Privacy Policy

Last updated 18 August 2026

This policy explains what Kamadeva Privé records about you, why, who it is shared with, how long it is kept, and what you can ask us to do about it. It covers the membership programme and the member portal. It is written to be read, not to be survived.

1. Who is responsible

Kamadeva Privé is the membership programme of Kamadeva Hospitality Group, which operates Oso Lounge, Boom Boom Room, Oxymor Concepts, Cleanbite Kitchen and Noh-Ra Cabaret. The Group is the data controller for everything described here.

Kamadeva Privé is operated by Kamadeva Ltd. (RC 1657075), 141 Adetokunbo Ademola Crescent, Wuse 2, Abuja. For anything in this policy, write to privacy@kamadevaprive.com.

2. What we record

We hold only what the programme needs to work:

Who you are — your name, phone number and email address. Optionally, and only if you offer them: your gender and date of birth.
Your membership — your member number, your tier, the venue you joined at, and your membership card, which is a QR code tied to your record.
Your visits — when you arrive at a venue and which venue it was, recorded when your card is scanned or your name looked up at the door.
Your spend — the totals of bills attributed to you, and the itemised receipt from the till where a ticket has been linked to your membership. This is what your points and your tier are calculated from.
Your requests — reservations, click & collect orders, and any enquiry you send us.
Your sign-in — your portal code is stored only as a one-way hash. We cannot read it back, and neither can anyone else.
Your permissions — a dated record of each consent you have given or withheld, so we can show what you agreed to and when.

We do not take payment details. Bills are paid at the venue's own till, and card information never reaches this platform.

3. Why we hold it, and on what basis

To run your membership — recognising you at the door, applying the benefits of your tier, keeping your points and your standing accurate, and handling reservations and orders. This is necessary to provide the membership you asked for.
To write to you about your own membership — a welcome when you join, and a note when your standing changes. These are service messages about your account, not marketing.
To recognise occasions — if you gave us your date of birth, so the house can mark your birthday.
Marketing — only where you have said yes. Your consent is recorded separately for email and for WhatsApp, and you can withdraw either at any time without affecting your membership.
Keeping the programme honest — an internal audit record of significant actions taken by staff on member records, so decisions can be traced.

4. Who else sees it

Your record is visible to Kamadeva staff to the extent their role requires: a host at the door sees enough to recognise you and welcome you in, while fuller records are limited to venue managers and above.

We rely on three service providers, none of whom may use your data for their own purposes:

Supabase — the database and sign-in service that stores the records above.
Vercel — hosting for the portal you are reading now.
Resend — delivery of the emails described in clause 3.

These services hold data in the European Union (Ireland), so information about you is stored outside Nigeria. We do not sell your data, and we do not share it with anyone else except where the law requires it.

5. How long we keep it

Your membership record is kept while you are a member and for as long as we are required to keep records afterwards. Visit and spend history is what your tier is built on, so it is retained for the rolling period the programme runs on and the accounting period that follows. Consent records are kept for as long as we rely on them, and after, so we can evidence what was agreed. If you ask us to erase your record, see clause 6.

6. What you can ask for

You may ask us at any time to:

show you what we hold about you;
correct anything wrong — a misspelled name, a wrong number, a date of birth;
delete your record, where we are not required to keep it;
stop marketing to you, which we will do immediately and without question;
object to a particular use, or ask for your data in a portable form.

Write to us at privacy@kamadevaprive.com, or use the Help page in your member portal, which sends your request straight to the team. You can also speak to the manager at any venue. We will respond within one month.

Closing your membership. In the app, Settings → Close my membership raises a request rather than erasing your record the moment you tap it. That is deliberate, and we would rather say so than imply otherwise: your visits and attributed spend are what your tier was built on, and we are obliged to keep accounting records for a period after you leave. We will close the membership, stop all messages, and delete what we are free to delete — then tell you plainly what has been kept and why. You can also ask by writing to support@kamadevaprive.com.

7. How it is protected

Access is enforced by the database itself rather than by the app alone: each member can reach their own record and no one else's, and staff access is limited by role. Sign-in codes and staff passwords are stored only as one-way hashes. Significant staff actions on member records are written to an audit log.

8. Age

Membership is for adults of 18 and over, and the programme is not intended for children. If you believe we hold a record for someone under 18, tell us and we will remove it.

9. Kamadeva Muse

Muse is a separate programme with its own records, kept apart from Kamadeva Privé. This policy applies to it in the same way. Belonging to one does not give the other access to your information.

Because Muse is invitation-only, a Muse record also holds the written rationale for the invitation and, where it is offered, an Instagram handle — a public account, recorded because presence is part of what the invitation is based on. Neither is held for Kamadeva Privé members.

10. The law that applies

Kamadeva Ltd. is registered in Nigeria and the programme is run from Abuja, so the Nigeria Data Protection Act 2023 governs how we handle your information. Under that Act we are the data controller for the records described here, and the rights in clause 6 are yours by law rather than by our courtesy.

If we have not answered you properly, you may complain to the Nigeria Data Protection Commission. We would rather you came to us first — but you are not required to, and asking us does not cost you that right.

As clause 4 explains, the providers we rely on hold data in the European Union. That is a cross-border transfer under the Act. We make it on the basis that each provider is contractually bound to protect your information, to act only on our instructions, and never to use it for its own purposes.

11. Changes

If this policy changes we will update the date at the top, and tell you through the portal where the change is significant. Continuing to use your membership after a change means the updated policy applies.