Privacy Policy

Who we are

CoBuilt Investment Partners (“CoBuilt”, “we”) is a property development company registered in Nigeria, with offices at 27 Apex Drive, TechZone District, Victoria Heights, Lagos. For the purposes of the Nigeria Data Protection Act 2023 (the “NDPA”) we are the data controller for personal data collected through this website.

Questions about this policy, or about how we handle your data, go to [email protected] or +234 700 262 8458.

What we collect, and why

We collect only what a specific interaction needs. We do not buy personal data, and we do not build advertising profiles.

• When you register your interest — your name, email address and the enquirer category you choose. We use these to send the project and milestone updates you asked for. The lawful basis is your consent, confirmed by the link we email you.
• When you contact us — your name, email address, phone number if you give one, and the content of your message, so that we can answer it. The lawful basis is our legitimate interest in responding to enquiries, and for investor enquiries, in taking steps at your request before any contract. The form also records your full IP address and browser details, which we use only to detect spam and abuse.
• When you message us on WhatsApp or live chat — your phone number or chat name, your email if you give it, the messages you send and their delivery status, so that we can reply. The lawful basis is your consent, given by contacting us on that channel.
• When you browse — the page visited, where you arrived from (without any query string), your browser type, a random identifier for the visit, and a truncated IP address. The final octet of an IPv4 address (or the last 80 bits of an IPv6 address) is discarded before storage, so the record shows coarse geography and never identifies you. The lawful basis is consent where analytics cookies are enabled; essential logging rests on legitimate interest.
• If you hold an account — your email, name, role and sign-in history, to operate the account and keep it secure.

How long we keep it

Where a period is fixed, a scheduled job enforces it automatically once the window closes. Nothing is kept indefinitely except where law requires it.

Anonymised means your name, email, phone number, message, IP address and browser details are erased from the record. What remains is only the fact that an enquiry was received on a given date, which we use to count enquiries over time.

Who else sees your data

We share personal data only with the service providers needed to run the site, each under contract and each processing only on our instructions, and only what each needs. We do not sell personal data or share it with advertisers. Those providers are:

• Our hosting, database and file storage providers, which store the records described above.
• Cloudflare, which delivers and protects the website and handles the IP address of every visit.
• Our email delivery provider, which sends confirmation emails, replies and updates, and handles your email address and the content of those emails.
• A spam-filtering service (Akismet, operated by Automattic Inc.), which may receive the name, email, message, IP address and browser details from a form submission to judge whether it is spam. A submission marked as spam is kept for a person on our team to review, not discarded.
• An error-monitoring service, which receives technical details when something on the site fails, such as the error and the page address. It is not sent form contents, cookies or IP addresses.
• Meta, if you contact us on WhatsApp. Meta’s own privacy policy also applies to that conversation.

Some of these providers operate outside Nigeria. Where personal data is transferred abroad, we rely on the adequacy and contractual safeguards the NDPA permits.

We may disclose data where the law requires it, or to establish or defend a legal claim.

Your rights

Under the NDPA you may ask us to:

• Confirm what personal data we hold about you, and give you a copy of it.
• Correct anything inaccurate or incomplete.
• Delete your data, where we have no overriding obligation to keep it.
• Restrict or object to a particular use.
• Provide your data in a portable, machine-readable form.
• Withdraw consent at any time — every email we send carries an unsubscribe link, and withdrawing does not affect processing carried out beforehand.

If you hold an account, you can exercise two of these yourself, at any time: download a machine-readable copy of your data, and delete your account, from your account page.

For anything else, write to [email protected] and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.

Security

Data is transmitted over TLS and stored on access-controlled infrastructure. Passwords are hashed, never stored in readable form. Administrative access is limited by role and recorded in an audit log. Contact details shown to staff in internal tools are masked by default.

No system is perfectly secure. If a breach affects your personal data, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you without delay where the breach is likely to put your rights at high risk.

Children

This site is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, contact us and we will delete them.

Cookies

Only essential cookies are set unless you allow more. Categories, purposes and durations are set out in the Cookie Policy, where you can also change your choice at any time.

Changes to this policy

If we change how we handle personal data we will update this page and revise the date above. Where a change materially affects you, we will say so directly.