Privacy Policy

1. Introduction

Expatico Travels and Tours Ltd ("Expatico," "we," "us," "our") is committed to protecting the privacy of our customers and partners. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and your rights under the Nigeria Data Protection Act (NDPA) 2023 and applicable regulations issued by the Nigeria Data Protection Commission (NDPC).

Expatico does not operate an online booking portal. Bookings and related communications are conducted directly through email, phone calls, and social/messaging platforms such as WhatsApp and Instagram. By contacting us through any of these channels, requesting a booking, or otherwise engaging with Expatico, you consent to the practices described in this policy.

2. Information We Collect

a) Information you provide directly:

• Full name, date of birth, gender, nationality, passport/ID details
• Contact information (email, phone, address)
• Travel preferences and itinerary details
• Payment information (processed via our licensed payment partners; we do not store full card details)
• Visa application documents, where applicable

b) Information collected through our communication channels:

• Messages, attachments, and documents shared via email
• Call details and information shared during phone conversations
• Messages, media, and documents shared via WhatsApp, Instagram, or other social/messaging platforms you choose to contact us on

Please note that WhatsApp, Instagram, and similar platforms are operated by third parties (e.g., Meta) with their own privacy policies. Any information shared through these platforms is also subject to that platform's terms, and Expatico is not responsible for how these third-party platforms independently handle your data outside of our conversations.

c) Information from third parties:

• Airlines, hotels, tour operators, and GDS/booking systems we work with (e.g., Amadeus) to confirm and manage your bookings

3. How We Use Your Information

We use personal data to:

• Process bookings, ticketing, and travel documentation
• Communicate booking confirmations, changes, and support
• Facilitate visa and travel document applications
• Process payments and refunds
• Comply with legal, regulatory, and security requirements (e.g., NCAA, SCUML, immigration authorities)
• Improve our services and personalize offers, where you have opted in
• Send marketing communications, where you have given consent (you may opt out at any time)

4. Legal Basis for Processing

Under the NDPA 2023, we process personal data based on:

• Your consent (e.g., marketing communications)
• Performance of a contract (processing your booking)
• Legal obligation (regulatory reporting, immigration/visa requirements)
• Legitimate interest (fraud prevention, service improvement)

5. Sharing of Information

We share personal data only as necessary with:

• Airlines, hotels, tour operators, and other travel suppliers required to fulfill your booking
• Payment processors and banking partners (e.g., Monnify, Access Bank) for transaction processing
• Government authorities and embassies, where required for visa or immigration processing
• Regulatory bodies where legally required (e.g., NCAA, SCUML, tax authorities)

We do not sell personal data to third parties.

6. International Data Transfers

Some bookings require sharing information with international airlines, hotels, or visa authorities located outside Nigeria. Where this occurs, we take reasonable steps to ensure such transfers comply with NDPA cross-border transfer requirements, including working only with reputable, established travel and payment partners.

7. Data Retention

We retain personal data only as long as necessary to:

• Fulfill the purpose it was collected for
• Meet legal, tax, and regulatory record-keeping obligations (e.g., BSP/IATA settlement records)
• Resolve disputes and enforce our agreements

Booking and financial records are typically retained for a minimum of 6 years in line with Nigerian tax and financial regulations, unless a longer period is required by law.

8. Your Rights

Under the NDPA 2023, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, subject to legal retention obligations
• Withdraw consent for marketing communications at any time
• Object to certain processing activities
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact us at privacy@goexpatico.com.

9. Data Security

We implement reasonable technical and organizational measures — including access controls, encrypted payment processing, and restricted internal access — to protect your data against unauthorized access, loss, or misuse. However, no method of transmission over the internet is 100% secure.

10. Social Media and Messaging Platforms

As bookings are conducted via email, phone, WhatsApp, and Instagram rather than a website portal, we do not use website cookies or tracking technologies to collect your personal data. Any interaction data (such as message history) on these platforms is retained in line with our own retention practices as described above, in addition to whatever retention practices WhatsApp/Instagram/Meta apply on their end.

11. Children's Privacy

Our services are not directed at children under 18. Where minors' data is submitted (e.g., for family travel bookings), it is provided and consented to by a parent or legal guardian.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email, WhatsApp, or our official social media channels. Continued use of our services after changes constitutes acceptance.

13. Contact Us