Herivium Limited (“Herivium”, “we”, “us”) operates the Herivium mobile app and website (together, the “Platform”), through which you can discover and book cultural places, events and packages in Lagos and across Nigeria.
This policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it. We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, other data protection laws.
Herivium Limited is the data controller for personal data collected through the Platform.
1. Data we collect
Data you give us
- Account details: name, email address, phone number, password (stored in hashed form) and, if you choose to add it, a profile photo.
- Booking details: the places, events and packages you book, visit dates, number of guests, and any notes or requests you add to a booking.
- Payment details: we do not store your full card number, CVV or bank login. Payments are processed by our payment partners (see section 4), who send us a payment reference, the last four digits of your card, the card type, and the transaction amount and status.
- Communications: messages you send to our support team by email, phone or in-app, and any reviews or ratings you post.
- Vendor details (vendors only): business name, registration details, bank account details for settlement, contact person, and the listings you create.
Data we collect automatically
- Location: with your permission, your device’s precise location, used to show places near you. You can turn this off in your device settings; the app will then ask you to enter a location manually.
- Device and usage data: device type and operating system, app version, IP address, language settings, the screens you view, features you use, and crash reports.
- Booking activity: when a booking is redeemed at a venue (via your visit PIN or QR code), we record the time and place of redemption. This is used to confirm your visit, settle payment to the vendor, and populate your personal stats (places visited, events attended).
Data from third parties
- If you sign in with Google, we receive your name, email address and profile picture from Google in line with the permissions you grant.
- Our payment partners send us transaction status and, where a payment fails or is disputed, the reason.
2. Why we use your data and our legal basis
| Purpose | Legal basis under the NDPA |
|---|---|
| Creating and managing your account | Performance of a contract |
| Processing bookings, sending confirmations and visit PINs/QR codes, and handling cancellations and refunds | Performance of a contract |
| Taking payment and paying vendors | Performance of a contract; legal obligation (financial record-keeping) |
| Showing places near you | Consent (device location permission) |
| Sending booking reminders and service messages | Performance of a contract |
| Sending marketing emails or push notifications about new places, events and offers | Consent (you can opt out at any time) |
| Preventing fraud, abuse and unauthorised access | Legitimate interest |
| Fixing bugs, understanding how the Platform is used and improving it | Legitimate interest |
| Responding to support requests and disputes | Performance of a contract; legitimate interest |
| Complying with law, regulators, courts and payment-network rules | Legal obligation |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
3. Marketing
We will only send you marketing emails or push notifications if you have opted in. You can opt out at any time from the app’s notification settings, by using the unsubscribe link in any marketing email, or by emailing info@herivium.com. Opting out of marketing does not stop service messages about your bookings.
4. Who we share data with
We share personal data only where necessary, and only with:
- Vendors: when you book, the vendor receives your name, the booking details, and the number of guests, so they can prepare for and confirm your visit. Vendors do not receive your payment details. Vendors may only use your data to fulfil your booking.
- Payment processors: Paystack and Flutterwave process card and bank payments on our behalf and are independently regulated by the Central Bank of Nigeria.
- Service providers: companies that host our servers, deliver emails and push notifications, provide analytics and crash reporting, and provide map data. These providers act on our instructions under written contracts and may not use your data for their own purposes.
- Professional advisers and authorities: lawyers, auditors, regulators (including the Nigeria Data Protection Commission and the Central Bank of Nigeria), law enforcement and courts, where required by law or to protect our rights or the safety of users.
- A buyer or successor: if Herivium is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
We do not sell your personal data.
5. International transfers
Some of our service providers store or process data on servers outside Nigeria. Where we transfer personal data outside Nigeria, we do so in line with the NDPA, relying on transfers to countries with adequate protection, contractual safeguards with the recipient, or your consent where required.
6. How long we keep data
| Data | Retention |
|---|---|
| Account details | For as long as your account is active, then deleted within 90 days of account closure, unless we must keep it longer for legal reasons |
| Booking and transaction records | 7 years after the transaction, to meet financial record-keeping and tax obligations |
| Support communications | 2 years after the query is closed |
| Location data | Used in real time to show nearby places; not stored beyond the current session |
| Usage and crash data | Up to 24 months, in aggregated or pseudonymised form where possible |
| Marketing consent records | For as long as you are opted in, plus 2 years, so we can show we had consent |
When data is no longer needed we delete it or anonymise it so that it can no longer identify you.
7. Your rights
Under the NDPA you have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data. You can edit most account details in the app.
- Delete your data, subject to our legal obligations to keep certain records (see section 6). You can delete your account from the app’s settings or by emailing us.
- Restrict or object to processing, including objecting to processing based on legitimate interest.
- Withdraw consent at any time where we rely on consent (for example location or marketing), without affecting processing that took place before withdrawal.
- Data portability: receive the data you gave us in a structured, machine-readable format.
- Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data properly. We would appreciate the chance to resolve your concern first.
To exercise any of these rights, email info@herivium.com with the subject “Data request”. We will respond within 30 days and may ask you to verify your identity before acting.
8. Security
We protect personal data using measures including encryption in transit (TLS), hashed passwords, access controls limiting staff access to data they need for their role, and logging of access to production systems. No system is completely secure; if we become aware of a breach that is likely to affect your rights, we will notify the NDPC and, where required, affected users, within the timeframes set by the NDPA.
9. Children and young people
Users must be at least 13 to create an account. Users aged 13 to 17 may create an account only with the permission of a parent or guardian, which we ask them to confirm at sign-up, and any bookings they make must be paid for using a parent or guardian’s payment method.
For users under 18 we collect only the data needed to run their account and bookings, and we do not send them marketing without parental consent. Parents and guardians can ask to see, correct or delete their child’s data by emailing info@herivium.com. If you believe a child under 13 has created an account, contact us and we will delete it.
Children attending an Experience as guests on an adult’s booking are not registered; we record only the number of guests.
10. Cookies and similar technologies (website)
Our website uses strictly necessary cookies to keep you signed in and to remember your preferences, and analytics cookies to understand how the site is used. You can control cookies through your browser settings; blocking necessary cookies may stop parts of the site from working.
11. Third-party links
The Platform may contain links to vendor websites, social media or other third-party sites. We are not responsible for their privacy practices and encourage you to read their policies.
12. Changes to this policy
We may update this policy from time to time. We will post the updated version on the Platform with a new “Last updated” date, and notify you in the app or by email if the changes are material.
13. Contact us
For questions about this policy or your personal data, contact our data protection contact using the details below. You can also read our Terms and Conditions and Refund & Cancellation Policy.