Data Protection Compliance

Data Protection Compliance Haven International Limited

Effective date: August 1, 2026  ·  Last updated: August 1, 2026  ·  Version 1.0

Haven International Limited ("Haven") is a Nigerian-registered company that serves users globally. This page explains how Haven complies with data protection regulations across the different countries and regions where its users are based.

For full details on how Haven collects, uses, and protects your personal data, see our Privacy Policy.

1. Which Law Applies to You

Haven is registered in Nigeria and Nigerian law governs Haven's operations. However, because Haven serves users globally, additional data protection regulations may also apply depending on where you are located:

• All Haven users: Nigeria Data Protection Regulation (NDPR) applies as Haven is a Nigerian company.
• Users in the European Union: The EU General Data Protection Regulation (GDPR) also applies.
• Users in the United Kingdom: UK GDPR also applies.
• Users under 13 in the United States: The Children's Online Privacy Protection Act 2026 (COPPA 2026) also applies.

Where multiple regulations apply, Haven applies the standard that provides the greatest protection to the user.

2. Nigeria — NDPR Compliance

The Nigeria Data Protection Regulation (NDPR), issued by the National Information Technology Development Agency (NITDA), is Haven's primary data protection obligation as a Nigerian-registered company.

2.1 Haven's NDPR Obligations

• Haven is registered with NITDA as a data controller
• Haven collects personal data only for lawful, specific, and legitimate purposes
• Haven does not process personal data beyond the purposes for which it was collected
• Haven implements appropriate technical and organisational security measures to protect personal data
• Haven retains personal data only for as long as necessary
• Haven notifies NITDA of data breaches within 72 hours as required by NDPR

2.2 Nigerian User Rights Under NDPR

Nigerian users have the following rights under the NDPR:

• Right to be informed about how your data is used
• Right to access your personal data
• Right to correct inaccurate data
• Right to delete your personal data
• Right to object to data processing
• Right to lodge a complaint with NITDA at nitda.gov.ng

3. European Union — GDPR Compliance

The EU General Data Protection Regulation (GDPR) applies to Haven's processing of personal data belonging to users in the European Union, regardless of where Haven is based.

3.1 Haven's GDPR Obligations

• Haven processes EU user data on a valid legal basis (contract, legitimate interests, consent, or legal obligation)
• Haven implements data protection by design and by default
• Haven maintains records of processing activities
• Haven ensures appropriate safeguards are in place when transferring EU user data outside the EU
• Haven notifies relevant EU supervisory authorities of data breaches within 72 hours where required

3.2 EU User Rights Under GDPR

EU users have the following rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with your national Data Protection Authority

3.3 Legal Basis for Processing EU User Data

Haven processes EU user data on the following legal bases:

• Contract: Processing necessary to deliver Haven's platform and services to you
• Legitimate interests: Fraud prevention, platform security, and platform improvement
• Consent: Marketing emails and non-essential cookies
• Legal obligation: Tax records, regulatory compliance, and anti-money laundering obligations

4. United Kingdom — UK GDPR Compliance

UK GDPR applies to Haven's processing of personal data belonging to users in the United Kingdom. UK GDPR mirrors EU GDPR in most respects but is administered by the UK's Information Commissioner's Office (ICO) rather than EU supervisory authorities.

4.1 UK User Rights Under UK GDPR

UK users have the same rights as EU users listed in Section 3.2 above. UK users may additionally:

• Lodge a complaint with the ICO at ico.org.uk
• Seek enforcement action through UK courts

4.2 UK Data Transfers

When Haven transfers UK user data outside the UK, Haven ensures appropriate safeguards are in place including standard contractual clauses approved by the ICO or other approved transfer mechanisms.

5. United States — COPPA 2026 Compliance

The Children's Online Privacy Protection Act (COPPA), updated in 2026, applies to Haven's collection of personal data from users under 13 in the United States. The updated COPPA 2026 rules took effect on April 22, 2026.

5.1 Haven's COPPA 2026 Obligations

• Haven does not knowingly collect personal data from children under 13
• If Haven discovers a user under 13 has created an account, Haven deletes the account and all associated data immediately
• Haven does not use personal data from users under 18 for behavioural advertising
• Haven does not share data from users under 18 with advertising platforms for targeting purposes
• Haven collects only the minimum data necessary from users under 18
• Haven does not collect precise location data from users under 18

5.2 Parental Rights Under COPPA 2026

Parents and guardians of users under 13 in the United States may:

• Request access to their child's personal data held by Haven
• Request deletion of their child's personal data
• Refuse further collection of their child's personal data

To exercise these rights, contact Haven at privacy@youfoundhaven.com with your child's account details.

6. International Data Transfers

Haven is based in Nigeria. When Haven uses third-party services including Stripe, Google Analytics, and Mailchimp, user data may be transferred to and processed in the United States and other countries outside Nigeria.

Haven ensures all international data transfers are protected by appropriate safeguards including:

• Standard contractual clauses with all third-party processors
• Data processing agreements with all third parties that handle personal data
• Compliance with NDPR cross-border transfer requirements
• Compliance with GDPR and UK GDPR transfer mechanisms where applicable

A full list of Haven's third-party processors and their locations is available in the Subprocessors page.

7. Data Breach Notification

In the event of a personal data breach, Haven will:

• Notify affected users by email within 72 hours of discovering the breach
• Notify NITDA within 72 hours as required by NDPR
• Notify relevant EU supervisory authorities within 72 hours where required by GDPR
• Notify the ICO within 72 hours where required by UK GDPR
• Provide full details of what data was affected, how it happened, and what Haven is doing to fix it

8. Exercising Your Rights

To exercise any of your data protection rights under NDPR, GDPR, UK GDPR, or COPPA 2026:

• Email privacy@youfoundhaven.com with your request
• Include your full name, email address associated with your Haven account, and details of your request
• Haven will verify your identity before processing your request
• Haven will respond within 30 days

For full details on your rights and how to exercise them, see Section 9 of our Privacy Policy.

9. Contact and Complaints

For data protection enquiries, subject access requests, or complaints:

• Data protection contact: privacy@youfoundhaven.com
• General support: support@youfoundhaven.com
• Post: Haven International Limited, Block 271, Flat 2, Zone F, Iba Housing Estate, Ojo, Lagos, Nigeria

If you are not satisfied with Haven's response, you may escalate your complaint to the relevant supervisory authority:

• Nigerian users: NITDA at nitda.gov.ng
• EU users: Your national Data Protection Authority
• UK users: The ICO at ico.org.uk
• US users (COPPA): The Federal Trade Commission at ftc.gov