Privacy policy
This policy explains what personal data Booked & Boujee collects, why, who we share it with, how long we keep it and what your rights are. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025.
In short: we collect your details, especially your name, email address and phone number, when you book, enquire, write a review or join our newsletter. We use them to run your trip and to reply to you. We don't sell them, and we keep them only as long as we need to.
1. Who we are
Booked & Boujee, the trading name of Booked and Boujee Ventures (a business name registered in Nigeria with the Corporate Affairs Commission, BN 9755576), based in Lagos, is the data controller for the personal data described here.
Privacy contact: bookedboujee0@gmail.com · WhatsApp +234 913 523 4280.
2. What we collect, why, and our legal basis
| What | When | Why | Legal basis (NDPA s.25) |
|---|---|---|---|
| Name, email address and phone number of the lead booker | When you book | To confirm and manage your booking, send receipts, reminders and trip updates, and contact you about your trip | Performance of a contract |
| Full names of all travellers | When you book | To book flights, hotels and tours | Contract |
| Passport number, nationality, date of birth, passport expiry, and documents a visa needs (for example a passport photo) | After you pay, on your secure "Manage booking" page | To apply for visas or travel authorisations and to book flights | Contract, and the entry rules of the destination country |
| Whether you have a yellow fever card | After you pay | Entry requirement | Contract |
| Special requests, dietary or health notes (optional) | Only if you choose to tell us | To look after you on the trip | Your explicit consent (health information is sensitive data) |
| Payment records (amount, date, payment reference, card type and last 4 digits) | When you pay | Accounting, receipts, refunds and fraud prevention | Contract and legal obligation (tax records) |
| Name, email address, phone number and message | When you send an enquiry (custom trip, consultation or contact form) | To reply to you and plan your trip | Steps you ask us to take before a contract, and your consent |
| Name, city, email address and review | When you write a review | To check the review against a booking, and to publish it with the name and city you give us (your email is never shown) | Consent |
| Email address (and first name, if given) | Only if you tick the newsletter box and confirm by email | To send travel offers and news | Consent, which you can withdraw at any time |
| Photos and videos taken on our trips | During the trip | To share trip memories on our website and social media | Legitimate interests; you can ask us not to post you (section 7) |
| How the website is used (pages viewed, button clicks) | When you browse | To understand which trips interest people and improve the site | Legitimate interests. No advertising cookies; visitors are counted with an anonymous code that changes every day and can't identify you |
You don't have to give us your details, but we can't make a booking or reply to an enquiry without them. We do not make decisions about you using fully automated processing.
We never receive or store your full card number or security code. Those go directly to Paystack.
3. Who we share it with
Only where it's needed for your trip or to run our business:
- Airlines, hotels, tour operators, transport companies and insurers for the trip you booked.
- Embassies and immigration authorities for visa or travel authorisation applications.
- Paystack, to process payments.
- Service providers who work for us under contract and only on our instructions: website hosting (Hostinger), email delivery, newsletter software, encrypted backup storage and error monitoring.
- Police, regulators or courts, where the law requires it.
We do not sell your personal data, and we don't share it for others' advertising.
4. Transfers outside Nigeria
Many of our trips take place outside Nigeria, so we must share some of your data with suppliers and authorities in the destination country. Some of our service providers also store data outside Nigeria. We only transfer data as the NDPA allows (Part VIII), for example where it's necessary to carry out your booking, or where the recipient protects it adequately.
5. How long we keep it
| What | How long |
|---|---|
| Passport details and uploaded travel documents | Deleted 30 days after your trip ends (or 30 days after a cancelled booking) |
| Booking and payment records | 6 years, because tax and accounting law requires it |
| Enquiries that don't become bookings | 24 months |
| Reviews | Until you ask us to remove them |
| Newsletter email | Until you unsubscribe. We keep a record of when you agreed and when you withdrew, as proof |
| Website usage events | 90 days, then only daily totals are kept |
6. How we protect it
The website uses encrypted connections (HTTPS). Passport details and uploaded documents are encrypted. Only our authorised staff can see bookings, they must sign in with two-step verification, and every time someone views passport details or documents it is logged. Backups are encrypted.
7. Your rights
Under the NDPA you have the right to:
- know what data we hold about you and get a copy of it;
- correct data that is wrong;
- ask us to delete your data;
- restrict or object to how we use it, including to stop appearing in our trip photos;
- withdraw your consent at any time (for example, unsubscribe from the newsletter using the link in every email), without affecting what we did before;
- receive your data in a portable format.
To use any of these rights, email bookedboujee0@gmail.com. We will reply within 30 days. Some data may have to be kept even after a deletion request, for example payment records that tax law requires us to keep.
If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.
8. Emails we send
- Booking emails (confirmations, receipts, payment reminders, trip updates) are part of your booking and are sent to the email address you give us.
- Newsletters are sent only if you opt in and confirm your email address. Every newsletter has an unsubscribe link.
9. Cookies
We use only the cookies the website needs to work: a session cookie and a security cookie that keep forms and your booking secure. Your browser's own storage also remembers a few small choices on your device, such as closing our cookie notice or a pop-up. We don't use advertising or tracking cookies. If that ever changes, we will ask for your consent first and update this policy.
10. Children
Bookings must be made by an adult. We only collect children's details as travellers on a booking made by their parent or guardian.
11. Changes to this policy
We will post any changes on this page and update the date below. If a change significantly affects how we use your data, we will tell you by email.
Last updated: 28 October 2026. Version: privacy-2026-10-v1.
Version 1 · Last updated 28 October 2026