Privacy Policy

1.About this policy

This Privacy Policy explains what personal data we collect when you use Xofar, why we collect it, how we use and share it, how long we keep it, and the rights available to you. It applies to the Xofar website, mobile applications, APIs, customer support channels and other Xofar services (together, the “Platform”).

Xofar is part of the TransferXO ecosystem. When you create an account on Xofar, a corresponding TransferXO account is automatically created for you. Your Xofar and TransferXO accounts are connected and may use shared account information and systems to enable applicable services.

Depending on the services you use, Xofar and TransferXO may process personal data in connection with account creation, authentication, customer support, payments, travel cards and other applicable services. The entity responsible for processing your personal data will depend on the purpose and service involved.

Where Xofar determines the purposes and means of processing your personal data, Xofar acts as a data controller. Where Xofar processes personal data solely on behalf of a business, travel partner or other organization that determines the purposes and means of processing, that organization may act as the data controller and Xofar may act as its data processor.

This Privacy Policy is governed by the Nigeria Data Protection Act 2023 (“NDPA”) and applicable regulations, directives and guidance issued by the Nigeria Data Protection Commission (“NDPC”), including the General Application and Implementation Directive 2025 (“GAID”), as applicable.

2.The data we collect

We aim to collect personal data that is reasonably necessary for the purposes described in this Policy. The information we collect depends on how you use Xofar and the services you request. Different Xofar services may require different types of personal data because they are provided in partnership with different suppliers, service providers and regulatory authorities.

Account and identity data

This may include name, email address, telephone number, country of residence, date of birth, password or authentication information, profile information, and profile photograph where you choose to upload one. If you sign in using a third-party authentication service such as Google or Apple, we may receive information such as your name and email address from that provider.

Traveller data

To search for, reserve or issue travel services, suppliers may require information about each traveller. Depending on the service, this may include full name as shown on the applicable travel document, date of birth, gender where required, nationality, passport or national identity information, document issue and expiry dates, place of issue, visa or travel authorization information, and frequent flyer or loyalty programme information.

If you make a booking for another person, you must have the authority or lawful basis required to provide their personal data to us.

Booking and travel data

This may include searches conducted on the Platform, itineraries, booking references, travel dates and destinations, seat, room and baggage selections, booking changes and cancellations, supplier communications relating to your booking, and correspondence between you and Xofar concerning a booking or service.

Payment data

Payment card and other payment credentials are generally collected and processed by our payment processors and other authorized payment partners. Where applicable, Xofar may retain limited transaction information such as card brand, last four digits of the payment card, cardholder name, transaction amount, currency, transaction date, and transaction outcome. We do not intentionally store full payment card numbers on Xofar systems where payment processing is handled by our payment providers.

Special category data

Some travel-related services may require information that is subject to enhanced protection under applicable data protection law. Depending on the service, this may include:

• health or accessibility information required to arrange assistance or meet travel requirements;
• information associated with special meals or other service requests where such information may reveal sensitive characteristics;
• information contained in documents submitted for visa assistance; and
• other sensitive information required by a supplier, insurer, immigration authority or other relevant authority.

We process such information only as permitted by applicable law and where an appropriate lawful basis and any additional conditions required for sensitive data have been satisfied. We do not use such information for unrelated marketing purposes or behavioral profiling.

Technical and device data

When you use the Platform, we may collect IP addresses, device type and identifiers, operating system, browser type and language, pages and screens viewed, searches and interactions, links clicked, session information, crash reports, security and diagnostic information, and approximate location derived from your IP address. Where you enable precise location services, we may use your location to provide location-based features. You can disable precise location through your device settings.

Communications and marketing data

We may collect communication preferences, subscription and unsubscribe status, marketing preferences, and communications between you and Xofar, including emails, chats and support messages. Where support calls are recorded, we will notify you at the beginning of the call where required by applicable law.

3.Why we use your data and our lawful basis

We process personal data only where we have a lawful basis to do so under applicable data protection law.

Where we rely on legitimate interests, we will assess whether our interests are balanced against your rights and freedoms. Where consent is the lawful basis, you may withdraw your consent at any time. Withdrawal does not affect processing carried out before withdrawal.

4.Who we share your data with

We do not sell your personal data. We may disclose personal data where necessary to provide the services you request, comply with legal obligations, protect our rights and users, or operate the Platform.

Because Xofar provides different travel and travel-related services, the personal data we process and the parties with whom we share it may vary depending on the service you use. Flight bookings may require sharing traveller and travel-document information with airlines and global distribution systems; hotel bookings may involve hotels and bed banks; car rentals may involve car rental companies; and eSIMs, gift cards and travel cards may involve telecommunications providers, card issuers and payment providers.

Travel suppliers and service providers

Depending on your booking, we may share relevant traveller and booking information with airlines, hotels, ground transport providers, transfer companies, car hire providers, tour operators, insurers, visa processing partners, and other suppliers involved in fulfilling your booking. Where a supplier independently determines how and why it processes your data, that supplier may act as a separate data controller and its own privacy policy may apply.

Distribution and technology partners

We may use global distribution systems, consolidators, bed banks, channel managers, booking technology providers, and other technology or distribution partners to access inventory, process bookings and deliver the services available through the Platform. Where such providers process personal data on our behalf, we require appropriate contractual safeguards.

Payment and verification providers

We may share relevant information with payment processors, banks, card networks, identity verification providers, fraud-prevention providers, and other financial or verification service providers, to authenticate transactions, prevent fraud and comply with applicable financial, Know Your Customer, anti-money laundering and regulatory requirements.

Service providers

We may engage service providers for cloud hosting, email and messaging, customer support, analytics, cybersecurity, software and infrastructure, data storage, and other services necessary to operate the Platform.

Xofar and TransferXO

Where necessary to operate connected services, manage your account, provide customer support, process transactions, maintain security, or provide other services requested by you, relevant personal data may be shared between Xofar and TransferXO The information shared may include account identifiers, contact information, transaction information and booking information.

Government, regulatory and law enforcement authorities

We may disclose personal data where required or permitted by law. Depending on the journey and service, airlines, border authorities and other relevant bodies may require Advance Passenger Information, Passenger Name Record information or other traveller information. We may also disclose information to immigration authorities, embassies, aviation regulators, tax authorities, law enforcement agencies or courts where legally required or authorized.

Corporate transactions

If Xofar undergoes a merger, acquisition, restructuring, financing, sale of assets or other corporate transaction, personal data may be transferred as part of the relevant transaction, where permitted by law.

5.Sending data outside Nigeria

Because travel services frequently involve suppliers and authorities outside Nigeria, your personal data may need to be transferred to or accessed from other countries. For example, where you book an international flight, relevant traveller information may need to be shared with the airline and, where legally required, relevant authorities in the destination or transit country.

We will transfer personal data outside Nigeria only where permitted under applicable Nigerian data protection law and where an appropriate legal mechanism or condition for the transfer applies. Depending on the circumstances, this may include:

• transfer to a country recognized as providing an adequate level of protection;
• appropriate contractual or other safeguards;
• a transfer that is necessary for the performance of a contract with you or to take steps at your request before entering into a contract;
• a transfer required or permitted by applicable law; or
• another lawful transfer mechanism or exception recognized under applicable law.

You may contact us at [email protected] to request information about the safeguards applicable to a particular international transfer, subject to any legal restrictions on providing such information.

6.Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, remember your currency and language, understand how the Platform is used, maintain security, measure performance where permitted, and where you have provided the required consent, provide relevant offers or marketing.

Non-essential cookies will be managed through the cookie controls available on the Platform where required by applicable law. Our Cookie Policy has full details.

7.Automated decisions

We may use automated systems to detect fraudulent transactions, stolen or compromised payment methods, suspicious account activity, abuse of promotions, and other security or compliance risks.

An automated system may temporarily hold, reject or flag a booking or payment for further review. Where applicable law gives you rights in relation to automated decision-making, including a right to request human intervention or challenge a decision, you may contact us at [email protected].

We do not use automated profiling for the purpose of setting individual travel prices for individual users. Prices may change because supplier fares, inventory, availability, exchange rates and other commercial factors change.

8.How long we keep your data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide services, resolve disputes, enforce agreements and comply with legal, regulatory, tax, accounting and security requirements.

Where a retention period expires, we will securely delete, destroy or anonymize the relevant information unless continued retention is permitted or required by law. Anonymized information that can no longer reasonably be linked to an identifiable individual may be retained for statistical, analytical, planning and business purposes.

9.Your data protection rights

Subject to applicable law and any relevant exemptions, you may have rights in relation to your personal data, including the right:

1. 1To be informed about how we process your personal data.
2. 2To request access to personal data we hold about you.
3. 3To request correction of inaccurate or incomplete personal data.
4. 4To request deletion of your personal data where applicable.
5. 5To request restriction of certain processing where applicable.
6. 6To object to processing based on legitimate interests and, where applicable, to direct marketing.
7. 7To request portability of personal data where the applicable legal requirements are satisfied.
8. 8To withdraw consent where consent is the lawful basis for processing.
9. 9To exercise applicable rights relating to automated decision-making.
10. 10To lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority where applicable.

To exercise your rights, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond within the timeframe required by applicable law.

10.Children

Users must be at least 18 years old to create a Xofar account. We do not knowingly permit children to create independent Xofar accounts. Adults may use Xofar to make bookings that include children or other minors. In those circumstances, we may process the minor’s personal data where it is necessary to arrange and provide the requested travel service. The adult making the booking is responsible for ensuring that they have the appropriate authority or lawful basis to provide the minor's personal data to us.

If you believe that a child has independently created an account or provided personal data to us in circumstances where this was not authorized, please contact us at [email protected].

11.How we protect your data

We maintain appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration or disclosure. These measures may include:

• encryption of data in transit using appropriate transport-layer security;
• encryption of stored data where appropriate;
• access controls limiting personal data access to authorized personnel;
• logging and monitoring relevant access and security events;
• use of appropriate payment security measures and PCI DSS-compliant payment providers where applicable;
• multi-factor authentication for privileged or production-system access where appropriate;
• security monitoring and vulnerability assessments;
• periodic penetration testing and security reviews;
• data protection and security training for relevant personnel; and
• due diligence and contractual safeguards for relevant third-party service providers.

No system can be guaranteed to be completely secure. You should keep your account credentials confidential, use a strong and unique password and enable available multi-factor authentication features.

12.Personal data breaches

If Xofar becomes aware of a personal data breach, we will assess the incident and take appropriate steps in accordance with applicable law and our incident response procedures. Where notification to the Nigeria Data Protection Commission is required, we will make the required notification within the applicable statutory timeframe. Where a breach is likely to result in a high risk to affected individuals and notification is required by applicable law, we will notify affected individuals without undue delay and provide relevant information about the incident and appropriate protective steps.

13.Contact us

For questions, requests or concerns relating to your personal data, please contact us first.

If you are not satisfied with how we have handled your personal data or your request, you may lodge a complaint with the Nigeria Data Protection Commission through its official channels.

14.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data processing activities. Where we make material changes, we will publish the updated Policy and, where appropriate or required by law, notify you through the Platform, by email or through another appropriate communication method. The version number and effective date shown at the beginning of this Policy indicate the version currently in effect.