This platform collects a tax. Collecting a tax means holding records, and some of those records are about people. This notice says exactly what is held, why it is held, what the law allows it to be used for, how long it stays, and what you can require to be done about it. It is written under the Nigeria Data Protection Act 2023.
Who is responsible for this data
TourismRevenue operates this platform to administer the Tourism Development Contribution and to lodge fiscal invoices with the Nigeria Revenue Service e-invoicing service, with the Federal Ministry of Art, Culture, Tourism and the Creative Economy. It is the data controller for the records described below. Where an invoice is issued by a registered business through this platform, that business is the controller of its own customer records and this platform processes them on its behalf and under the tax law that requires the invoice to exist.
Data protection enquiries and requests go to support@tourismrevenue.co.
What is collected, and why
1 · If you are just reading this site
Almost nothing. The public pages — this one, the register, the rules, the transparency pages and the verification pages — do not create an account, do not set a tracking cookie, and do not carry an advertising or analytics tag belonging to anyone else.
- Your IP address is counted, not kept. Each public page is rate limited so that one connection cannot exhaust it for everybody. The counter holds a bucket key derived from your IP and a hit count for the length of its window, and stale windows are deleted automatically about half an hour later. It is never joined to anything else.
- Your web server request is logged in the ordinary way any web server logs a request, for security and fault diagnosis.
- Your theme choice (light or dark) is stored by your own browser on your own device. It never reaches the server.
Lawful basis: the legitimate interest of keeping a public service available and secure, under section 25 of the Act.
2 · If you register or run a business here
A business is not a person, but the people who act for it are. For a registered operator the platform holds the business's own particulars — trading and legal name, registration and tax identifiers, category, premises, state and local government area, bank details for remittance — and, separately, the details of the people authorised to act for it: name, work email address, work phone number, role, and the record of what each of them did in the system.
- Sign-in and security records: password verifier, multi-factor enrolment, session and device records, sign-in attempts and their source, so an account can be defended and a compromise investigated.
- An audit trail: a hash-chained record of the actions taken in the platform, including who took them. This is what makes the ledger evidence rather than assertion, and it is deliberately not editable.
Lawful basis: compliance with a legal obligation and the performance of a task carried out in the public interest — the administration and collection of a statutory contribution — together with the contract under which an account is held. Providing these details is a condition of being registered to charge the contribution; it is not optional and it is not based on consent, so consent cannot be withdrawn to avoid it.
What of this is public: only the business identity — trading name, Tourism Registration Number, category, state, local government area, registration status and whether its remittance periods are up to date. The people are not published. Neither are turnover, contact details, bank details or any amount belonging to the business.
3 · If you were given an invoice
A fiscal invoice is a tax record, and the law requires it to identify the supply. For a consumer sale that normally means no more than the transaction itself. Where a buyer is named — a business or government buyer, a booking in a guest's name, an invoice you asked to be addressed to you — the name and the identifiers on the invoice are held as part of that record and are lodged with the Nigeria Revenue Service e-invoicing service, because that is what makes the invoice valid.
- The platform holds no card number and no bank account number belonging to a guest. Payment is confirmed by the bank, and what reaches the platform is the fact and the reference of a payment, not the instrument.
- None of this is published. The public verification pages confirm that an invoice is genuine and show its fiscal particulars in masked form; they do not disclose who the customer was.
Lawful basis: compliance with a legal obligation — the issue, lodgement and retention of a fiscal document.
4 · If you report a business
The report form asks for no personal data at all. It asks which business, what happened, and when — nothing about you.
- Contact details are optional and marked as such. Give them only if you want to be contacted about your report; leave them blank and the report is still investigated, you simply cannot be asked a follow-up question.
- Your IP address is not stored in the report. What is stored is a keyed hash of it, which lets the platform recognise a flood of reports from one source without being able to work backwards to a person or to link two reports across the rest of the platform.
- Your reference is not an account. It confirms a report was received and when. It reveals nothing about the business you named and nothing about what was done next.
Lawful basis: a task carried out in the public interest — the detection of unissued invoices and uncollected contribution — and your consent for the optional contact details, which you can withdraw by asking for them to be removed.
How long it is kept
| Record | Kept for | Why that long |
|---|---|---|
| Fiscal invoices and their archive | 10 years from the date of issue | The statutory retention period this deployment is configured with. Each archived document carries its own retain_until date and a SHA-256 line in the archive manifest, so what was kept and until when is itself auditable. |
| Levy ledger, remittances and settlements | For as long as the fiscal records they belong to | They are the accounting record behind the published fund position and cannot be deleted piecemeal without destroying the chain that proves it. |
| Audit trail | For the life of the platform record it describes | It is hash-chained. Removing an entry would break the chain and is detectable by design — that is the point of it. |
| Operator and user accounts | While the registration is live, then with the fiscal records | A deregistered business stays on the record because the invoices it issued while registered stay on the record. |
| Public reports | Until the report is closed, and then only as a closed case | Optional contact details are removed on request at any time, including before the case is closed. |
| Rate-limit counters | About half an hour | Stale windows are pruned automatically. Nothing about a visitor survives the window it was counted in. |
| Signed-in sessions | 30 minutes of inactivity | An unused session is destroyed rather than left open on a shared machine. |
Who it is shared with
- The Nigeria Revenue Service. Every fiscal invoice is lodged with the national e-invoicing service as it is issued. That is the obligation the invoice exists to satisfy, not an optional disclosure.
- The settlement bank. Remittance references and amounts, so a payment can be matched to the operator that made it. The bank sees the money, not the guests.
- State tourism authorities, for operators trading in their state — registration status and compliance standing, within the scope of their statutory function.
- Nobody else. Personal data held here is not sold, not rented, not used for advertising, not used to profile anyone, and not transferred outside Nigeria as a matter of routine operation.
Disclosure to a law enforcement or regulatory body happens only where the law requires it, and is itself recorded in the audit trail.
Your rights
What you can require
Under the Nigeria Data Protection Act 2023 you may ask for:
- Access — confirmation of whether personal data about you is held, and a copy of it.
- Rectification — correction of anything inaccurate, and completion of anything incomplete.
- Erasure — deletion, where the data is no longer needed for the purpose it was collected for or where it was held on consent you have withdrawn.
- Restriction and objection — that processing be paused while a dispute about accuracy or lawfulness is resolved, or that processing based on legitimate interests stop.
- Portability — data you provided, in a structured, commonly used, machine-readable form.
- Not to be subject to a decision based solely on automated processing that significantly affects you. The platform computes the contribution automatically from the approved schedule, but no registration, suspension or enforcement decision is taken by the system alone.
What erasure cannot reach. A fiscal invoice, a ledger entry and an audit record are kept because the law requires them to be kept, for the retention period above. A request to erase them will be refused for that reason and the reason will be given in writing. Optional data — a contact detail on a report, a notification preference — is erased on request.
How to exercise them, and how to complain
Write to support@tourismrevenue.co and say what you are asking for. You will be asked to establish that you are the person the data is about — that check exists to stop someone else obtaining your records, and nothing beyond what is needed for it is retained.
If you are not satisfied with the response, you may complain to the Nigeria Data Protection Commission, the supervisory authority established under the Act. Complaining to the Commission does not stop you pursuing any other remedy available to you.
Cookies and storage on your device
- No cookie is set for an anonymous visitor reading the public pages. There is one exception: the report form carries a security token that has to be remembered for the moment between the form being shown and being submitted, so opening the report form sets a single, strictly necessary session cookie. It contains no identifier of you and expires with the session.
- Signing in sets a session cookie for the same strictly necessary reason. It is marked HttpOnly and SameSite, and Secure wherever the site is served over HTTPS.
- Your device remembers your theme. Light or dark is kept in your browser's local storage and never sent anywhere.
- No third-party cookie, tag, pixel or analytics script is served by this platform.
Security
Passwords are stored as verifiers, never in a form that can be read back. Multi-factor authentication is available and is required for privileged roles. Access inside the platform is by permission, scoped so that a state officer sees that state and an operator sees only itself. Fiscal documents are signed and their verification identifiers are opaque, so a public verification link cannot be walked through to reach the next record. Every privileged action is written to a hash-chained audit trail that would show tampering.
Changes to this notice
This notice describes the platform as it is configured right now — the retention period and the session timeout above are read from the running configuration each time the page is loaded rather than restated from memory, so it cannot quietly fall out of date. Where the platform's handling of personal data changes materially, the change is announced to registered operators through the platform.
Related reading: the rules of the contribution · what the public register publishes · where the money goes.