Introduction
Welcome to KAP Film Village & Resort ("we," "our," or "us"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at kapfilmvillageandresort.com, make a reservation, attend our events, or interact with us in any other way.
This policy is governed by the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, as well as other applicable Nigerian laws. By using our services, you agree to the collection and use of information in accordance with this policy.
Your privacy is important to us. We never sell your personal data to third parties for their marketing purposes, and we are committed to handling your information transparently and securely.
Please read this policy carefully. If you do not agree with the terms of this policy, please do not access or use our website or services. If you have any questions, please contact our Data Protection Officer at the details provided in Section 15.
Who We Are
KAP Film Village & Resort is operated by KAP Entertainment & Hospitality Limited, a company incorporated in Nigeria. For the purposes of applicable data protection law, we are the "data controller" in respect of the personal data you provide to us.
| Detail | Information |
|---|---|
| Legal Entity | KAP Entertainment & Hospitality Limited |
| Registration | Registered with Corporate Affairs Commission (CAC), Nigeria |
| Address | KAP Film Village & Resort, Igbojaye, Oyo State, Nigeria |
| Website | kapfilmvillageandresort.com |
| privacy@kapfilmvillageandresort.com | |
| Role | Data Controller (NDPA 2023) |
Information We Collect
We collect information you provide directly to us, information we collect automatically when you use our services, and information from third parties.
3.1 Information You Provide Directly
- Identity data — First name, last name, title, date of birth (for age-restricted bookings)
- Contact data — Email address, telephone number, postal address
- Booking data — Reservation dates, room type, number of guests, special requirements, dietary needs, accessibility requirements
- Payment data — Payment card details are processed directly by our payment processors; we do not store full card numbers
- Communications data — Your correspondence with us via contact forms, email, telephone, or social media
- Event data — Information provided when enquiring about or booking events, conferences, or film production services
- Profile data — Username and password when you create an account, your preferences, feedback, and survey responses
- Marketing data — Your preferences in receiving marketing communications from us
3.2 Information Collected Automatically
- Usage data — Pages visited, time spent on pages, links clicked, referring URLs
- Technical data — IP address, browser type and version, device type, operating system, screen resolution
- Location data — General geographic location derived from your IP address (city/country level only)
- Cookie data — Information collected via cookies and similar tracking technologies (see Section 7)
3.3 Information from Third Parties
- Booking platforms — If you book through third-party platforms (e.g., travel agencies), we receive information they share with us
- Social media — If you interact with our social media pages or log in using social media accounts
- Payment processors — Transaction confirmation and fraud prevention data from payment service providers
Sensitive Information: We do not intentionally collect sensitive personal data (health information, ethnic origin, political opinions, religious beliefs, etc.) unless required by law or with your explicit consent for specific purposes such as catering for dietary or accessibility needs.
How We Use Your Information
We use the information we collect for the following purposes:
| Purpose | Examples |
|---|---|
| Reservation & Service Delivery | Processing bookings, managing check-in/check-out, fulfilling special requests, coordinating event production |
| Account Management | Creating and managing guest accounts, providing access to booking history, loyalty benefits |
| Payment Processing | Processing transactions, issuing invoices and receipts, managing refunds |
| Customer Support | Responding to enquiries, complaints, and feedback; providing pre-arrival information |
| Marketing & Communications | Sending newsletters, promotional offers, event announcements (with your consent) |
| Safety & Security | Ensuring guest and staff safety, fraud prevention, CCTV monitoring on-property |
| Legal Compliance | Meeting tax obligations, responding to lawful government requests, record-keeping |
| Service Improvement | Analysing usage patterns, conducting guest satisfaction surveys, improving website functionality |
| Personalisation | Tailoring our recommendations and offers based on your preferences and booking history |
Legal Basis for Processing
Under the Nigeria Data Protection Act (NDPA) 2023, we must have a lawful basis for processing your personal data. We rely on the following legal bases:
- Contract performance — Processing necessary to fulfil your reservation, deliver services you have requested, or take steps at your request prior to entering into a contract
- Legal obligation — Where processing is required to comply with applicable laws, regulations, or court orders (e.g., tax records, government requests)
- Legitimate interests — Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your privacy rights (e.g., fraud prevention, service improvement, direct marketing to existing guests)
- Consent — Where you have given us explicit consent to process your data for specific purposes (e.g., subscribing to our newsletter, analytical cookies). You may withdraw consent at any time without affecting the lawfulness of prior processing
- Vital interests — In rare cases where processing is necessary to protect your life or the life of another person
Data Sharing & Disclosure
We do not sell, trade, or rent your personal data to third parties for their marketing purposes. We may share your information in the following limited circumstances:
6.1 Service Providers
We engage trusted third-party service providers who assist us in operating our business. These providers are contractually obligated to keep your data confidential and use it only for the purposes we specify:
- Payment processors (for secure transaction processing)
- Email delivery services (for transactional and marketing communications)
- IT and hosting providers (for website and data storage infrastructure)
- Analytics providers (for understanding how our website is used)
- Customer support tools (for managing guest communications)
6.2 Business Partners
In some cases, we may share data with business partners who provide complementary services (e.g., travel agencies, tour operators) where this is necessary to fulfil your booking or requested service.
6.3 Legal Requirements
We may disclose your information when required by law, court order, or government authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
6.4 Business Transfers
If KAP Entertainment & Hospitality Limited undergoes a merger, acquisition, or asset sale, your personal data may be transferred to the successor entity. We will notify you of any such change and ensure your rights continue to be protected.
We never sell your data. Your personal information is never sold or rented to third parties for their own marketing or commercial purposes.
Cookies & Tracking Technologies
Our website uses cookies and similar tracking technologies to improve your browsing experience and help us understand how visitors use our site. A cookie is a small text file stored on your device by your web browser.
Managing Cookies
You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. However, disabling strictly necessary cookies may affect website functionality including the ability to make bookings. To manage your cookie preferences, please consult your browser's help documentation or visit allaboutcookies.org.
Third-Party Technologies
We may use the following third-party services that set their own cookies:
- Google Analytics — Web traffic analytics (opt-out via Google Analytics Opt-out Browser Add-on)
- Google reCAPTCHA — Anti-spam protection on forms
- Google Maps — Location and directions functionality
- YouTube — Embedded video content on gallery and film village pages
- Facebook Pixel — Advertising effectiveness measurement (if enabled)
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
| Data Category | Retention Period | Reason |
|---|---|---|
| Reservation data | 7 years after checkout | Tax and accounting obligations |
| Payment records | 7 years from transaction | Financial regulations (FIRS) |
| Guest account data | 3 years after last activity | Legitimate interest in guest relations |
| Contact form enquiries | 2 years | Customer service history |
| Marketing preferences | Until opt-out or account deletion | Consent-based processing |
| Website analytics | 26 months (aggregated) | Service improvement |
| CCTV footage | 30 days (on-property) | Security and safety |
| Job applications | 12 months after decision | Potential future opportunities |
When your data is no longer required, we will securely delete or anonymise it. In some circumstances, we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice.
Data Security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption in transit — All data transmitted between your browser and our server is encrypted using HTTPS/TLS
- Password security — All account passwords are hashed using industry-standard algorithms; we never store plain-text passwords
- Access controls — Access to personal data is restricted to staff who need it to perform their duties, governed by role-based permissions
- Payment security — Payment card data is handled by PCI-DSS compliant payment processors; we do not store full card numbers
- Regular security reviews — Our systems and practices are reviewed periodically to identify and address vulnerabilities
- Staff training — All staff with access to personal data receive appropriate data protection training
- Incident response — We have procedures in place to detect and respond to data breaches, including notification obligations under NDPA 2023
No transmission method is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. You share information with us at your own risk. If you become aware of any security concerns, please contact us immediately at security@kapfilmvillageandresort.com.
International Data Transfers
Your personal data is primarily stored and processed within Nigeria. However, some of our third-party service providers may process data in other countries. When we transfer your data internationally, we ensure appropriate safeguards are in place, including:
- Transferring only to countries that the Nigeria Data Protection Commission (NDPC) has determined offer adequate data protection
- Using contractual safeguards (data processing agreements) with service providers that require them to maintain equivalent data protection standards
- Ensuring service providers are certified under recognised international data protection frameworks
If you would like further information about our international transfer safeguards, please contact our Data Protection Officer.
Your Rights
Under the Nigeria Data Protection Act 2023 and NDPR 2019, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at privacy@kapfilmvillageandresort.com.
Right of Access
Request a copy of the personal data we hold about you and information about how we process it.
Right to Rectification
Request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure
Request deletion of your personal data where there is no valid reason for us to continue processing it.
Right to Restriction
Request that we limit how we use your personal data in certain circumstances.
Right to Portability
Receive your personal data in a structured, commonly used format and transfer it to another organisation.
Right to Object
Object to processing based on legitimate interests or for direct marketing purposes at any time.
Automated Decisions
Not to be subject to solely automated decision-making, including profiling, that produces significant effects on you.
Withdraw Consent
Withdraw consent at any time where processing is based on your consent, without affecting prior lawful processing.
How to Exercise Your Rights
To exercise any of your rights, please contact us by email at privacy@kapfilmvillageandresort.com or by post to our registered address. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.
Right to Complain
If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):
- Website: ndpc.gov.ng
- Email: info@ndpc.gov.ng
- Address: National Information Technology Development Agency Complex, Mbora District, FCT Abuja
We would appreciate the opportunity to address your concerns before you contact the NDPC, so please reach out to us first.
Children's Privacy
Our website and services are not directed to children under the age of 18. We do not knowingly collect personal data from children under 18 without the consent of a parent or guardian. Children may be included in family reservations, in which case the accompanying adult takes responsibility for the information provided.
If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us at privacy@kapfilmvillageandresort.com and we will take immediate steps to remove that information from our systems.
Third-Party Links & Services
Our website may contain links to third-party websites, social media platforms, or booking channels that are not operated by us. We have no control over these external sites and are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site you visit.
Specific third-party services used on our website include:
- Google Maps — For directions and location services (Google Privacy Policy applies)
- YouTube — For embedded video content (Google/YouTube Privacy Policy applies)
- Facebook/Instagram — Social sharing features and embedded posts (Meta Privacy Policy applies)
- Twitter/X — Social sharing features (X Corp Privacy Policy applies)
- WhatsApp — Click-to-chat feature for customer enquiries (Meta Privacy Policy applies)
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will indicate the date of the most recent revision at the top of this page.
For material changes that significantly affect how we process your personal data, we will:
- Post a prominent notice on our website
- Send an email notification to registered users and newsletter subscribers
- Where required by law, seek renewed consent
Your continued use of our website and services after any changes take effect constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
Version History
| Version | Date | Key Changes |
|---|---|---|
| 2.0 | 1 January 2025 | Updated to comply with NDPA 2023; added rights grid; expanded cookies section; DPO contact details added |
| 1.0 | 1 June 2023 | Initial policy publication under NDPR 2019 |
Contact Us & Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our dedicated Data Protection Officer (DPO):
Data Protection Officer
KAP Entertainment & Hospitality Limited takes data protection seriously. Our DPO is responsible for overseeing our data protection strategy and compliance. All privacy requests are handled confidentially.
We take all privacy enquiries seriously and will do our utmost to address your concerns promptly and fairly. For general enquiries unrelated to data protection, please use our Contact Page.