Privacy Policy

1. WHO WE ARE AND SCOPE

1.1 The controller

The Xelfcon entity responsible for your personal information (the " controller ", or " data controller " under Nigerian law) is determined by your country of residence or establishment: If you are resident or established in Your controller is Principal data protection law applied Nigeria Xelfcon Limited , RC 9720868, TIN 2622937879210 Nigeria Data Protection Act 2023 and subsidiary instruments issued by the Nigeria Data Protection Commission United Kingdom and all other countries and territories Xelfcon Limited , company number 17356543, England and Wales UK General Data Protection Regulation and Data Protection Act 2018, together with any local law that applies to you The two entities share a common platform and act as joint or independent controllers of certain records where necessary to operate the service across both markets. Whichever entity you contract with, you may exercise your rights and raise any concern by contacting support@xelfcon.com , and we will route your request internally.

1.2 Scope

This Policy applies to the Xelfcon mobile applications, websites, APIs, communications, and support channels (the " Platform "). It does not apply to: (i) the practices of other Members, including Property Owners, Tenants, and Caretakers, who handle personal information for their own purposes; or (ii) third-party websites, applications and services that we link to or integrate with, which have their own privacy notices.

1.3 Terms used

Capitalised terms not defined here have the meaning given in the Xelfcon Terms of Service. "Personal information" and "personal data" are used interchangeably and mean information relating to an identified or identifiable person.

2. INFORMATION WE COLLECT

2.1 Information you give us

Account and profile information: name, email address, phone number, password, country of residence, profile photograph, and any biography or description you add. Identity verification information: government-issued identification numbers, identity documents and images of them, date of birth, address, selfie or liveness capture where used, and the results of any verification or screening check we or our providers carry out. Property and workspace information: property and Unit details, addresses, geolocation and map data, specifications, photographs, rent and charge amounts, availability and occupancy status, house rules, and other listing content. Enquiry, tenancy and occupancy information: enquiries you submit or receive, commitment records, inspection arrangements, acceptance and onboarding records, tenancy start and renewal dates, maintenance and repair requests, and documents such as tenancy agreements, contracts, notices and receipts uploaded by you or shared with you. Caretaker information: service location, rate, experience, description, availability, shortlisting and hire records, and confirmations or declines. Payment and payout information: transaction records, amounts, references, wallet and balance data, payment method identifiers and, where you receive payouts, bank account and payout destination details and the results of account verification.

Communications: messages exchanged through the Inbox and other in-app messaging, broadcast messages to tenants, support requests, and correspondence with us. Reports and disputes: reports you make about other Members, refund requests, and information you supply when we review a matter.

2.2 Information collected automatically

Device and technical data: device model, operating system and version, unique device and app identifiers, language, time zone, mobile network, IP address, and app version. Usage data: pages and screens viewed, features used, searches run, listings viewed, actions taken, timestamps, referring and exit points, and session duration. Diagnostics: crash logs, error reports, and performance data. Notification tokens: push notification tokens used to deliver alerts you have enabled. Approximate or precise location: derived from your IP address or, where you grant permission, from your device, used for proximity-based caretaker recommendations, local search results, and fraud prevention. You can withdraw device location permission at any time in your device settings, though some features will then be less useful. Cookies and similar technologies: on our web surfaces, as described in Section 12.

2.3 Information from third parties and other Members

From other Members: for example, where a Property Owner records you as an existing occupant of a Unit and submits your name and contact details in order to invite you to the Platform, or where a Caretaker records information about a tenant interaction. From verification, screening and fraud-prevention providers: identity match results, document authenticity results, sanctions, politically exposed person and adverse media screening results, and risk or fraud signals. From payment providers and financial institutions: payment status, authorisation and decline codes, chargeback and dispute notifications, and account verification results. From infrastructure and analytics providers: aggregated and event-level data about how the Platform performs and is used.

2.4 Sensitive information

We do not ask you for special category or sensitive personal information, and you should not submit it. Identity documents may incidentally reveal information such as nationality or, in some formats, biometric data derived from a facial image; where that is the case we process it only as necessary for identity verification and fraud prevention, on the basis set out in Section 3, and with the safeguards described in Section 9.

3. HOW WE USE YOUR INFORMATION AND OUR LEGAL BASES

We use your personal information for the purposes below. The table also sets out the legal basis we rely on under the UK GDPR, and the corresponding lawful basis under the Nigeria Data Protection Act 2023.

Purpose What this involves Legal basis Creating and operating your account Registration, authentication, profile management, account recovery, settings Performance of a contract with you Providing core Platform features Property workspaces, units, vacancies, marketplace listings, enquiries, commitment holds, inbox messaging, acceptance and onboarding, tenant hubs, maintenance requests, caretaker enrolment, shortlisting and hiring Performance of a contract with you Identity verification and screening Verifying who you are before you can create a workspace, enrol as a caretaker, add a payout destination, or withdraw funds; document and database checks Compliance with a legal obligation; performance of a contract; and our legitimate interests in preventing fraud and protecting Members Processing payments, holds and payouts Charging commitment fees, rental payments, renewal fees and promotion fees; operating pending and main balances and the seven-day holding period; making payouts; processing refunds and reversals Performance of a contract with you; compliance with a legal obligation Caretaker recommendations Surfacing enrolled caretakers to property owners based principally on proximity to a property Performance of a contract; our legitimate interests in operating a useful marketplace Notifications and service communications Push notifications, emails and in-app alerts about enquiries, hire requests, payments, holds, terminations, and account or security matters Performance of a contract; your consent where required for push notifications on your device Fraud prevention, safety and security Detecting and investigating fraud, fake listings, impersonation, account takeover, payment abuse, chargeback abuse and platform misuse; applying holds; suspending accounts Our legitimate interests in protecting the Platform and Members; compliance with a legal obligation Support, disputes and refund review Responding to your requests; reviewing inbox records and transaction history when deciding a refund under the Refund Policy; investigating reports Performance of a contract; our legitimate interests in resolving matters fairly and in defending claims Improving reliability, quality and product Diagnostics, crash analysis, aggregated analytics, testing, and developing new features Our legitimate interests in maintaining and improving the Platform Legal, regulatory and tax obligations Anti-money-laundering and sanctions obligations, tax reporting and withholding, responding to lawful requests, keeping records required by law Compliance with a legal obligation Establishing, exercising or defending legal claims Retaining and using records where a claim, complaint, investigation or regulatory matter arises or is reasonably foreseeable Our legitimate interests in protecting our legal position; compliance with a legal obligation Marketing about Xelfcon Sending you information about Xelfcon features and offers Your consent, or our legitimate interests where permitted; you can opt out at any time Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may ask us for further information about that assessment, and you may object as described in Section 10.

4. SHARING AND DISCLOSURE

We do not sell your personal information. We do not share it for third-party advertising or cross-context behavioural advertising. We share it only as described below.

4.1 With other Members, as the Platform requires

When you make an Enquiry: your name, contact details and enquiry content are shared with the Property Owner and, where one is engaged at that property, with the hired Caretaker. When you publish a listing: your listing content, property and Unit details, and location information are visible in the Marketplace, and your name or display name is shown to Renters who enquire. When you are accepted and onboarded: your tenancy details are visible to the Property Owner in the Property Workspace and, where engaged, to the Caretaker, and documents shared with you appear in your Tenant Hub. When you enrol as a Caretaker: your profile, service location, rate and description are visible to Property Owners in the recommendation and shortlisting flows, and your contact details are shared when a hire request is sent or confirmed. When you submit a maintenance request: your request and identifying details are shared with the Property Owner and, where engaged, the Caretaker. Messages: content you send in the Inbox or by broadcast is shared with the recipients of that channel.

4.2 With service providers

We share personal information with providers who process it on our instructions and under written contracts requiring appropriate security and confidentiality. Categories include: cloud hosting and storage; database and infrastructure; identity verification and document authentication; sanctions, fraud and risk screening; payment processing, payouts, banking and card acquiring; email, SMS and push notification delivery; customer support tooling; product analytics and crash reporting; mapping and geolocation; and professional advisers such as lawyers, auditors and accountants.

4.3 For legal, regulatory and safety reasons

We may disclose personal information where we reasonably believe it is necessary to: comply with applicable law or a binding request from a court, regulator, tax authority, law enforcement agency or other government body; enforce the Terms of Service or investigate a suspected breach; detect, prevent or address fraud, security, or technical issues; protect the rights, property, safety or life of Xelfcon, our Members, or any person; or establish, exercise or defend legal claims. Where lawful and appropriate, we will tell you before disclosing.

4.4 Corporate transactions

If Xelfcon is involved in a merger, acquisition, reorganisation, financing, insolvency, or sale of all or part of its business or assets, personal information may be transferred as part of that transaction, subject to the recipient continuing to handle it in accordance with this Policy or giving you notice of any material change.

4.5 Aggregated and de-identified information

We may create and share aggregated or de-identified information, such as market statistics or usage trends, that does not identify you and cannot reasonably be used to identify you.

5. AUTOMATED PROCESSING AND RECOMMENDATIONS

We use automated processing in a limited number of places, principally: proximity-based recommendation of Caretakers to Property Owners; ranking and filtering of Vacancies in the Marketplace, including the effect of paid promotion; automated identity verification and document checks; automated fraud, risk and abuse scoring; and the automatic processing of rental refunds where a Property Owner terminates within the seven-day Cooling-Off Period. Where an automated check would result in a significant decision about you, such as declining verification, blocking a transaction, or suspending an account, you may ask for human review by contacting support@xelfcon.com, explain your position, and contest the outcome. Recommendation of a Caretaker is a surfacing of profiles based on distance and other factors; it is not an assessment or endorsement of that Caretaker by Xelfcon.

6. INTERNATIONAL TRANSFERS

Xelfcon operates through entities in Nigeria and the United Kingdom and uses service providers located in a number of countries. This means your personal information may be transferred to, stored in, or accessed from a country other than the one you live in, including between our Nigerian and UK entities. Where we transfer personal information out of the United Kingdom, we rely on one of the following: an adequacy decision or adequacy regulations covering the destination country; the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses; or another lawful transfer mechanism, together with a transfer risk assessment and any supplementary technical and organisational measures we consider necessary. Where we transfer personal information out of Nigeria, we do so in accordance with the Nigeria Data Protection Act 2023, relying on an adequacy determination by the Nigeria Data Protection Commission where one applies, or otherwise on contractual instruments providing an adequate level of protection, on your explicit informed consent, on necessity for the performance of a contract with you or in your interest, or on another basis permitted by that Act. You may request further information about the transfer mechanisms we use, and a copy of the relevant safeguards, by contacting support@xelfcon.com.

7. OTHER MEMBERS ARE INDEPENDENT CONTROLLERS

WHEN A PROPERTY OWNER OR A CARETAKER RECEIVES PERSONAL INFORMATION ABOUT ANOTHER MEMBER THROUGH THE PLATFORM, THEY RECEIVE IT AS AN INDEPENDENT CONTROLLER IN THEIR OWN RIGHT. XELFCON DOES NOT CONTROL AND IS NOT RESPONSIBLE FOR HOW THEY USE, STORE, SHARE, OR DISPOSE OF IT. A Property Owner or Caretaker who receives personal information about a Renter, Tenant, or other Member must: use it only for the purpose for which it was provided, namely operating the enquiry, tenancy or caretaking arrangement concerned; keep it secure and confidential; not use it for marketing, resale, profiling, credit reference, background investigation, or any unrelated purpose; not disclose it to anyone who does not need it for that arrangement; not retain it longer than necessary or after the arrangement ends, except where the law requires; and comply with all data protection law applicable to them, including the Nigeria Data Protection Act 2023, the UK GDPR and the Data Protection Act 2018 as relevant. Property Owners and Caretakers are separately responsible for meeting registration, notification, record-keeping, breach-reporting and data-subject-rights obligations that apply to

them as controllers. If you believe another Member has misused your personal information, you may report it to us at support@xelfcon.com. We may take action on the Platform, including removing access, suspending an account, or reporting the matter. We are not, however, able to control what a Member has already done with information outside the Platform, and you may need to pursue that Member directly or complain to the relevant supervisory authority.

8. RETENTION

We keep personal information for as long as your account is active and for as long as we need it for the purposes described in this Policy. When those purposes end, we delete it or irreversibly anonymise it. In deciding retention periods we take into account: the amount, nature and sensitivity of the information; the potential risk of harm from unauthorised use or disclosure; the purposes for which we process it; whether we can achieve those purposes by other means; and applicable legal, accounting, tax, anti-money- laundering, regulatory, dispute and limitation-period requirements. Category Indicative retention Account and profile records For the life of the account, then for a limited period after closure to handle disputes, claims and legal obligations Identity verification records and check results Retained for the period required by anti-money-laundering, sanctions and fraud-prevention obligations applicable to us, calculated from the end of the relationship Transaction, payment, payout and refund records Retained for the period required by tax, accounting and financial record-keeping law in Nigeria and the United Kingdom Inbox messages, enquiry and tenancy records Retained while the arrangement is live and afterwards for the period during which a dispute or claim could reasonably arise Documents uploaded to a Tenant Hub or Workspace Retained while access subsists and afterwards as required for legal and dispute purposes; you should keep your own copies Device, usage, diagnostic and log data Retained for a shorter period, typically measured in months, then deleted or aggregated Records relating to a reported incident, suspected fraud, or an actual or threatened claim Retained until the matter and any limitation period is concluded Some records must be kept for compliance even after you ask us to delete your account, as explained in Section 10.

9. SECURITY

We use administrative, technical and organisational measures designed to protect personal information, including encryption of data in transit and at rest, access controls and role-based permissions, authentication controls, network and application security measures, logging and monitoring, secure development practices, vendor due diligence and contractual security obligations, staff confidentiality obligations and training, and an incident response process. No method of transmission over the internet, and no method of electronic storage, is completely secure, and we cannot guarantee absolute security. You play an important part: choose a strong and unique password, keep your credentials confidential, never share one-time codes with anyone including someone claiming to be from Xelfcon, keep your device and app updated, and tell us immediately at support@xelfcon.com if you suspect unauthorised access to your account. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the time required by applicable law, and will notify you where the law requires.

10. YOUR RIGHTS AND CHOICES

10.1 In-app controls

You can update your profile details in the app, manage notification preferences in Settings, control device permissions such as location in your device settings, and request account closure through support.

10.2 Your rights

Subject to the conditions and exemptions in the law that applies to you, you have the following rights in relation to your personal information: Access: to be told whether we process your information and to receive a copy of it and information about how it is used. Rectification: to have inaccurate information corrected and incomplete information completed. Erasure: to have your information deleted where there is no longer a lawful reason for us to keep it. Restriction: to have processing limited in certain circumstances, for example while an accuracy dispute is resolved. Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing. Portability: to receive information you provided to us in a structured, commonly used, machine-readable format and, where

technically feasible, to have it transmitted to another controller. Withdraw consent: where we rely on consent, to withdraw it at any time, without affecting processing already carried out. Human review: to obtain human intervention in relation to a significant automated decision, to express your point of view, and to contest the decision. Complain: to lodge a complaint with a supervisory authority, as set out in Section 11.

10.3 How to exercise your rights

Email support@xelfcon.com from the address registered on your account, or use More → Contact support in the app. Tell us which right you wish to exercise and give us enough detail to locate your records. We may need to verify your identity before acting, and may ask for additional information for that purpose. We will respond within the time required by the law applicable to you, and in any event within one month of receiving a valid request, extendable where a request is complex or where we have received a number of requests from you, in which case we will tell you and explain why. We do not charge for responding, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, and will explain our reasons.

10.4 Limits

Rights are not absolute. We may be unable to delete or stop processing information where we need it to comply with a legal obligation, to keep tax, accounting, anti-money-laundering or transaction records, to establish, exercise or defend legal claims, to prevent fraud or protect other Members, or where the information also relates to another person whose rights would be affected. Where we cannot fully meet a request, we will tell you why and, where possible, meet it in part. Closing your account does not automatically erase all records; see Section 8.

11. COMPLAINTS AND SUPERVISORY AUTHORITIES

If you are unhappy with how we have handled your personal information or a request you have made, please contact us first at support@xelfcon.com so that we can try to put it right. You also have the right to complain to a supervisory authority: Nigeria: the Nigeria Data Protection Commission (NDPC), the supervisory authority established under the Nigeria Data Protection Act 2023. United Kingdom: the Information Commissioner's Office (ICO), the UK supervisory authority. Elsewhere: the data protection or privacy authority for your country, where one exists. Complaining to a supervisory authority does not affect any other legal remedy available to you.

12. COOKIES AND SIMILAR TECHNOLOGIES

On our web surfaces we use cookies and similar technologies such as local storage and software development kits within the app. We use them to: keep you signed in and maintain your session; remember your settings and preferences; keep the Platform secure and detect fraudulent or automated activity; measure how the Platform is used so that we can improve it; and, where you have consented, measure the effectiveness of our own marketing. Strictly necessary cookies are required for the Platform to function and cannot be switched off through our controls. For other categories we ask for your consent where the law requires, and you can change your choice at any time. You can also control cookies through your browser settings, and you can reset or limit advertising identifiers through your device settings. Blocking some cookies may affect how the Platform works for you.

13. MARKETING AND NOTIFICATIONS

Service communications are necessary to operate your account and your transactions, and include alerts about enquiries, hire requests, payments, holds, refunds, terminations, security and changes to our terms. You cannot opt out of these while you hold an account, though you can control how push notifications are delivered to your device. Marketing communications about Xelfcon features and offers are sent only where you have consented, or where we are otherwise permitted to send them. You can opt out at any time using the unsubscribe link in any marketing email, or through notification preferences in Settings. Opting out of marketing does not stop service communications.

14. CHILDREN

The Platform is not intended for anyone under eighteen (18), and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact support@xelfcon.com and we will take steps to delete it and close any associated account.

15. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we do, we will change the "Last updated" date and post the revised Policy on the Platform. Where a change is material, we will give you additional notice by email or in-app notification before it takes effect, and where the law requires your consent for a new use of your information, we will ask for it.

16. CONTACT US

For any privacy question, request, or concern, contact support@xelfcon.com , or use More → Contact support in the app. We aim to acknowledge privacy requests within one to two business days and to respond substantively within the period required by applicable law. Entity Registration Contact Xelfcon Limited (England and Wales) Company number 17356543, incorporated 23 July 2026 under the Companies Act 2006; registered office in England and Wales support@xelfcon.com Xelfcon Limited (Nigeria) RC 9720868, incorporated 29 July 2026 under the Companies and Allied Matters Act 2020; TIN 2622937879210 support@xelfcon.com Xelfcon Privacy Policy — Last updated 31 July 2026. This Policy forms part of the Xelfcon Terms of Service and should be read alongside it and the Xelfcon Refund Policy.