There may be a need to update this policy periodically, for example as a result of government regulation, new technologies or other developments on data protection and / or privacy laws. The current version of this policy is available on our website (www.leola.ng)
The following roles are defined for the purpose of this policy:
Data Subject: is an identifiable person; one who can be identified directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity and includes Leadway Hotels’ clients, customers, business partners and employees.
Data Administrator: means a persons or organization that processes data. For the purpose of this policy, Leadway Hotels is the Data Administrator.
Data Controller: means a person who either alone, jointly with other persons or in common with other persons or as a statutory body determines the purposes for and the manner in which personal data is processed or is to be processed. For the purpose of this policy, the General Manager is the Data Controller or whoever he so delegates.
Data Protection Officer: is appointed by the data controller to ensure that the strategy and implementation of data protection requirements are in compliance with the data protection policy and the relevant extant laws. For the purpose of this policy, the data protection officer is defined as the Chief Compliance Officer of Leadway Group.
Responsibilities of the Data Administrator, Data Controller and Data Protection Officer are clearly outlined in the Nigeria Data Protection Regulation (2019).
When Leadway Hotels collects and processes the personal information of its data subjects, Leadway Hotels adheres to strict controls to ensure that personal data of the data subject is obtained and used in line with the company’s privacy principles. Leadway Hotels handles personal data with the greatest care and use it only for legitimate and specified business purposes under the following principles:
- Leadway Hotels respects the privacy rights of its employees, customers, clients, business partners and other individuals whose personal data are in its custody and use.
- Leadway Hotels protects personal data by implementing appropriate technical and organizational measures in our data processing operations.
- Leadway Hotels obtains personal data fairly and only use it for legitimate business purposes based on permissible legal basis for processing personal data.
- Leadway Hotels holds itself accountable for demonstrating compliance with applicable legal and regulatory requirements and understanding of our roles and responsibilities.
All personal information collected by Leadway Hotel is processed in accordance with the extant data protection laws in Nigeria.
- Type of Information Processed by Leadway Hotel
Leadway Hotel may process the following information when prospective clients make reservations:
- Information about the data subject – for example name, age, gender, date of birth, nationality, occupation.
- Means of identification – date of birth, National Identity Card Number (NIN), International Passport details, Drivers’ License, Voter’s card details, etc.
- Contact information – in some cases, for example, the Company may receive the data subject’s email, address, and phone number.
- Online information – for example cookies and IP address (your computer’s internet address), if you use Leadway’s websites.
- Financial information – the Company may process information related to payments the data subject make or receive in the context of confirmation of payment or making a refund. This includes information such as data subject’s account number.
- Other sensitive personal data (COVID-19 tests results, itinerary of last 7days etc.)
- Requirement for Consent
- Where data subjects provide their consent for use of their personal information, Leadway Hotels will explain the reason for obtaining the data subject’s consent. Without such consent, Leadway Hotels may be unable to provide their hospitality services when the need arises. Where the data subject provide personal information about third parties, Leadway will ask such clients to confirm that the third party has given consent to the data subject to act on their behalf and will provide Leadway Hotels with a copy of the consent issued.
- Consent will be obtained via the same medium used to obtain personal information or through any other means that is acceptable to Leadway Hotels. Reference will be made to this Policy or a summarized version that can be easily understood by the data subject. The data subject will be required to indicate understanding and acceptance of the terms contained in the policy. This can be via signature for physical documents or a ticked checkbox for electronic platforms.
- Where Leadway Hotels has appropriate, legitimate business need to use client personal information for maintenance of business records including development and improvement of products and services, Leadway will take extra care to ensure that the data subject’s rights to security and confidentiality is not infringed upon.
- Reasons for use and process of data by Leadway Hotel
- Leadway Hotels will obtain the consent of the data subject before use and processing of the data for one or more specific purposes made known to the data subject.
- Such personal data obtained with the consent of the data subject shall not be used in any manner other than the stated purpose for which the data was obtained, except with further consent of the data subject whether at the instance of the data subject or upon Leadway Hotels engagement with the data subject.
- Leadway Hotels may use data subject’s personal data for a number of reasons:
- Provision of hospitality services
- Assessing, improving and developing our services
- Enhancing our knowledge of hospitality services in general
- Fulfilling legal or regulatory obligations and protecting ourselves and our clients against fraud. Such regulators include Nigeria immigration service, Economic and Financial Crimes Commission, Nigerian Financial Intelligence Unit and such other regulatory agencies that is created from time to time.
- For the protection of public interest such as investigation of fraudulent claims and anti-money laundering checks.
- For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
- For the purpose of assessment of proposed data subject’s employability and other employee benefits-related purposes.
- Leadway Hotels applies information protection technologies including perimeter security, malware management, data loss prevention and backup & recovery. Leadway Hotels data centers are also protected against environmental threats. Leadway Hotels information security policies and practices apply to all personal information in the company’s custody.
- Methods of collecting private information
- In most cases, Leadway Hotels receives personal data directly from the data subject.
- The following shall comprise the method of collection of personal information:
- Direct collection:
- Know Your Customer (KYC) forms
- Refund Vouchers
- Forums and feedback forms
- Recorded telephone conversations
- Digital touch points
- Electronics means (emails)
- Employee engagement personal data forms (inclusive of medical report)
- In the case of Leadway Hotels customers, the data subject will provide consent by responding to a dialogue box corresponding to declarations indicating whether consent is given or declined. Such declaration will be in clear and plain language. For children’s personal data, consent will be sought from their legal guardian.
- Social Media Platforms
- The data subject may wish to participate in various blogs, forums, and other social media platforms hosted by Leadway Hotels (“Social Media Platforms”) which are made available to the data subject. The main aim of these Social Media Platforms is to facilitate and allow the data subject share content. However, Leadway Hotels cannot be held responsible if the data subject shares personal information on Social Media Platforms that is subsequently used, misused or otherwise appropriated by another user. The data subject is required to consult the Privacy Statements of such services before using them.
- Third Party Access and Purpose of Access
- Disclosure to Employees
- Leadway Hotels employees have access to and process personal data based upon a “need to know” basis in order to do their job. Leadway Hotels regularly check who has access to its systems and data.
- Disclosures to Third Parties
- Leadway Hotels may disclose data subjects’ personal data to these categories of third parties:
- Leadway Hotels service providers and agents e.g. IT companies who support Leadway Hotels technology, marketing agencies, and tax advisers.
- Leadway Hotels professional advisers: auditors; medical agencies for COVID 19 basis and legal advisers.
- Persons legally authorized to act on behalf of Leadway Hotels e.g. Lawyers etc.
- Individuals nominated and authorized by the data subject to engage Leadway Hotel on his/her behalf.
- Fraud detection agencies and other parties who maintain fraud detection registers.
- Customer relationship management
- Independent Customer satisfaction survey providers.
- Financial organizations and advisers.
- Government and its agencies.
- Emergency assistance Companies.
- Selected third parties in connection with the sale, transfer or disposal of the business or in connection with employee assessment, academic records verification and employee well-being survey.
The above disclosures to the third party shall be made only to the extent necessary for the specific purpose for which the data is provided and the third party shall be informed of the confidential nature of such information and shall be directed to keep the data subject’s information strictly confidential.
- Lawful Processing of Personal Data
- There are a number of legal grounds that may apply and the following ones are most likely to be relevant to the data subject:
- Leadway Hotels may process the personal data of the data subject when Leadway Hotels obtains the data subject’s consent or when Leadway Hotels clients obtains consent from the data subject.
- Where the data subject has a contract with Leadway Hotels, the personal data of the data subject may be processed when it is necessary in order to enter into or perform a contract.
- Where Leadway Hotels has a legal obligation to perform such processing, such as where Leadway Hotels shares information with its regulators, law enforcement agencies or court.
- In order to protect the vital interests of the data subject or of another natural person.
- Where Leadway Hotels is required to do so by law or regulatory bodies such as where a court order exists to such effect or there is a statutory obligation to do so.
- Where it is necessary to facilitate prevention and/or detection investigation of criminal action (including fraud) or is otherwise in the overriding public interest.
- Where exemptions under the Data Privacy law allows Leadway Hotel to disclose such information.
- Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of public mandate vested in Leadway Hotel.
The following table contain breakdown of lawful grounds which Leadway Hotels relies on for processing personal information of its clients:
|#||Purpose for collection and processing of data subject’s personal information||Collectable Personal information includes but not limited to the ones set out below||Legal grounds for processing personal information|
|1||To make room reservations.||Name, Phone number, Email, Car Registration number, Nationality, Home address, Passport Number etc||The use described is necessary for provision of hospitality services and based on customer’s consent.
|2||For data subject’s communication and resolution of complaints.||Contact details and any information relevant to the complaint.||The use described is required for provision of hospitality services and to resolve any legitimate concerns.
Where sensitive personal information is requested, it may be necessary for the exercise and defense of Leadway Hotels legal rights, where the client has provided consent or where we have applied or obtained exemption for such purposes or on the basis of a contract that exists between Leadway Hotel and the customer.
|3||To prevent, detect and investigate fraud. This may include collection of biometric information such as voice prints.||Contact details, age, age of other persons included on the reservation list if any, CCTV recording, internet login details, browsing history where the hotel’s internet is used, etc
Sensitive personal information such as biometrics (i.e. voice print).
|Necessary for the provision of hospitality services and a legitimate business need to prevent fraud or to prevent or for the investigation of a crime.
Where sensitive personal information is requested, it may be necessary for the exercise and defense of Leadway Hotels legal rights, where the data subject has provided consent or where we have applied an exemption for such purposes.
|4||Compliance with legal and / or regulatory obligations||Details about the data subject, other related parties, specific product required by the data subject, service or benefit, depending on the nature of the obligation.||Necessary for Leadway Hotels to comply with Legal and Regulatory obligations.|
|5||Providing marketing information to Leadway Hotel clients including information about other products and services and undertaking customer surveys in accordance with preferences communicated by the data subject.||Name, contact details and marketing preference.||Data subject’s consent.|
|6||Determination of employability, background check up, academic records verification, and employee surveys and other HR processes requiring personal identifiers.||Name, contact details, academic records, health background / information, Marital status, criminal history record, Biometric details, Academic records, and Gender||To determine employability and to improve employee wellbeing, and regulatory demands. The relevant legal basis will either be consent or contract or processing made in anticipation of the performance of a contract|
- Foreign Transfer of Personal Data
- In most cases, Leadway Hotels does not transfer client’s personal information to a third party in a foreign country. In the event of any transfer, Leadway Hotel shall ensure such country has adequate data protection laws for data transfer, to be determined by the Attorney General of the Federation and the Data subject shall have the right to be informed of the appropriate safeguards for data protection in the foreign country.
- Where the Attorney General of the Federation has not determined the status of a third party country, the data subject’s personal information may be transferred to a third party in a foreign country in the following circumstances:
- Where the data subject has consented to the proposed transfer after having been informed of the possible risks of such transfers
- The transfer is for the performance of a contract between the data subject and the data controller
- The transfer is for the performance of a contract concluded in the interest of the data subject between the Data Controller and another natural or legal person
- The transfer is for public interest
- The transfer is for the establishment exercise or defence of legal claim
- The transfer is to protect the vital interest of the data subject or other persons, where the data subject is physically or legally incapable of giving consent.
The data subject shall have the right to be informed of the appropriate safeguards for data protection in the foreign country.
- Length of time for keeping client personal information
The length of time for storing data subject’s personal information shall be in line with Leadway Group Data Retention Schedule in its Retention Policy. This includes keeping the data subject’s information for a reasonable period of time as stated in the Retention policy after the data subject’s relationship with Leadway Hotels or its client has ended and particularly for statistical analysis, pricing purposes.
In certain instances, Leadway Hotels will minimize personal data; or de-identify data for use in statistical or analytical activities. This is undertaken in accordance with the data protection laws.
- Data Subject’s Rights
- Leadway Hotels shall disclose the specific purpose for which the information is required before obtaining the information from the data subject and shall inform the data subject of his/her right and method of withdrawal of consent.
- The data subject has the right to request that Leadway Hotels perform certain activities on his/her personal information, such as request for a copy of their personal information, correction of errors on the personal information, a change in the use of their personal information, or delete their personal information. Leadway Hotels is obligated to either carry out the data subject’s instructions or explain why it may not be possible – usually because of a legal or regulatory issue.
- Data subject have the following rights in respect of Leadway’s use of their personal information:
- Right to access: The data subject has a right to a copy of their personal information as maintained by the Company
- Right to rectify: Leadway Hotels takes due care to ensure that the personal information we maintain about data subjects are accurate and complete. However, if a data subject believes the information is inaccurate or incomplete, such data subject has the right to request an amendment.
- Right to erase: under certain circumstances, a data subject may ask that Leadway Hotels erase their personal information. For instance where the personal information collected is no longer necessary for the original purpose or where consent is withdrawn. There may be some legal and regulatory obligations which prevents Leadway from complying immediately.
- Right to restriction of processing: under certain circumstances, but subject to regulatory requirements, a data subject may be entitled to instruct Leadway Hotels to stop using his/her personal information. This is applicable where
- A data subject contests the accuracy of personal information held by the data controller
- Processing of personal data of the data subject is unlawful
- The data controller no longer requires the personal data but the data is required by the data subject for establishment, exercise or defense of legal claims
- The data subject has objected to processing, pending the verification whether the legal grounds for the data controller override those of the data subject.
- Right to data portability: under certain circumstances, data subjects have the right to ask that Leadway Hotels transfers any personal information that they have provided to Leadway Hotel to another third party. Once transferred, the other party will be responsible for safeguarding such personal information.
- Right to object to marketing: Data Subject can object to the processing of his/her personal data for the purposes of third party marketing.
- Right to lodge a complaint: Leadway Hotels data subject has the right to lodge complaints, in the event that there is an objection to the manner in which personal information is being used by the Company. Such complaints can be communicated using contact details provided on our website. In certain cases, Leadway Hotels may be unable to comply with data subject’s requests for reasons such as our own obligations to comply with other legal or regulatory requirements. However, Leadway Hotels will always respond to complaints and where compliance is not feasible, an explanation will be provided.
Data subjects can enforce the above rights by sending an email to or . The Data Controller is obligated to act on the request of the data subject without delay. In the event that the Data Controller does not take action on the request of the Data Subject, the Data Controller shall within one month of receipt of the request, inform the data subject of the reasons why the request has not been actioned.
The exercise of the rights listed above shall be in conformity with constitutionally guaranteed principles of Law for the general protection and enforcement of fundamental rights.
- Ultimately, it is Leadway Hotels employees who are the most important element of Leadway Hotels commitment. Leadway Hotels employees are involved in every step of the data lifecycle, including sourcing and receiving personal data, processing it in compliance with laws and regulations, employing safeguards, and establishing the means and schedules of retention and deletion. It is therefore imperative that Leadway Hotels employees understand their role and be committed to safeguarding personal data.
- Leadway Hotels designs its training programme to be relevant, focused on the individual and also focused on concrete risks. Leadway Hotels runs regular data protection and information security awareness campaigns. Leadway Hotels also share with its employees other knowledge resources on data protection and privacy topics, including guidance on ways that they can better protect and safeguard personal privacy.
- Leadway Hotels employees understand the seriousness of protecting personal data and respecting privacy rights with the ability to relate this back to the risks and consequences from an individual perspective. Through Leadway Hotels efforts, it remains committed to realize its goal to ensure its employees and business partners understand their respective roles and responsibilities for data protection compliance.
- The data subject reserves the right to the use of his/her personal information for marketing and Leadway Hotels shall obtain the consent of the client prior to using such information for marketing purpose in specific cases not covered under this policy.
- Leadway Hotels shall be committed to only send its data subjects marketing communications that meets the needs and behaviours of the data subject. Where the data subject chooses to unsubscribe from our mailing lists, such can be achieved at any time by following the unsubscribe instructions that appear in all marketing emails or contact Leadway Hotel via the details on its website.
- Periodically, Leadway Hotels may run specific marketing campaigns through social media and digital advertising that the data subject may see which are based on general demographics and interests. Individual personal information is not used for these campaigns. Should a data subject not want to see such campaigns, the data subject shall be responsible for adjusting preference settings within the specific social media platform including cookie browser settings
- Leadway Hotels may retain any data provided on its website for a reasonable period, subject to the client’s prior approval, even if the service is not consummated and such information may be used to make enquiry on why the service is not consummated.
- Audit and Enforcement of the Data Protection Policy
- The Internal Audit Department of the Company shall conduct the audit of the privacy and data protection practice, in accordance with the extant Data protection regulation and the Data Protection Officer shall be responsible for monitoring compliance with the regulation. In line with the Nigeria Data Protection Regulation 2019, Leadway Hotel shall engage the service of a Data Protection Compliance Organization to conduct audits on an annual basis.
- Remedies for Violation of Data Protection Policy and the Timeframe for Remedy
- In the event of violation of this policy, the data controller shall within 15 days redress the violation. Where the violation pertains to the disclosure of the data subject’s information without his/her consent, such information shall be retracted immediately and confirmation of the retraction sent to the data subject within 48 hours of the redress.
Where the violation is caused by any representative of the data controller, such representative shall be subject to appropriate sanction.
To download a full copy of this policy in PDF format, please visit:
- Contact details of the Data Controller and Data Protection Officer
Leadway Hotel’s Data Controller and Data Protection Officer can be contacted via the following details:
Delineate a data controller from a data processor.
1 Mogambo Close, Maryland Estate,