Privacy Policy

Who we are

Churchgate Group is the data controller for personal data collected through this website. Head office: Churchgate Towers, PC 30 Churchgate Street (formerly Afribank Street), Victoria Island, Lagos, Nigeria. You can contact us about anything in this policy at [email protected].

What we collect

• Tour and appointment requests: your full name, email address, phone number (optional) and the property you are interested in.
• Newsletter sign-ups: your email address.
• Website usage, only if you accept analytics cookies: pages visited, approximate location (city or country), device and browser type, collected by Google Analytics. See our Cookie Policy.
• Technical data needed to run and secure the site, such as IP addresses processed by our hosting provider to deliver pages, block attacks and check that form submissions come from people rather than automated programs.
• Anything you choose to tell us when you email or call us.

We do not ask for sensitive personal data through this website. Please don’t include any in your messages.

Why we use it and our lawful basis

• To respond to your tour or appointment request and arrange a visit. Lawful basis: your request, as steps you ask us to take before any agreement, and our legitimate interest in answering enquiries.
• To send our newsletter. Lawful basis: your consent, which you can withdraw at any time using the unsubscribe link or by emailing us.
• To understand and improve how the website is used. Lawful basis: your consent, given through the cookie banner.
• To keep the website secure and meet our legal obligations. Lawful basis: legitimate interests and legal obligation.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing.

Who we share it with

We share personal data only with service providers who process it on our behalf, under contract and only on our instructions:

• Cloudflare: website hosting, delivery and security, including the Turnstile spam check on our forms and cookieless Web Analytics (page views and page speed, without identifying you).
• Our sales systems, used to receive and manage enquiries: an application hosted on Railway with a Supabase database, our Freshsales (Freshworks) CRM, and SendGrid (Twilio) for the email notifications our team receives.
• Google: Google Analytics, only if you accept analytics cookies.
• Vimeo: playing videos on the site, in do-not-track mode.

We may also disclose information where the law requires it, or to protect our rights, property or safety and those of others.

International transfers

Some of our service providers store or process data outside Nigeria, including in the United States and the European Union. Where this happens we rely on the safeguards permitted by the NDPA, such as contractual protections, and we choose providers with recognised security standards.

How long we keep it

• Tour and appointment requests: for as long as needed to deal with your enquiry and any resulting relationship, and in any case no longer than three years after our last contact with you, unless the law requires longer.
• Newsletter sign-ups: until you unsubscribe.
• Analytics data: no longer than 14 months, the maximum retention period for standard Google Analytics properties.

How we protect it

Data is sent to us over encrypted connections (HTTPS), and access to our systems is restricted to the staff and providers who need it. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your data.

Your rights

Under the NDPA you have the right to:

• be informed about how your data is used, and to access a copy of it;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive your data in a commonly used format and have it transferred (data portability);
• withdraw your consent at any time, without affecting processing that has already taken place.

To exercise any of these rights, email [email protected]. We may need to confirm your identity first, and we will respond within the time the law allows. If you are unhappy with how we have handled your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Children

This website is not aimed at children, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. Significant changes will be highlighted on this page.