Who we are
Mine Homes Mail is operated by MINE-HOMES ENTERPRISES LIMITED, RC 9681489, Lagos, Nigeria (“we”, “us”). This policy explains how we handle personal data when you use Mine Homes Mail at inbox.mine-homes.com and our installable app. It is written to meet the Nigeria Data Protection Act 2023 (“NDPA”) and the General Application and Implementation Directive 2025 (“GAID”) issued by the Nigeria Data Protection Commission.
Our role: processor and controller
- Data processor for workspace content. For mail content, files, tasks, notes, contacts and calendar entries, the organisation that owns your workspace is the data controller. We process that content on its behalf and on its documented instructions — to provide the Service.
- Data controller for account and billing data. For the data we need to run your account — sign-in details, security records and billing information — we decide how it is used and are the controller.
What we collect
- Account data: name, email address, workspace and role, preferences and 2-factor sign-in settings.
- Mail host settings: server names, ports and the credentials needed to connect to your mailbox. Mail passwords are encrypted and never logged.
- Mail content: messages and attachments are fetched from your mail host and processed transiently to display them. We cache content, encrypted at rest, only where a feature needs it — for example search, summaries, offline reading or follow-up reminders.
- Files you upload to the team drive, and share links you create.
- Workspace content: tasks, notes, contacts and calendar entries.
- Device and sign-in data: IP address, browser and device type, sign-in times and security events, and push notification tokens if you turn notifications on.
- Billing data: plan, seats, invoices and payment references. Card details are held by Paystack; we store only the card brand, last four digits and expiry date.
How we use data
- to provide the Service — show, send, sort and search your mail and run the features you use;
- to secure accounts — authentication, 2-factor sign-in, fraud and abuse prevention, and virus scanning;
- to bill you, process renewals and keep financial records;
- to send service messages, such as security alerts, receipts and important changes;
- to provide support when you contact us;
- to understand reliability and performance in aggregate so we can improve the Service;
- to comply with legal obligations.
Lawful bases
Under section 25 of the NDPA we rely on:
- Contract — to provide the Service you or your organisation signed up for, and to bill for it;
- Legal obligation — to keep tax and accounting records and respond to lawful requests;
- Legitimate interests — to keep the Service secure and improve it, balanced against your rights;
- Consent — for optional things such as push notifications. You can withdraw consent at any time.
For workspace content, the workspace owner, as controller, is responsible for its own lawful basis.
AI processing
AI features run only when an administrator has enabled them for your domain. When you use one — for example a summary or smart reply — we send the content needed for that request to our AI provider, receive the result and return it to you. Content is not used to train AI models, either by us or by our providers, and our providers process it only to produce the result.
International transfers
Some providers process data outside Nigeria. Where that happens, we transfer data only in line with Part VIII of the NDPA — to countries with adequate protection or under appropriate safeguards such as binding contractual clauses — and we take steps so the data receives a level of protection equivalent to Nigerian law.
Security
- Encryption in transit (TLS) and at rest for stored data and caches.
- Mail passwords encrypted and never written to logs.
- 2-factor sign-in available for every account.
- Every attachment and uploaded file is scanned for viruses.
Retention
- We keep account and workspace data for as long as your workspace is active.
- When a workspace is deleted, its data is removed from our systems within 30 days, including caches and backups that roll over in that time.
- Billing records are kept for as long as tax and accounting law requires.
- Security logs are kept for a limited period to protect the Service.
Your rights
Under the NDPA you have the right to:
- access the personal data we hold about you;
- have inaccurate data rectified;
- have data erased;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- complain to the Nigeria Data Protection Commission (NDPC).
Email privacy@mine-homes.com to exercise these rights. We will respond within 30 days. If your request concerns workspace content, we may refer it to your workspace owner, who controls that data, and help them respond.
Children
Mine Homes Mail is a business service and is not directed at children under 18. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.
Breach notification
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it where required, inform affected workspace owners without undue delay, and tell affected people directly where the risk is high.
Changes to this policy
We will update this policy when our practices change and notify workspace owners of material changes before they take effect. The “Last updated” date above shows the latest version.
Contact and Data Protection Officer
Our Data Protection Officer can be reached at privacy@mine-homes.com, or by post at MINE-HOMES ENTERPRISES LIMITED, Lagos, Nigeria. For general support, email support@mine-homes.com.
MINE-HOMES ENTERPRISES LIMITED · RC 9681489 · Lagos, Nigeria