Privacy and Data Governance Policy

Last updated: October 29, 2026

For customers in Nigeria. Green Tangelo is a US business and this is our US policy, with the additions that the Nigeria Data Protection Act 2023 gives you marked “Customers in Nigeria”. Where the two differ, the Nigerian additions apply to you.

This policy explains what personal information Green Tangelo (“we”, “us”), a business based in the United States, collects through www.greentangelo.net (the “Platform”), why, who we share it with, how long we keep it and how we protect it. It also sets out how we govern data: the principles, responsibilities and controls we work to. It forms part of our Terms and Conditions.

1. Who is responsible

Green Tangelo decides how and why personal information on the Platform is used. Questions, requests and complaints go to our privacy officer at info@greentangelo.net.

Customers in Nigeria. Under the Nigeria Data Protection Act 2023 (NDPA), Green Tangelo is the data controller for your personal data, and our privacy officer acts as our data protection officer. You can reach them at the same address.

2. The standards we follow

the Fair Information Practice Principles and the NIST Privacy Framework, for how we govern personal information;
the NIST Cybersecurity Framework and the practices of ISO/IEC 27001, which our security controls follow (we are not certified against them);
the Payment Card Industry Data Security Standard (PCI DSS), met by our payment partners, who handle all card details;
United States privacy laws where they apply, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), other state privacy laws, the California Online Privacy Protection Act and the Children’s Online Privacy Protection Act.

Customers in Nigeria. We also follow the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) 2025.

3. Our principles

We collect and use personal information openly and fairly; only for the purposes we state; limited to what we need; kept accurate; kept no longer than necessary; and protected against loss and misuse. We give you choices and access, and we are accountable for following this policy.

4. Responsibilities

Management is accountable for privacy, approves this policy and reviews it at least once a year.
The privacy officer keeps the record of what data we hold and why, answers your requests, assesses new uses of data before they start, manages security incidents and trains staff.
Administrators see only what their work needs, and keep it confidential.
Partner dry cleaners and delivery partners receive only what they need to serve a booking (for example, a Renter’s name, delivery address and phone number). They may use it only for that booking, must keep it confidential and secure, and must not keep it longer than needed.
Service providers who process data for us (section 8) do so under contract and only on our instructions.

5. What we collect, why, and how long we keep it

Information	Why we use it	How long we keep it
Account: username, name, email, phone, address, profile text, website and social links, profile photo, account type, country, and when you accepted our terms	To run your account and the bookings, listings or partner work it is for	While your account is open
Listings: description, photos, price, address and map position, and any contact details you add	To show your items to Renters (listings are public)	Until you remove the listing or close your account
Bookings and payments: dates, amounts, invoices, payment and refund status, booking notes, delivery address and phone. We never receive card numbers.	To take payment, deliver and return items, and keep accounts	Invoices, payments and payout records: seven years, or longer if the law requires. Notes and delivery addresses on finished rentals can be deleted on request.
Payout details: bank name, account name and account number (Listers and partner cleaners)	To pay out earnings and bonuses	While your account is open; the copy on each payout record is kept as an accounting record
Partner profiles: business name, phone, address, city, opening hours, description, map position and business registration number	To approve partners and show drop-off points (the registration number is never shown publicly)	While the partnership lasts
Item and inspection records: item status, inspection results, notes, deductions, and who made each change	To verify items, settle deposits and disputes, and prevent fraud	As long as the related listing and booking records
Messages between members, with the sender’s name, email and phone	To let members arrange rentals	Until you close your account or ask us to delete them
Reviews	To help others choose (reviews are public)	Until removed
Recommendations: the name, city, phone or email of someone a member recommends	To invite them and reward the member who recommended them	Until the recommendation is decided, and then as long as needed to record the reward. The person recommended can ask us to delete it at any time.
Newsletter: email, when you agreed and when you confirmed	To send the newsletter you asked for	Until you unsubscribe, which deletes it
Contact form: name, email and message	To answer you	90 days, then deleted automatically
Technical data: your IP address, used at the moment of your visit to find your country (it is not stored); a one-way scrambled form of it, kept for up to a day, to limit repeated attempts (such as sign-ins) and count listing views; your country cookie (section 6); our host’s server logs	To show prices in your currency, and to keep the Platform secure	Country cookie: 30 days. Security and view counters: up to 24 hours. Server logs: as set by our host.

Photos and files you upload but never use are deleted after 48 hours. The chat assistant answers from our own server and does not store your conversation there; if the site keeps a chat history, it stays in your own browser.

In the terms of the CCPA, these are identifiers, customer records, commercial information, internet activity, approximate location (your country) and the content you post. We collect them from you, from other members (for example, a recommendation or a booking), from our Partners (inspection and delivery records) and from your device. We do not use automated decision-making that has legal or similarly significant effects on you.

Customers in Nigeria: our lawful bases. We use your account, listing, booking, payout, partner, message and review data to perform our contract with you; invoices and payment records also to meet our legal obligations (such as tax); inspection records, recommendations, contact form messages and technical data for our legitimate interests in running a safe, fair marketplace, which we have weighed against your rights; and newsletter data with your consent, which you can withdraw at any time.

6. Cookies and similar technologies

gt_region remembers your country so prices show in your currency (30 days).
WordPress sign-in cookies keep you signed in, and a test cookie checks that your browser accepts cookies.
If you leave a comment, WordPress may remember your name and email in your browser.
If the chat assistant is set to keep history, it is saved in your browser’s local storage.

We use no advertising or analytics cookies, and we do not track you across other websites. Because we do not sell or share personal information, browser “Do Not Track” and Global Privacy Control signals do not change what we do, but we treat a Global Privacy Control signal as a request to opt out.

7. Sharing your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We disclose it only:

between the members and Partners of a booking, as far as the booking needs (for example, Partners see the Renter’s name, and delivery partners their address and phone);
publicly, where you choose to publish it: your listings, reviews and, for partner cleaners, the drop-off details on the map;
to our service providers (section 8);
to the police, regulators or courts where the law requires it, or to prevent fraud (see our Anti-Fraud and Collusion Policy);
to a buyer of our business, who must keep to this policy.

We do not share personal information with third parties for their own direct marketing (California’s “Shine the Light” law).

8. Service providers

Stripe (card payments): your email, the invoice number, the item’s name and the amount.
PayPal (PayPal payments): the invoice number, the item’s name and the amount.
Our web host and email service, which store the Platform’s data and send its emails.
OpenStreetMap map tiles and address search (and Google Maps, if we switch maps to it) are loaded by your browser, so these services receive your IP address.
Gravatar shows a profile picture for members who have not uploaded one, from a scrambled form of their email address.
Facebook, only if you choose to sign in with Facebook.

Our country database comes from DB-IP; we download it, and send them nothing about you.

9. Where your information is processed

We are based in the United States, and the Platform’s data is processed in the United States and by our service providers wherever they operate.

Customers in Nigeria. Your personal data is transferred from Nigeria to the United States. We make these transfers only on a basis allowed by Part VIII of the NDPA, such as appropriate safeguards (for example, contractual clauses with our service providers) or where the transfer is necessary to perform our contract with you.

10. How we protect your information

The Platform is served over HTTPS.
Card details are entered only on our payment partners’ secure pages, which meet PCI DSS. We never see or store them, and we check the signature of every payment notification they send us.
The keys to our payment accounts are kept in the server’s configuration, not in the database.
Access follows the least-privilege principle: each member and Partner sees only their own data and what their bookings need. Full payout details and partners’ registration numbers are visible only to administrators; members see only the last four digits of their own account number.
Every form checks a security token and the user’s permissions, and sign-in, registration, messages, bookings and checkout are rate-limited.
Changes to items, bookings, refunds and payouts are logged with who made them.
We keep the Platform’s software up to date, keep regular backups, and train everyone with access to personal information.

11. Your privacy rights

Depending on the state you live in (for example California, Colorado, Connecticut, Virginia, Texas or Oregon), you have the right to:

know what personal information we collect, use and disclose, and get a copy in a portable format;
correct it (you can also edit your profile in your dashboard);
delete it (you can also close your account in your dashboard once any balance is settled);
opt out of its sale or sharing, targeted advertising and profiling (we do none of these);
not be treated differently for using these rights.

We give these rights to all our customers, wherever they live. To use them, write to info@greentangelo.net. We will confirm your identity by asking you to write from the email address on your account, or for other details. You can ask someone to act for you as your authorized agent; we will ask for proof of their authority. We reply within 45 days (or tell you if we need up to 45 more). If we turn down your request, you can appeal by replying to our answer; if we turn down the appeal, you can contact your state attorney general. We may keep information the law requires us to keep, such as invoices, even after a deletion request.

Customers in Nigeria: your rights under the NDPA

You have the right to be informed; to access your personal data and get a copy in a portable format; to have it corrected or erased; to restrict how we use it; to object to its use (including for direct marketing); to withdraw your consent at any time; and not to be subject to decisions based solely on automated processing. Write to info@greentangelo.net and we will reply within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

12. Children

The Platform is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18, including children under 13; if we learn we have, we delete it.

13. Security incidents

We have a plan for responding to data breaches. If a breach affects your personal information, we notify you and the authorities as the breach notification laws of your state require, without unreasonable delay, with advice on protecting yourself.

Customers in Nigeria. Where a breach is likely to put your rights and freedoms at risk, we notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you without undue delay if the risk to you is high.

14. Accountability and review

We keep a record of the personal information we process and why.
We assess the privacy risks before starting any new use of personal information that could put people at high risk.
We review this policy, our retention periods and who has access to what at least once a year.

Customers in Nigeria. Where the NDPA and the GAID require it, we register with the Nigeria Data Protection Commission, carry out data protection impact assessments and file our compliance audit returns.

15. Changes

We will post any changes here and update the date at the top. For significant changes we will also tell members by email or on the Platform.

16. Contact

Green Tangelo · info@greentangelo.net · Contact page