In Short
We collect what we need to run Erroway: to help you discover experiences, make bookings, and get support.
We share booking details with experience providers so they can deliver what you booked.
Payments are processed by trusted providers; we don't store your full card details.
We use necessary cookies for core functionality and ask before using analytics/marketing cookies.
You can request access, correction, deletion, or object to processing by contacting us.
Who We Are
Erroway is an online marketplace that helps people discover and book experiences and curated packages in Lagos, Nigeria.
Data Controller
Scope
This policy applies when you:
- Visit our website or use our web app
- Browse experiences/packages, search, or apply filters
- Make a booking or attempt payment
- Contact us (email, forms, support)
Personal Data We Collect
We collect only what is adequate, relevant, and limited to what is necessary.
Why We Use Your Data
We process personal data only when a lawful basis applies under the Nigeria Data Protection Act (NDPA) and GDPR.
| Purpose | Lawful Basis |
|---|---|
| Provide service (search, booking, coordination) | Contract Necessity |
| Customer support | Contract / Legitimate Interests |
| Fraud prevention & platform security | Legitimate Interests / Legal Obligation |
| Marketing messages (if enabled) | Consent |
| Analytics & cookies (non-essential) | Consent |
| Compliance (accounting, tax, legal claims) | Legal Obligation / Legitimate Interests |
Automated Decision-Making
Erroway does not make decisions that produce legal or similarly significant effects solely through automated processing. Any operational decisions involving bookings, cancellations, or reviews involve human oversight.
Data Retention
We retain personal data for no longer than necessary.
Residual copies may remain in backups for a limited period; access is restricted.
Your Rights
Under NDPA and GDPR, you have rights including access, correction, deletion, restriction, and objection. To exercise rights, email privacy@erroway.com with:
- Your name and email used on Erroway
- The request (access/correction/deletion/objection)
- Relevant booking reference (if applicable)
You also have the right to lodge a complaint with the Nigeria Data Protection Commission.
We respond to verified privacy requests within 30 days, unless the request is complex or requires additional verification. In such cases, we will inform you of any extension and the reason.
Security
We implement appropriate technical and organizational measures including access controls and encryption in transit. If a personal data breach occurs that risks individuals' rights, NDPA requires notification to the Commission (and affected individuals where high risk is likely) within 72 hours where feasible.
If you believe your personal data has been compromised, please contact us immediately atsecurity@erroway.com.
Cross-Border Transfers
Erroway may use service providers that process data outside Nigeria (e.g., cloud hosting, email, analytics). NDPA restricts transfers unless an adequate protection basis applies. We maintain vendor agreements and documented transfer bases for compliance.
Children's Privacy
Erroway is not intended for children under 16. Where child consent rules apply, we require parental/guardian consent for processing based on consent for children.
Changes to This Policy
When we update this policy, we will update the "Last updated" date and provide notice on the site or via email for material changes.
Update Log:
Questions about your privacy?
Contact our data protection team.