Privacy & Cookie Policy | City Spaces and Bookings

1. Introduction

Welcome to City Spaces and Bookings ("CSB," "we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy and Cookie Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, make or manage bookings, and use our customer-support channels, including our WhatsApp support agent.

This policy is intended to provide transparent information about our processing practices. The existence of this policy does not, by itself, mean that every processing activity is complete or that CSB is fully compliant with every applicable obligation; we continue to review and improve our privacy, security, and retention controls.

2. Data We Collect

We may collect and process the following personal data:

Identity Data: First name, last name, or similar identifier.
Contact Data: Email address, telephone number, and messaging identifiers (such as a WhatsApp phone number) when you contact us.
Transaction Data: Details about payments to and from you and other details of services you have purchased from us.
Booking and Enquiry Data: Accommodation preferences, location interests, stay dates, guest counts, budget information, and other details you share to help us respond to an enquiry or booking request.
Messaging and Support Data: Messages you send or receive through our WhatsApp support channel (and related conversation context), attachments you choose to share, and records needed to provide customer support, escalate to a human agent, or troubleshoot service issues.
Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
Usage Data: Information about how you use our website and services.
Communications Data: Your preferences in receiving marketing from us and your communication preferences, including any WhatsApp marketing opt-in or opt-out choice. Cookie consent on our website is separate from WhatsApp messaging permissions.

3. How We Use Your Data

We use your personal data to:

Provide and manage your access to our site and services.
Process and manage bookings and payments.
Communicate with you, including sending booking confirmations and updates.
Provide customer support through our website, human support team, and WhatsApp support agent, including answering accommodation enquiries and assisting with booking requests.
Maintain relevant conversation context so we can respond accurately within an ongoing support interaction.
Manage our relationship with you, including notifying you about changes to our service terms or privacy policy.
Administer and protect our business and this Site (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data).
Use data analytics to improve our website, products/services, marketing, customer relationships, and experiences, where permitted.
Send promotional WhatsApp or other marketing messages only where you have provided a separate optional opt-in, or where another applicable lawful basis applies.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds, as applicable under Nigeria's data-protection framework (including the Nigeria Data Protection Act / NDPA) and other applicable laws:

To fulfill our contractual obligations to you when you make a booking or request booking-related assistance.
To provide the customer-support service you request when you initiate or continue a WhatsApp support conversation with CSB. A request for support may establish the context for processing needed to provide that service; it does not automatically establish consent for unrelated marketing or every possible use of your data.
To comply with legal and regulatory requirements.
To manage our business, provide services, protect service security, and improve our offerings where we have a legitimate interest that does not override your rights.
Where you have provided consent, especially for marketing communications. Marketing consent is optional and separate from using our customer-support service.

5. WhatsApp Business, Automated Messaging and AI-Assisted Support

5.1 Overview

City Spaces & Bookings (CSB), operated by Platon Core Ltd, uses the WhatsApp Business Platform and automated customer-support systems to communicate with customers, prospective guests, property hosts and business partners.

CSB is currently piloting its WhatsApp customer-support agent to evaluate customer-support use cases, response quality, reliability and booking assistance before a broader rollout.

5.2 Personal Information We Collect

When you communicate with CSB through WhatsApp, we may collect and process the following information, depending on your interaction:

Contact information: Your telephone number and WhatsApp profile information made available to CSB.
Communication information: Messages, attachments, timestamps, message identifiers and relevant conversation history.
Booking information: Accommodation preferences, listing enquiries, booking details and information you provide when requesting booking assistance.
Support information: Customer enquiries, support requests, complaints and related interaction records.
Technical information: Relevant workflow records, error logs and security records generated when operating our messaging services.
Communication preferences: Records of applicable messaging permissions, opt-out requests and communication preferences.

Please do not send passwords, full payment-card details or other sensitive information through WhatsApp.

5.3 How Our WhatsApp Messaging System Works

CSB uses the Meta WhatsApp Business Platform, including WhatsApp Cloud API, to send and receive customer messages.

Incoming messages may be routed through CSB's self-hosted n8n automation system running on Amazon Web Services (AWS) infrastructure in the EU (eu-west-1) region. n8n coordinates the workflows connecting WhatsApp to CSB's customer-support systems.

CSB's AI-assisted customer-support agent (the CSB Agent) may process relevant message content and conversation context to answer frequently asked questions, assist with accommodation searches, provide booking assistance and route enquiries to appropriate support channels.

Relevant conversation history is stored in CSB's application database or other application storage systems. CSB also uses MongoDB and Qdrant for application data storage and related functionality. Depending on the workflow, personal information may additionally be processed or temporarily retained in workflow execution records, server logs, monitoring systems or backups.

5.4 AI Processing and Third-Party Service Providers

The CSB Agent uses the OpenAI API to process relevant inputs and generate responses. Depending on your enquiry, information sent to OpenAI may include message content, relevant conversation context and limited accommodation or booking information necessary to respond.

CSB aims to minimize personal information sent to external AI services and does not intend to provide information that is unnecessary for the requested service.

Our messaging infrastructure also relies on the following service providers or technologies:

Meta / WhatsApp: For receiving and delivering WhatsApp messages.
Amazon Web Services (AWS): For hosting CSB's self-managed n8n infrastructure in the EU (eu-west-1) region.
OpenAI: For AI-assisted processing and generation of customer-support responses through its API.
MongoDB and Qdrant: For application data storage and related functionality, as configured by CSB.

These providers may process personal information to deliver their services, subject to their applicable service terms, privacy documentation and contractual arrangements. Their roles and processing activities may differ depending on the service.

5.5 Purposes and Lawful Bases of Processing

CSB processes personal information for the following purposes:

Responding to enquiries and providing customer support.
Helping customers search for accommodation and obtain booking assistance.
Providing booking-related communications and service updates.
Maintaining relevant conversation history and customer-support records.
Investigating complaints and disputes, protecting service security and preventing misuse.
Diagnosing technical issues and improving the reliability and quality of our customer-support services.
Sending promotional communications where the required permission has been obtained.

Depending on the purpose and circumstances, CSB relies on the applicable lawful basis under data protection law. This may include taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation, pursuing legitimate interests where permitted by law, or obtaining consent where required.

5.6 Customer Notice and Messaging Permissions

When you contact or continue an interaction with the CSB Agent, you are requesting or continuing to use the customer-support service. CSB may process the information reasonably necessary to respond to your enquiry on an applicable lawful basis described in this policy.

Where required, CSB will provide appropriate privacy information and obtain the relevant permission before processing personal information for a purpose that requires consent.

Using CSB's WhatsApp support service does not automatically constitute consent to receive unrelated promotional messages or authorize every possible use of your personal information.

CSB will obtain the permissions required by applicable law and WhatsApp Business policies before sending business-initiated messages. Providing a telephone number or making a booking enquiry does not, by itself, authorize unrelated promotional communications.

5.7 Promotional Messages and Opt-Out

Where CSB offers promotional WhatsApp communications, we will request the required permission separately from the provision of ordinary customer support.

You may withdraw your marketing permission or opt out of promotional WhatsApp messages at any time by replying STOP or contacting CSB through its published support channels.

CSB will record and respect applicable opt-out requests and take reasonable steps to prevent further promotional messages after an opt-out has been processed.

Opting out of marketing does not necessarily prevent essential booking-related or service communications where those communications are otherwise permitted by law.

5.8 Automated Responses and Human Support

The CSB Agent uses AI-assisted processing to generate responses to customer enquiries. It may help answer questions, retrieve relevant accommodation information and assist with booking-related requests.

Automated responses may occasionally be incomplete or inaccurate. Information generated by the CSB Agent is not, by itself, a guarantee of accommodation availability, final pricing or booking confirmation. Relevant booking information must be validated against CSB's applicable booking systems.

Where an enquiry requires human intervention, customers may request assistance through the customer-support channels made available by CSB.

5.9 Quality Assurance and Conversation Monitoring

CSB may review and monitor interactions with the CSB WhatsApp Agent for quality assurance, customer-support evaluation, troubleshooting, security, and service improvement. This may include reviewing conversation messages, automated responses, relevant interaction records, and technical logs to identify errors, assess response accuracy, improve the customer experience, and ensure the agent operates as intended.

Access to conversation records for these purposes is restricted to authorized personnel and, where necessary, relevant service providers supporting CSB's operations. CSB will apply appropriate access controls and data-minimization measures and retain records in accordance with its data-retention policy and applicable data protection laws.

Please do not share sensitive personal information, including passwords, payment-card details, financial account credentials, or sensitive medical or identity information, through the CSB WhatsApp Agent. Provide only the information necessary for your enquiry or booking request.

5.10 Data Storage, Security and Retention

CSB stores relevant conversation history in its application database and uses supporting storage systems, including MongoDB and Qdrant, as configured for the relevant application functions.

CSB applies appropriate technical and organizational measures intended to protect personal information, including access restrictions, credential protection, secure communications and appropriate monitoring and retention controls.

CSB intends to retain relevant customer-support and conversation records for a minimum period of one year where necessary for customer support, booking administration, security, auditability and dispute resolution. Retention remains subject to applicable legal requirements, the purpose for which the information is processed and the rights of individuals under applicable law.

Not all information is retained for the same period. Transient workflow data, technical logs, backups and records held by third-party service providers may be subject to different retention periods. CSB will configure and review retention arrangements to avoid retaining personal information longer than necessary.

Where personal information is no longer required, CSB will delete or anonymize it where appropriate, subject to lawful retention obligations and applicable exceptions.

5.11 International Data Processing and Transfers

CSB's messaging and customer-support services may involve the processing of personal information by Meta, OpenAI, AWS and other relevant technology providers.

CSB's self-hosted n8n infrastructure runs on AWS in the EU (eu-west-1) region. Other providers may process or store information in additional locations depending on their service configuration and applicable terms.

Where personal information is transferred outside Nigeria, CSB will assess and apply the safeguards and legal requirements applicable to the transfer under relevant data protection law.

5.12 Your Privacy Rights

Subject to applicable law, you may have the right to:

Request access to your personal information.
Request correction of inaccurate or incomplete information.
Request deletion of personal information where applicable.
Request restriction of processing or object to certain processing activities.
Withdraw consent where processing is based on consent.
Lodge a complaint with the relevant data protection authority where appropriate.

These rights are subject to applicable legal requirements and exceptions. For example, CSB may need to retain certain records to comply with legal obligations, resolve disputes or protect its legitimate interests where permitted by law.

To exercise your rights or raise a privacy concern, please contact CSB through the privacy contact details published in this Privacy and Cookie Policy. CSB may need to verify your identity before processing your request.

5.13 Changes to This Section

CSB may update this section when its WhatsApp messaging infrastructure, AI services, data-processing practices or legal obligations change. The latest version will be published as part of CSB's Privacy and Cookie Policy.

The privacy protections described in this section apply during the pilot programme as well as any subsequent wider rollout, subject to applicable law.

7. Data Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including critical information security controls to protect the confidentiality and integrity of your information in our possession. For the WhatsApp support system, this includes restricted administrative access to automation tooling, credential protection, webhook validation, and database permission controls appropriate to the environment.

8. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes we collected it for, including for legal, accounting, audit, or reporting requirements. Retention must be justified and proportionate under Nigeria's data-protection framework.

For WhatsApp customer-support and related conversation records that are needed for customer support, booking administration, security, auditability, and dispute resolution, CSB intends to retain relevant records for a minimum period of one year where necessary for those purposes. Records will be reviewed and deleted or anonymized when no longer required, subject to applicable legal obligations, legitimate retention requirements, and valid data-subject requests.

A one-year minimum does not mean that every raw message, webhook payload, error trace, attachment copy, or transient operational record is kept for at least a year. CSB aims to apply shorter retention periods to transient operational data where possible. Operational records, workflow execution data, technical logs, backups, and information held by third-party providers may be subject to different retention periods. CSB will configure and review these periods to avoid retaining unnecessary personal information.

10. Your Rights

As a data subject of City Spaces and Bookings, you have the right to:

Access your personal data,
Rectify inaccurate or incomplete data,
Erase your personal data (right to be forgotten),
Restrict the processing of your data or object to the processing of your data, and
Withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

You also have the right to complain to the supervisory authority (Nigeria Data Protection Commission - NDPC) if you feel unsatisfied with how we handle your personal data or requests. For further clarity on how to exercise these rights, you can contact us at support@cityspacesandbookings.com.

11. Our Use of Cookies

We use cookies to enhance your experience on our Site. Cookies are small text files stored on your device that help us remember your preferences and understand how you use our Site.

We use essential cookies necessary for the functioning of the Site, analytical/performance cookies that allow us to recognize and count the number of visitors and see how visitors navigate the Site. We also use functionality cookies to recognize you when you return to our Site and personalize content for you, as well as targeting cookies to record your visit to our Site, the pages you have visited, and the links you have clicked.

You can control and manage cookies through your browser settings and, where offered, through our cookie consent tools. However, disabling cookies may affect the functionality, as well as your experience on our Site. Cookie choices on the website do not replace WhatsApp messaging permissions or marketing opt-in choices.

12. Third-Party Links

Our Site may contain links to third-party websites. In such cases, we are not responsible for the privacy practices or content of these external sites.

13. Grievance Redress Process

We are committed to addressing any concerns or complaints you may have regarding how we process your personal data. If you believe that we have not adequately resolved your concerns, you have the right to escalate the matter to the supervisory authority.

Our grievance redress process involves submission of your initial complaints via support@cityspacesandbookings.com. Upon receipt of your complaint, we will acknowledge it within 1 - 3 business days, and then we will investigate your complaint and aim to provide a comprehensive response within 30 calendar days.

If we are able to resolve your concern, we will provide a detailed explanation of the actions taken to address the issue. If you are not satisfied with our response or believe that we have not handled your personal data in compliance with applicable laws, you have the right to lodge a complaint with the relevant supervisory authority.

However, we encourage you to contact us first to allow us the opportunity to resolve your concerns before escalating them to the supervisory authority.

14. Changes to This Policy

We may update this Privacy and Cookie Policy from time to time. We will notify you of any changes by posting the new policy on this page. Material updates related to WhatsApp support, AI processing, or marketing consent will be reflected in this policy before or as those practices are introduced more broadly.

15. Contact Us

If you have any questions or concerns about this Privacy and Cookie Policy, please contact us at support@cityspacesandbookings.com.