Compliance / Privacy

Privacy that puts
people first.

Effective 17 September 2026 · Last updated 17 September 2026

PlugOut Village is a Lagos-based app and service platform for discovering experiences, ordering food, making reservations, attending events, sharing content and managing your Village account. This Privacy Notice explains what personal data we collect, why we use it, who may receive it, how long we keep it and the choices available to you.

This Notice is intended to meet the transparency requirements of the Nigeria Data Protection Act, 2023 (the NDP Act), the 1999 Constitution of the Federal Republic of Nigeria and other applicable Nigerian data-protection laws and directives. It does not remove any mandatory right or remedy available under Nigerian law.

1. Who controls your data

For personal data processed through the PlugOut Village app, website and shared Village services, PlugOut Village is the data controller. We operate from Lagos, Nigeria.

Privacy, data-rights and account-deletion requests: hello@plugoutvillage.com. Use the subject line Data protection request. We will route requests to the person responsible for privacy handling.

2. Data we collect

Account and identity data

• Email address, display name and optional username.
• Password in protected one-way hash form; we do not store your readable password.
• Email-verification status, sign-in sessions, security events and account status.
• Information supplied when you contact support or request account assistance.

Profile, preference and device data

• Optional profile information such as biography, date of birth, visibility choice and profile image.
• Saved searches, favourites, visits, carts, notification preferences and other settings stored on your device.
• Push-notification device token and platform when you enable Village notifications.
• Basic technical information such as IP address, browser or app user-agent, request identifiers, app version, security logs and diagnostic information.

Orders, bookings and payments

• Orders, selected products and add-ons, quantities, prices, order status, pickup or delivery method and fulfilment notes.
• Reservation details such as date, time, guest count, table or resource, customer contact details and booking status.
• Event, ticket, membership, loyalty and support records connected to your account.
• Payment-provider reference, amount, currency, payment status and reconciliation details. Card numbers, PINs and full payment credentials are handled by the payment provider and are not stored by PlugOut Village.
• Delivery address and contact information when delivery is available and you choose to use it.

Community and media data

• Posts, comments, likes, follows, saved posts, reports and messages you submit through PlugOut Connect.
• Images or videos you choose to upload, together with moderation, processing and delivery information.
• Any location, caption or other information you voluntarily include in public content. We do not request precise device location in the current mobile implementation.

Information from optional providers

If a native provider is enabled for your release and you use it, we may receive information from Google, Apple, Firebase or another authentication, notification, analytics or crash-reporting provider. The specific data depends on the feature and your device settings. The marketing website is a static site and does not use advertising cookies or third-party tracking scripts in its current implementation.

3. Why we use personal data

We use the minimum information reasonably needed to:

• create and secure your account, authenticate you and recover access;
• provide menus, experiences, reservations, tickets, orders, memberships and customer support;
• process payments through authorised payment providers and prevent fraud, abuse and duplicate transactions;
• send service, security, booking, order and delivery notifications you request or that are necessary to operate the service;
• publish and moderate content according to your visibility choices and the Community rules;
• troubleshoot, maintain, measure and improve the app, website and infrastructure;
• comply with court orders, regulatory requests, tax, accounting, safety and other legal obligations; and
• protect the rights, property, safety and integrity of PlugOut Village, our users and participating businesses.

4. Lawful bases

Depending on the activity, our lawful basis is performance of a contract or steps requested before a contract, compliance with a legal obligation, your consent, protection of vital interests, public interest where applicable, or our legitimate interest in operating a secure and useful service. Where we rely on consent, you may withdraw it at any time; withdrawal does not undo processing already carried out lawfully or stop processing required for a contract or legal obligation.

5. When we share data

We do not sell or rent personal data. We share it only when reasonably necessary for the purposes described in this Notice, including with:

• the participating restaurant, bakery, lounge, studio, event organiser or other experience provider needed to fulfil your order, booking, ticket, membership or support request;
• payment providers such as Paystack or Stripe when configured, subject to their own terms and privacy notices;
• delivery, hosting, database, storage, media, email, notification, security, monitoring and customer-support providers acting on our instructions;
• Firebase, Google, Apple or similar providers only when the relevant optional feature is enabled and used;
• professional advisers, insurers, auditors or a successor in a merger, acquisition or business transfer, subject to confidentiality and lawful safeguards; and
• law-enforcement, courts, regulators or other persons where disclosure is required or permitted by law, or needed to prevent serious harm, fraud or unlawful activity.

6. Transfers outside Nigeria

Some service providers may process data in Nigeria or another country. Where personal data is transferred outside Nigeria, we use a lawful transfer basis and reasonable contractual, technical and organisational safeguards required by the NDP Act and applicable NDPC directives. You may ask us for general information about the relevant safeguards.

7. Public content and visibility

Content you mark public, including a profile name, username, posts, comments or media, may be visible to other users and may be copied or shared by them. Use private settings where available and do not publish another person’s personal data without a lawful basis or permission. We may hide, restrict or remove content that violates law, safety requirements or our Terms.

8. Retention and deletion

We keep personal data only for as long as it is needed for the purpose collected, your account relationship, security, dispute handling or a legal, tax, accounting or regulatory obligation. Transaction, payment, audit, fraud-prevention and safety records may need to be retained after account deletion for the period required by law or reasonably necessary to establish or defend a claim. Backups may take additional time to expire.

You can delete your account in the app under Settings → Privacy & Data → Delete Account, or email hello@plugoutvillage.com. Account deletion disables access, revokes active sessions and removes or anonymises account information where possible. It does not erase information that we must lawfully retain, or public content and records that must be preserved for safety, dispute resolution or legal compliance.

9. Your rights

Subject to the limits and exceptions in Nigerian law, you may ask us to:

• tell you whether we process your personal data and provide access to it;
• correct inaccurate, incomplete or misleading data;
• erase data or restrict processing in appropriate circumstances;
• provide your data in a commonly used electronic format where portability applies;
• object to processing based on legitimate interest and object to direct marketing;
• withdraw consent where consent is the lawful basis;
• receive meaningful information about significant automated processing and request human review where applicable; and
• complain to the Nigeria Data Protection Commission.

Send requests to hello@plugoutvillage.com. We may ask for reasonable information to verify your identity and protect another person’s data. We aim to respond without undue delay and generally within 30 days after receiving a sufficiently clear request and any information needed to verify it. If a lawful extension, refusal or fee applies, we will explain why.

If you are not satisfied, you may contact the Nigeria Data Protection Commission or use its data-subject request channel.

10. Children

PlugOut Village is not directed at children who cannot lawfully consent. A child or person lacking legal capacity must not create an account or submit personal data without the consent of a parent or legal guardian where required by the NDP Act. If you believe a child has provided data unlawfully, contact us so we can investigate and take appropriate action.

11. Security and breach response

We use access controls, authentication safeguards, password hashing, audit records, secure transport where supported, provider controls and data-minimisation practices designed to protect personal data. No internet service is risk-free, so keep your credentials private and tell us promptly about suspected account misuse.

If we become aware of a personal-data breach likely to create a risk to your rights and freedoms, we will assess it and notify the NDPC within the period required by the NDP Act, including the 72-hour requirement where applicable, and notify affected data subjects where required.

12. Changes to this Notice

We may update this Notice when the service, law or processing activities change. We will publish the new effective date here and provide additional notice where the law requires it. Continued use after an update means you have received the updated Notice; it does not create consent where another lawful basis is required.