised service providers bound by confidentiality and security obligations.
5. Identity documents and security
Identity documents are particularly sensitive. They must be stored in access-restricted, non-public storage, protected by appropriate technical and organisational safeguards, and accessible only to authorised verifiers. Website operators must configure server-level access restrictions, HTTPS, backups, malware protection and least-privilege accounts. Do not upload identity documents until the hosting environment has been checked. QR codes are credentials and should be kept private; lost or compromised passes should be revoked and replaced.
6. Retention and deletion
Personal information is retained only for as long as necessary for access administration, security investigations, financial reconciliation and legal obligations. Retention periods should be approved and documented by the estate management body. Expired tenancy records, old visitor details, identity documents and access logs should be reviewed periodically and securely deleted or anonymised when no longer required, unless a lawful hold applies.
7. Resident rights and requests
Subject to applicable law, residents and visitors may request access to their personal information, correction of inaccurate details, deletion or restriction where appropriate, and may raise concerns about its use. Requests should be submitted to the estate management body or the contact listed in the estate's notices. Identity may be checked before responding.
8. Children and household members
A parent, guardian or authorised adult should submit information for minors and manage their access credentials. Only the minimum information needed for safe estate access should be collected.
9. Notifications and email
Estate notices, visitor alerts, meeting information, dues reminders and payment status messages may be sent to the email address or phone number provided. Essential security and account messages may still be sent where permitted by law. Residents should keep their contact details current.
10. Changes and contact
This policy may be updated when the system or applicable law changes. The current version will be published on the estate website. For privacy questions or requests, contact the estate management body or Cyforce Security Ltd. at info@cyforcesecurity.com.
This template is general information, not legal advice. Each estate should review and adapt it to its actual practices, retention periods, responsible data controller, contact details and applicable legal obligations before publication.