Last updated 29 September 2026
Privacy notice
This covers the Held waitlist on held.ng: what we keep when you join, why, and how to have it deleted. It's written under the Nigeria Data Protection Act 2023.
- What we keep
- Your phone number, whether you want to buy, sell or both, and your email if you give one.
- Why
- To send you one message when Held opens. Nothing else.
- How long
- Until that message is sent, then deleted within 30 days. At most 12 months after you sign up.
- Delete it
- Email [email protected] with your number. We'll delete it and tell you.
Who we are
Held is run by Held Digital Ltd. We decide how your details are used, so under the Act we are the data controller.
Questions about your data go to [email protected].
What we collect
- When you join: your phone number (+234 only), whether you want to buy, sell or both, your email if you add one, and the date you joined.
- To stop abuse: a scrambled, one-way version (a salted hash) of your internet address, so we can limit how many sign-ups come from one connection. We can't turn it back into your address. It's deleted after 24 hours.
- To tell people from bots: Cloudflare Turnstile looks at signals from your browser when you use the form. Cloudflare processes these for us; we only receive a pass or fail.
held.ng sets no cookies and has no advertising or tracking code. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't identify you.
Why, and on what basis
We use your details for one thing: to send you a single message, by SMS or WhatsApp (or email, if you gave one), when Held opens. We won't add you to marketing, sell your details or share them for anyone else's marketing.
We rely on your consent, which you give by joining. You can withdraw it at any time; that doesn't affect the message if it's already been sent. The hashed internet address is kept on the basis of our legitimate interest in keeping the list free of spam.
How long we keep it
Until we send the launch message, then we delete it within 30 days. If Held hasn't opened 12 months after you joined, we delete your details anyway. Hashed internet addresses are deleted after 24 hours.
Who else handles it
- Cloudflare, Inc. hosts this site, stores the list and runs Turnstile, as our processor under its data processing terms.
- The messaging provider we use to send the launch message. It receives only your number (or email) and the message.
Nobody else. If the law requires us to share something, we'll only share what's required.
Where it's stored
Cloudflare may process your details outside Nigeria. We only allow that under the Act's rules for transfers abroad, using Cloudflare's data processing terms, which include standard contractual safeguards.
Your rights
You can ask us to:
- show you what we hold about you, and give you a copy;
- correct it;
- delete it;
- stop using it, or withdraw your consent.
Email [email protected] and include the phone number you signed up with. We'll reply within 7 days and act on it within 30. It's free.
If you're not happy with how we've handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Keeping it safe
The list is stored in Cloudflare's database, not in spreadsheets or on laptops. Only the people at Held who send the launch message can open it.
Also
- No decisions about you are made automatically.
- The waitlist is for people aged 18 and over.
- If this notice changes, we'll update it here and change the date at the top. If we ever want to use your details for something new, we'll ask you first.