Privacy Policy & Data Protection Statement

1. Introduction & Scope

This Privacy Policy explains how Metro Property Management Limited ("Company", "we", "us", or "our"), operating as the technology vendor and platform developer of the M6 Smart Community Operating System ("M6" or "Platform"), collects, uses, processes, stores, and protects personal and operational data across:

• M6 Web Portals: Management ERP desks and Web Resident Dashboards.
• M6 Resident Mobile Applications: iOS and Android applications for homeowners, tenants, and residents.
• M6 Security Guard Terminal: Gate access optical scanning applications used by estate security personnel.

By accessing or using the Platform, you acknowledge that your personal data will be processed in accordance with this Policy and applicable Nigerian data protection regulations, including the Nigeria Data Protection Act (NDPA) and NDPR.

2. Information We Collect

To provide reliable facility governance, automated utility vending, and perimeter security, we collect the following categories of information:

A. Resident & Property Identity Data

• Full Name, official email address, mobile telephone number (for SMS/WhatsApp delivery).
• Assigned Estate Community, Block/Street, and Property Unit Number.
• Occupancy designation (Homeowner, Landlord, Primary Tenant, or Authorized Occupant).
• Emergency contact details when provided for security registers.

B. Utility & Smart Metering Data

• Standard Transfer Specification (STS) Prepaid Meter Serial Numbers.
• Electricity vending token history, tariff categories, purchase amounts, and kilowatt-hour (kWh) values generated.
• Generator usage schedules and common-area utility allocation metrics.

C. Financial & Payment Ledger Records

• Direct settlement transaction IDs, reference numbers, payment channel timestamps, and payment statuses.
• Itemized service charge billings, estate levies, and rent schedule records.
• Note on Payment Cards: M6 integrates with PCI-DSS Level 1 compliant payment gateways. M6 never captures, processes, or stores your credit/debit card numbers, CVVs, or online banking passwords.

D. Visitor Access & Gate Security Logs

• Visitor Name, scheduled arrival timestamp, authorized expiry window, and visitor pass QR reference code.
• Vehicle license plate numbers and visitor type (guest, delivery, technician).
• Optical gate scanner verification timestamps recorded at security terminals.

E. Maintenance & Work Order Data

• Maintenance requests, service category selections, descriptive notes, uploaded issue photos, and technician resolution feedback.

F. Device, Telemetry & Log Data

• Internet Protocol (IP) address, mobile device identifiers, operating system version, browser type, and push notification tokens (Firebase Cloud Messaging / Apple APNS).

3. Lawful Basis & Purposes of Processing

We process personal data strictly for legitimate operational and contractual purposes, including:

• Utility Fulfillment: Generating and delivering prepaid STS electricity tokens to resident devices 24/7 without manual intervention.
• Direct Estate Billing: Maintaining automated double-entry financial ledgers, generating itemized dues statements, and issuing digital payment receipts.
• Perimeter Security: Validating time-bound visitor QR gate passes and dispatching instant arrival notifications to residents.
• Maintenance Tracking: Facilitating communication between residents, facility technicians, and estate managers to resolve facility defects.
• Regulatory & Legal Compliance: Maintaining audit trails required by financial, tax, and property accounting regulations.

4. Core Commitment: Direct Settlement & Zero Fund Custody

5. Data Sharing & Third-Party Service Providers

We do not sell, rent, monetize, or trade your personal information. Data is shared strictly on a need-to-know basis with:

• Your Estate Administration: Designated Executive Committees (EXCO), Landlords, and verified Facility Management Companies (FMC) managing your community.
• Licensed Payment Gateways: CBN-authorized payment processors (e.g. Paystack, Monnify, Flutterwave, Providus Bank) to execute direct-to-estate transactions.
• SMS & Communication Providers: Telecommunication gateways (e.g. Termii) to transmit instant power tokens and gate arrival notifications.
• STS Vending Infrastructure: Utility token generation servers and meter manufacturer APIs.
• Law Enforcement & Regulatory Authorities: Only when strictly required by a court order or applicable law.

6. Data Retention & Accounting Standards

Personal identity records and active access credentials are retained for the duration of the resident's active tenure within the estate. Upon move-out or account termination:

• Resident login credentials, gate access rights, and mobile device notification tokens are deactivated immediately.
• Statutory financial records, double-entry ledger entries, and utility vending transaction logs are retained for statutory periods (minimum 6 years) in compliance with Nigerian financial and accounting legislation.

7. Your Privacy Rights & Account Deletion

Under applicable data protection laws, you possess the right to:

• Access: Request an export or copy of the personal data held on your profile.
• Correction: Request rectification of inaccurate resident or property details.
• Account & Data Deletion: Request the deletion of your M6 user profile and mobile app credentials.

To submit an account or data deletion request, please use our dedicated web portal:

8. Security Standards & Technical Safeguards

We implement enterprise-grade technical and organizational security controls:

• End-to-end TLS 1.3 cryptographic encryption for all web and mobile API communications.
• Multi-tenant logical database isolation ensuring no cross-estate data access.
• HMAC cryptographic signatures and timestamp verification on all remote webhooks and API calls.
• Role-Based Access Control (RBAC) restricting admin permissions to authorized estate officers.
• Immutable audit logging across administrative actions, utility token generations, and financial postings.

9. Terms of Service Summary

Use of M6 requires adherence to estate community guidelines and truthful profile information. Visitor gate passes must only be issued for bona fide guests. Fraudulent vending manipulation, reverse engineering, or unauthorized access attempts will result in immediate service suspension and legal escalation.

10. Data Protection Officer Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: