Waca Tour: tours and experiences across Nigeria

1.Who is responsible for your data

Waca Tour is run by WACA LTD (registration code 179320290979), of CRD1, Plot 248, Road 2, Street 5, Police Sign Board, Lugbe, Abuja, Nigeria, trading as Waca Tour. We decide why and how your personal data is used, so under the Nigeria Data Protection Act 2023 (NDPA) we are the “data controller”. Where the law requires us to register with the Nigeria Data Protection Commission (NDPC), we do.

Questions or requests about your data: support@waca.com.ng.

In short: we collect what we need to run your booking, we share it only with the people who need it for that, we never sell it, and you can ask to see, correct or delete it.

2.What we collect and why

Who	What we collect	Why
Guests	Name, email address, phone number (where asked), country, the tour, date, party size, pick-up point and any note you add; the booking reference and your QR ticket code.	To make and confirm your booking, take payment, let the operator run your trip and contact you about it.
Guest accounts (optional)	Email address, and if you add them, your name, phone and country; your list of trips.	To show “My trips” and let you cancel or review without retyping your details.
Claims and reviews	What you write, and the photos or documents you attach; your rating and comment (shown as first name and initial).	To look into a problem fairly, and to show honest reviews.
Operators	Company and contact names, CAC number and certificate, tourism licence, bank account details, guides’ and drivers’ names and phone numbers, vehicle papers.	To check and approve your business, run departures, and pay you.
Partners	Company and contact details, API keys (we keep only a scrambled copy), webhook address.	To approve you, let you sell safely and pay your commission.
Everyone	Sign-in and security records, the internet address (IP) you connect from, and a record of important actions on an account.	To keep accounts safe, stop abuse and investigate problems.

We do not collect payment card numbers: card and bank details are entered on our payment provider’s page and stay with them. We do not ask for more than a tour needs, and we do not collect “special category” data (such as health information) unless you choose to tell the operator a medical need in a note, in which case it goes only to that operator for that trip.

3.Our legal reasons

The NDPA lets us use personal data only when there is a lawful reason. Ours are:

To carry out a contract with you: taking, confirming, changing, cancelling and refunding your booking; paying operators and partners.
To follow the law: keeping accounting and tax records, answering lawful requests from authorities, dealing with consumer complaints.
Our legitimate interests: keeping the platform secure, preventing fraud and abuse, fixing faults, and handling claims fairly. We weigh these against your rights and do not use them where your rights matter more.
Your consent, where we ask for it, for example for optional features. You can withdraw it at any time.

4.Who we share it with

The operator of your tour sees your name, contact details, party and pick-up point, because they need them to run the trip. Other operators do not.
The partner who sold you a booking (if you booked through a hotel, app or agency) sees that booking. Partners never see another partner’s bookings.
Payment providers (currently Flutterwave and Paystack) process payments, refunds and bank-account checks under their own privacy rules.
Service providers who help us run the service: for example email delivery, website hosting and storage. They may use your data only to do that work for us.
Our team: only staff who need it for their job, with sign-in protected by a second step. Staff who open private documents or claim evidence are recorded in an audit log.
Authorities, courts and advisers when the law requires it or to protect legal rights.

We never sell your personal data and we do not use it for third-party advertising. The “Write it for me” tool that helps operators draft a tour description sends only the tour title and text the operator typed to our AI provider, never guest information.

5.Sending data outside Nigeria

Some of our providers (for example hosting or email) may store or process data in other countries. When your data leaves Nigeria we make sure it has appropriate protection, as the NDPA requires: we use providers that commit to protect it to a standard comparable to Nigeria’s, with a written agreement, and we follow the NDPC’s rules on transfers.

6.Cookies and similar storage

At the time of writing we use only what the site needs to work: cookies that keep you signed in (guest, operator, partner or staff), a cookie that remembers your language, and your device’s own storage for tours you “save” on this device. We do not use advertising or tracking cookies. If we add analytics later we will update this page and ask where the law requires.

7.How long we keep it

Booking, payment and payout records: for as long as the law requires us to keep accounting and tax records, and while a claim or dispute could still be raised.
Claim evidence and company papers: for as long as the claim, review or legal need lasts, then deleted or made anonymous.
Guest accounts: until you delete them. Deleting your account removes your profile; your past bookings stay as records of the trip with the operator and for the law.
Guest accounts that are never confirmed with the emailed code are removed after a day.

When we no longer need data we delete it or make it anonymous.

8.How we protect it

Connections are encrypted. Operator, partner and staff sign-in needs a password and a second step every time.
API keys are stored only as scrambled copies and shown to you once.
Claim evidence and company papers are private files that only the right people can open, and every opening by staff is recorded.
Access is limited by role, and each person sees only what their job needs.

No system is perfectly safe. If a breach is likely to put your rights at risk, we will tell the NDPC within 72 hours of becoming aware of it, and tell you without delay when the law requires.

9.Your rights

Under the NDPA you have the right to:

know what we hold about you and why (this page and the answer to your request);
see a copy of your data, and have wrong data corrected;
have your data deleted, or its use limited, in the cases the law allows;
object to some uses, including direct marketing, and withdraw consent you gave;
receive your data in a common format (portability);
not be decided about by a machine alone: nothing on this platform is approved or refused by a machine, a person always decides.

To use a right, write to support@waca.com.ng from the email address on your account. We may ask you to prove who you are. Guests can also change their details or delete their account on the account page. We answer without undue delay.

If you are not happy with how we use your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). We would like the chance to put it right first.

10.Children

You must be 18 to have an account. Parents or guardians may book for children and give us the child’s details for that booking only. We do not knowingly create accounts for children, and we use a child’s details only to run the trip they are on. If you think a child has given us data, tell us and we will delete it.

11.Emails and messages from us

We send messages you need: sign-in codes, booking confirmations, reminders before a trip, cancellation and refund notices, a request to review a tour you took, and security alerts. We do not send marketing without asking you first.

12.Changes to this policy

We will update this page when what we do with data changes, and show the date at the top. For important changes we will email account holders. See also our Terms of service and Refund policy.