Last updated: October 2026

Who we are and what this policy covers

City of Gold Estates is a real estate consultancy, agency and management firm with offices in Gbagada and at Trade Fair, Ojo, in Lagos. Under the Nigeria Data Protection Act 2023 the firm is the data controller for personal information collected through this website. This policy covers the website only: it does not cover a call you place to us, a WhatsApp chat, an email you send directly, or the paper file of a transaction, though we handle those on the same principles.

What the forms collect

Two forms ask anything of you, and both submit to the same handler: the message form on the Contact page and the enquiry form beside every listing. Each asks for four things — name (required), email address (required), phone number (optional) and a message (required). The listing form also carries two hidden fields identifying the property, its reference number and the address of the page you were reading, so your enquiry reaches the desk handling that property rather than having to be described in words. Each submission is stored with the date and time it was received and an internal marker showing whether the office has opened it.

Nothing else is asked: no date of birth, no home address, no identity document, no bank details. The site has no cart, no checkout and no payment facility, so payment card data is never collected or processed here. The hosting server keeps the ordinary technical records any web server keeps in order to diagnose faults; those are not used to identify visitors and are not merged with your enquiry.

How we use what you send

• To reply to you about the property or service you asked about.
• To know which listing an enquiry refers to, so the answer is not guesswork.
• To keep one record of who has contacted us, so two consultants do not send you different answers.

We do not advertise to you with these details, do not add you to a mailing list without asking, do not sell, rent or exchange enquiry data, and do not make automated decisions about you on the basis of an enquiry.

The anti-spam checks on the forms

Both forms carry two quiet protections against scripted form-posters: a hidden field no human ever sees, and a signed timestamp that rejects a form posted faster than a person could type into it. Both are checked at the moment of posting and neither is stored with your enquiry. There is no captcha, and none of it needs a cookie.

Where an enquiry goes and who reads it

1. It is saved to the site database, in a table of enquiries, on the server hosting this website. That record is the copy of truth.
2. A copy is emailed to the office through the mail facility built into the web server, carrying your name, email, phone number if you gave one, the property reference and your message as written.

Only the firm’s staff read it, through the admin area or the office mailbox. Where an enquiry becomes a transaction, the firm’s legal partner may be given the correspondence relating to it. No advertiser or contact-list trader ever receives it.

Hosting. The site and its database sit on a shared cPanel account under a United States and Nigeria arrangement, so your enquiry is stored on that hosting server, under the host’s controls rather than a Nigerian data centre’s. If the firm changes host, appoints a processor, or begins keeping enquiry data outside Nigeria, this section should be rewritten to name that processor and the location of the data before the change takes effect.

Google, and the requests your browser makes on our pages

The Contact page shows the head office on a map by embedding a Google Maps frame. When it loads, your browser contacts Google directly and Google receives your IP address with the usual request details. Every page also takes its webfonts from Google Fonts, which is the same kind of request with the same consequence. Neither sets a cookie through us and neither is used by us to profile you, but Google’s handling of a request your browser makes to Google is governed by Google’s own privacy policy, which we cannot speak for.

What this site does not do

• No cookies are set by the forms or by any public page.
• No analytics or visitor-measurement service is loaded anywhere.
• No advertising, retargeting or social media tracking scripts are loaded.
• No payment or card data is collected, and none is processed.
• No enquiry is sold, rented or exchanged.

The admin area staff use to manage listings does rely on a session cookie to know that a logged-in person is still present. Visitors never reach it.

How long we keep an enquiry

By default an enquiry is kept indefinitely. That is a choice rather than carelessness: somebody who asks about a plot one year may be ready to buy it the next, land disputes surface years after a sale, and a dated record of who asked about what protects you and us. Where an enquiry leads to a transaction, the records connected with it are kept for as long as that transaction and any legal obligation require. Ask, and we will delete yours sooner, though deletion ends our ability to follow it up.

Security, and its honest limits

The site is served over HTTPS, so details travel to our server encrypted with TLS; the form writes to the database using parameterised statements, the standard defence against the commonest attack on a public form; and the enquiry list sits behind a login limited to staff.

Shared hosting is not a bank vault and email is not a secure channel, so please do not send scanned identity documents, bank details or title documents through the website form. When a transaction needs those, a consultant will arrange a proper channel with you. If a breach affecting your data occurs we will tell you and the Nigeria Data Protection Commission without undue delay, as the Act requires.

Your rights under the Nigeria Data Protection Act 2023

In respect of the enquiry record we hold about you, you may ask us to:

• Access — confirm what we hold and give you a copy.
• Correct — fix a wrong name, email address, phone number or message.
• Delete — remove your enquiry and the record of it.
• Object — stop us processing it further, including follow-up contact.

Where we rely on your consent you may withdraw it, without affecting the lawfulness of earlier processing. Requests are usually free of charge. Write to cityofgoldestate@gmail.com with data request in the subject line and the address you used on the form; we may need to satisfy ourselves that the request is genuinely yours, and we aim to answer within one month. A request may be limited where a record is needed for a live transaction or a legal obligation, and we will say when and why.

Children

This site is not aimed at anyone under eighteen and we do not knowingly collect personal information from children. A minor should not submit the enquiry form; the parent, guardian or adult who will actually hold the interest in the property should. If a child’s details reach us through a form, tell us and we will remove them.

Changes to this policy

We may update this page as the site or the law changes. The date at the top is the version you are reading, and it is current the moment it is published here. If we begin collecting anything not described above, that description will appear first.

If you want to complain

Tell us first, at cityofgoldestate@gmail.com or 08181869458 during office hours: most privacy complaints on a site this size are a wrong record or a forgotten follow-up. If you are dissatisfied with our answer, or would rather not come to us at all, you may complain to the Nigeria Data Protection Commission (NDPC), the regulator under the Act, through its published contact channels. That does not affect any other remedy you have.

How to reach us

Data protection enquiries go to the same address as everything else: cityofgoldestate@gmail.com or 08181869458. Both offices are staffed Monday to Saturday, and the person who answers can open the enquiry record.

This policy describes what the code of this website really does, but it is a starting point rather than a legal opinion. It should be reviewed by a Nigerian legal practitioner, and checked against the firm’s actual hosting and email arrangements, before the site is relied on commercially.