PRIVACY POLICY
For the Plinths and Pitches website, mobile application, customer portal, property enquiries, transactions and related services
Version 1.0
| Website / app name | https://plinthsandpitches.com | Plinths and Pitches |
|---|---|
| Company registration number | RC 1916544 |
| Registered office | 4/6 Ajose Adeogun Street, Victoria Island, Lagos, Nigeria |
| Privacy contact | office@plinthsandpitches.com | +234 907 996 444 |
| YOUR PRIVACY AT A GLANCE Plinths and Pitches Investment Limited is responsible for deciding how and why personal data covered by this Policy is processed, except where another organisation independently determines its own processing. We collect only personal data reasonably required to respond to enquiries, operate accounts and digital services, complete property transactions, process payments, meet legal and compliance obligations, protect our systems and communicate with you. Card, transfer and direct-debit transactions are processed through Sterling Bank Plc and relevant payment networks or service providers. Never send Plinths and Pitches your card PIN, CVV, one-time password, online-banking password or other secret authentication credential. We do not sell personal data as a commodity. We disclose it only for legitimate service, transaction, security, professional, regulatory or legal purposes described in this Policy. You may have rights to access, correct, delete, restrict, object, withdraw consent, request portability and challenge certain automated decisions, subject to applicable law and lawful exceptions. |
|---|
This Policy should be read with the Terms of Use, any property-specific agreement, cookie controls, forms and other privacy notices shown at the point personal data is collected. A more specific notice applies to the particular processing it describes. Separately branded products or services may publish their own privacy notices.
CONTENTS
Introduction and Scope
Who We Are and Our Role
Definitions
Data-Protection Principles
Personal Data We Collect
How We Collect Personal Data
Why We Use Personal Data and Our Lawful Bases
Identity Verification, Compliance and Sensitive Data
Payment and Banking Information
Cookies, Device Data and Similar Technologies
Marketing and Communications
When We Share Personal Data
International Data Transfers
Data Retention
Security and Personal-Data Breaches
Your Data-Protection Rights
Exercising Your Rights
Automated Processing and Profiling
Children
Property Visits, CCTV and Physical Security
Third-Party Links and Social Platforms
Changes to This Policy
Questions, Complaints and Contact Details Schedule 1 - Retention Framework
Schedule 2 - Cookie and Tracking Categories
INTRODUCTION AND SCOPE
This Privacy Policy explains how Plinths and Pitches Investment Limited ("Plinths and Pitches", "we", "us" or "our") collects, uses, stores, discloses, transfers, protects and otherwise processes personal data.
It applies when you visit or use our website, mobile application, customer portal or related digital services; make an enquiry; create an account; request or purchase a property; make or receive a payment; visit our office or project locations; communicate with us; participate in a promotion or event; apply for a role; supply services to us; or otherwise interact with Plinths and Pitches.
It applies to customers, prospective customers, website and app users, property visitors, authorised representatives, guarantors or co-purchasers, beneficiaries, vendors, contractors, professional contacts and job applicants. Employees and workers may receive a separate internal privacy notice.
This Policy is designed to comply with the Nigeria Data Protection Act 2023, applicable regulations and directives issued by the Nigeria Data Protection Commission, and other applicable Nigerian laws. Where another law requires additional or different processing, that law will apply.
WHO WE ARE AND OUR ROLE
Plinths and Pitches Investment Limited is a Nigerian company with RC 1916544 and registered office at 4/6 Ajose Adeogun Street, Victoria Island, Lagos, Nigeria.
For most processing described in this Policy, Plinths and Pitches is the data controller because it determines the purposes and means of processing. Some service providers process personal data only on Plinths and Pitches' documented instructions. Other recipients, including banks, payment networks, regulators, land registries and professional advisers, may independently determine how they process data under their own legal duties and privacy notices.
Plinths and Pitches offers and sells its own properties. This Policy does not automatically apply to a separately branded product, third-party website or third-party service that displays a different privacy notice.
DEFINITIONS
| Term Meaning |
|---|
| all laws, regulations, regulatory requirements, binding Applicable Law directives and court orders applicable to the processing of personal data. |
| a freely given, specific, informed and unambiguous Consent indication of a person's wishes by a clear affirmative action, where consent is the applicable lawful basis. |
| Data Controller a person or organisation that determines the purposes and means of processing personal data. |
| Data Processor a person or organisation that processes personal data on behalf of a data controller. |
| Data Subject the identified or identifiable individual to whom personal data relates. |
| Personal Data information relating to an identified or identifiable individual, whether directly or indirectly. |
| Term | Meaning |
|---|---|
| Processing | any operation performed on personal data, including collection, recording, organisation, storage, alteration, retrieval, use, disclosure, transfer, restriction, deletion or destruction. |
| Sensitive Personal Data | personal data that receives enhanced legal protection, including information concerning health, biometric or genetic characteristics, racial or ethnic origin, religious or similar beliefs, political opinions, trade-union membership, sexual life or orientation, and other categories protected by law. |
DATA-PROTECTION PRINCIPLES
Plinths and Pitches will process personal data in accordance with the following principles:
lawfulness, fairness and transparency;
collection for specified, explicit and legitimate purposes and no incompatible further use;
data minimisation, so that data is adequate, relevant and limited to what is necessary;
accuracy and reasonable steps to correct or delete inaccurate data;
storage limitation, supported by documented retention criteria;
integrity, confidentiality and security appropriate to the risk; and
accountability, including policies, records, staff controls, vendor oversight and impact assessments where required.
PERSONAL DATA WE COLLECT
The categories collected depend on your relationship with Plinths and Pitches, the service requested and legal requirements. We may collect the following:
| Category Examples |
|---|
| Name, title, gender where relevant, date of birth, Identity and profile data nationality, photograph, signature, occupation, employer, customer number and account profile. |
| Residential or business address, email address, telephone Contact data number, emergency or authorised-contact details and communication preferences. |
| Username, encrypted or hashed password, Account and authentication data one-time-password events, login history, security questions, account settings and access permissions. |
| Enquiries, preferred property, reservation or allocation details, offer letters, contracts, instalment plans, invoices, Property and transaction data receipts, ownership or beneficiary details, inspection records, handover records, service requests and transaction history. |
| Category Examples |
|---|
| Bank name, account name and number where necessary, payment references, direct-debit mandate information, Financial and payment data payment status, amount, date and source-of-funds information. Complete card credentials are generally handled by the bank or authorised payment provider rather than stored by Plinths and Pitches. |
| Government-issued identification, NIN or other identifier where lawfully required, passport or driver's-licence Identity-verification and compliance data details, proof of address, tax information, beneficial-ownership information, sanctions or politically exposed person screening results and other records required for fraud prevention or legal compliance. |
| IP address, device identifiers, browser and Technical and usage data operating-system information, app version, cookie or SDK identifiers, log files, page views, clickstream, crash data, approximate location and security events. |
| Emails, letters, contact-form submissions, telephone-call Communications and support data logs, complaints, feedback, survey responses and records of customer-support interactions. Calls are not recorded unless a separate notice is given before recording. |
| Consent records, subscription status, campaign Marketing data engagement, referral source, event attendance and preferences concerning promotional communications. |
| Appointment details, visitor logs, access-control Visit, image and access data information, images or video from CCTV where installed and clearly signposted, and photographs supplied for transaction or event purposes. |
| Business-contact details, service records, qualifications, Vendor, professional and recruitment data work history, references, bank and tax details, background information where lawful, and information necessary to manage commercial or recruitment relationships. |
We do not intentionally collect personal data that is unnecessary for the stated purpose. Please do not provide secret banking credentials or sensitive personal data unless Plinths and Pitches has specifically requested it through an authorised channel and explained why it is required.
HOW WE COLLECT PERSONAL DATA
We collect personal data through the following sources:
directly from you through forms, accounts, contracts, correspondence, calls, inspections, payments, applications and in-person interactions;
from a person authorised to act for you, a co-purchaser, employer, referee, beneficiary, representative or other person who lawfully provides your data;
automatically from the website, app, portal, security systems, cookies, software-development kits, log files and similar technologies;
from Sterling Bank Plc, payment networks, direct-debit operators and authorised payment or banking service providers;
from identity-verification, fraud-prevention, sanctions-screening and compliance service providers;
from public registers, government agencies, land registries, courts and other lawful public sources; and
from vendors, professional advisers, referral partners, event organisers and other organisations where disclosure is lawful.
Where you provide personal data about another individual, you must have lawful authority to do so and should ensure that the person receives this Policy or another appropriate privacy notice, unless an exception applies.
WHY WE USE PERSONAL DATA AND OUR LAWFUL BASES
We process personal data only where at least one lawful basis applies. More than one basis may apply to the same activity. The principal purposes and bases are set out below.
| Purpose How the data is used Principal lawful basis |
|---|
| Respond to enquiries and arrange To provide requested information, Steps before a contract; legitimate inspections schedule visits and take steps requested interests in managing enquiries and before a contract. sales operations. |
| To register users, authenticate access, Contract; legitimate interests in Create and secure accounts manage permissions, recover accounts operating secure services. and prevent unauthorised use. |
| To prepare offers and agreements, Reserve, allocate, sell and manage administer payments and instalments, Contract; steps before a contract; legal properties communicate project information, obligation; legitimate interests in complete handover and manage administering transactions. post-sale obligations. |
| To perform KYC, anti-money-laundering, Legal obligation; legitimate interests in Verify identity and comply with law sanctions, fraud, beneficial-ownership, preventing crime and protecting Plinths tax, accounting, regulatory and and Pitches and customers; public recordkeeping checks. interest where applicable. |
| To initiate or confirm card, transfer and Contract; legal obligation; legitimate Process and reconcile payments direct-debit transactions, issue receipts, interests in financial control and fraud reconcile accounts and address failed, prevention. reversed or disputed payments. |
| To answer requests, resolve complaints, Contract; legal obligation; legitimate Provide customer service maintain service records and improve interests in service management. support quality. |
| To host services, diagnose faults, Legitimate interests in reliable and Operate, protect and improve the maintain availability, analyse usage, secure operations; consent for platform prevent abuse, conduct testing and non-essential cookies or tracking where improve functionality. required. |
| To provide transaction notices, security Send service and legal communications alerts, policy notices, account messages Contract; legal obligation; legitimate and information required by law or interests. contract. |
| To send property offers, events, news Consent where required; legitimate Send marketing communications and promotions and measure interests where permitted, subject to a engagement. clear right to object or unsubscribe. |
| Purpose How the data is used Principal lawful basis |
|---|
| To control access, maintain visitor Legitimate interests; legal obligation; Manage physical security and visits records, protect people and property and vital interests where necessary. investigate incidents. |
| Manage vendors and professional To onboard, contract, pay, communicate Contract; steps before a contract; legal relationships with and monitor service providers and obligation; legitimate interests. professional contacts. |
| To evaluate applications, conduct Steps before a contract; legitimate Recruit personnel interviews, verify references and meet interests; legal obligation; consent recruitment obligations. where specifically required. |
| Establish, exercise or defend legal To preserve evidence, obtain legal Legal obligation; legitimate interests; claims advice, manage disputes, respond to establishment, exercise or defence of authorities and enforce rights. legal claims. |
| To conduct restructuring, financing, Business continuity or corporate investment, merger, acquisition or Legitimate interests; legal obligation; transactions asset-transfer activities subject to contract where applicable. confidentiality and legal safeguards. |
Where Plinths and Pitches relies on legitimate interests, we consider the purpose, necessity and likely effect on individuals and implement safeguards. You may object to processing based on legitimate interests, although Plinths and Pitches may continue where it demonstrates compelling lawful grounds or the processing is required for legal claims.
Where consent is used, you may withdraw it at any time without affecting processing already carried out lawfully before withdrawal. Withdrawal may prevent Plinths and Pitches from providing an optional feature but will not affect processing supported by another lawful basis.
IDENTITY VERIFICATION, COMPLIANCE AND SENSITIVE DATA
Property transactions can require identity, beneficial-ownership, source-of-funds, sanctions, fraud and other compliance checks. Plinths and Pitches may request documents or information reasonably necessary to meet legal duties, protect customers, verify payment legitimacy or respond to regulatory requirements.
Plinths and Pitches may use authorised verification or screening providers. A match or risk alert will not automatically establish wrongdoing. Where a material decision is based on an alert, Plinths and Pitches will review relevant information and may request clarification or additional documents.
Plinths and Pitches does not seek sensitive personal data unless it is necessary and a lawful condition applies. Where such data is processed, access will be restricted and additional safeguards will be applied. Information that is voluntarily supplied but not relevant may be deleted or excluded from decision-making.
Plinths and Pitches may refuse, pause or restrict a service where required information is not supplied, cannot be verified, appears inconsistent, or where processing is prohibited or restricted by law. This will be handled under the applicable agreement and law.
PAYMENT AND BANKING INFORMATION
Plinths and Pitches accepts card, bank-transfer and direct-debit payments processed through Sterling Bank Plc and any authorised payment infrastructure used for the transaction. Those organisations may process personal data under their own regulatory duties and privacy notices.
Depending on the payment method, Plinths and Pitches may receive the payer name, masked account or card information, bank name, amount, currency, payment reference, transaction status, mandate status and fraud or reconciliation indicators. Where the payment interface is hosted by the bank or authorised provider, complete card details are generally submitted directly to that provider.
| PAYMENT SECURITY WARNING Plinths and Pitches will not ask you to disclose your card PIN, CVV, one-time password, online-banking password or complete secret authentication details by email, telephone, text message or an unofficial channel. A request to change payment instructions should be independently verified using the contact details published on Plinths and Pitches' official website or in your signed transaction documents. Report suspicious payment instructions immediately. |
|---|
Plinths and Pitches may retain transaction and reconciliation records even where a payment fails, is reversed or is disputed, where necessary for accounting, security, legal claims, regulatory compliance or fraud prevention.
COOKIES, DEVICE DATA AND SIMILAR TECHNOLOGIES
The website, app and portal may use cookies, local storage, pixels, tags, software-development kits and similar technologies. These tools can remember settings, maintain sessions, secure accounts, diagnose faults, measure usage and, where selected, support personalised communications or advertising.
Strictly necessary technologies may operate without consent where they are required to deliver a service requested by you or protect the platform. Non-essential technologies will be used according to your choices and applicable law. You may change available preferences through the cookie banner, settings menu, device permissions or browser controls.
Blocking certain technologies may cause parts of the platform to function incorrectly. Browser or device-level signals are not always recognised as a legally valid objection in every context; use Plinths and Pitches' available privacy controls or contact us where you require assistance.
Additional information appears in Schedule 2 and may also be displayed in a cookie-management panel, including the provider, purpose and duration of specific technologies in use.
MARKETING AND COMMUNICATIONS
Plinths and Pitches may send service communications that are necessary for an account, enquiry or transaction. These are not promotional and may continue while the relevant relationship exists.
Promotional email, SMS, push notification or telephone communications will be sent only where lawful. You may unsubscribe using the link or instruction provided, change your account preferences, or contact Plinths and Pitches. Opting out of marketing does not stop essential service, security, contractual or legal notices.
Plinths and Pitches may keep a limited suppression record after an opt-out so that the preference is respected. Plinths and Pitches does not sell marketing lists or personal data as a commodity.
WHEN WE SHARE PERSONAL DATA
Plinths and Pitches may disclose personal data to the following recipients where necessary, proportionate and lawful:
| Recipient category Examples and purpose |
|---|
| Sterling Bank Plc, card networks, direct-debit operators, Banks and payment participants settlement institutions and authorised payment-service providers. |
| Cloud hosting, software, customer-management, Technology and security providers messaging, identity, cybersecurity, backup, analytics and technical-support providers. |
| Lawyers, surveyors, architects, engineers, valuers, insurers, Property and professional service providers contractors, estate or facility managers, auditors, accountants and other advisers involved in a property or service. |
| Land registries, tax authorities, law-enforcement bodies, Government and regulatory bodies courts, tribunals, the Nigeria Data Protection Commission and other authorities where disclosure is required or permitted. |
| Potential or actual lenders, investors, purchasers, Corporate transaction recipients successors and advisers in connection with a financing, restructuring, merger, acquisition or transfer, subject to appropriate confidentiality and lawful safeguards. |
| A person you direct us to disclose to, your verified Other authorised recipients representative, co-purchaser, beneficiary, guarantor or another recipient supported by consent, contract or law. |
Service providers acting as processors are expected to process data only for authorised purposes, apply appropriate security, maintain confidentiality, assist with rights and incidents where relevant, and delete or return data as required by contract and law.
Plinths and Pitches may disclose information without prior notice where legally required, necessary to protect vital interests, required for security or fraud investigations, or otherwise permitted by law. We will assess the request and limit the disclosure where reasonably possible.
INTERNATIONAL DATA TRANSFERS
Some technology, cloud, communications or professional service providers may process data outside Nigeria. Plinths and Pitches will not transfer personal data internationally unless a lawful transfer mechanism or exception applies and the transfer is supported by safeguards appropriate to the risk.
Safeguards may include a legally recognised adequacy basis, contractual protections, binding organisational rules, specific consent where permitted, or a transfer necessary for a contract, legal claim, public interest or another lawful exception.
Plinths and Pitches will consider the destination, recipient, data type, purpose, security measures, onward transfers and enforceability of rights. You may request information about the applicable safeguard, subject to confidentiality and legal restrictions.
DATA RETENTION
Plinths and Pitches keeps personal data only for as long as reasonably necessary for the purpose for which it was collected, including to complete and administer property transactions, maintain title and allocation records, meet statutory recordkeeping duties, resolve complaints, prevent fraud and establish, exercise or defend legal claims.
Retention decisions consider the nature and sensitivity of the data, the transaction or relationship, the risk of harm, contractual requirements, applicable limitation periods, legal and regulatory obligations, and whether the purpose can be achieved through anonymisation.
Property ownership, allocation, title, payment and compliance records may require longer retention than ordinary enquiries because they evidence continuing rights, obligations and regulatory history. When data is no longer required, Plinths and Pitches will securely delete, destroy or irreversibly anonymise it, unless lawful archival retention applies.
Schedule 1 provides the retention framework. Operational retention periods may be further specified in Plinths and Pitches' internal retention schedule or a transaction-specific notice.
SECURITY AND PERSONAL-DATA BREACHES
Plinths and Pitches applies technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration, disclosure or access. Measures are selected according to the nature of the data, processing context, available technology, implementation cost and risk to individuals.
access controls, role-based permissions and account-authentication measures;
encryption in transit and, where appropriate, at rest;
logging, monitoring, malware protection, backups and recovery procedures;
secure development, configuration, patching and vulnerability management;
confidentiality obligations, staff awareness and incident-response procedures;
service-provider assessment and contractual security requirements; and
periodic reviews, testing and impact assessments where the processing is likely to present high risk.
No internet transmission or storage system is completely secure. Plinths and Pitches does not guarantee absolute security, but will maintain measures appropriate to the risk and respond to suspected incidents in accordance with law.
Where a personal-data breach occurs, Plinths and Pitches will investigate, contain and remediate it; document the incident; notify the Nigeria Data Protection Commission where required; and notify affected individuals where the law requires or where notice is otherwise appropriate.
You are responsible for keeping account credentials confidential, using a strong unique password, protecting your device and promptly reporting suspected account compromise or unauthorised activity.
YOUR DATA-PROTECTION RIGHTS
Subject to Applicable Law, lawful exceptions and the circumstances of the processing, you may have the following rights:
| Right What it may allow you to do |
|---|
| Be informed Receive clear information about the collection and use of your personal data. |
| Right What it may allow you to do |
|---|
| Access Ask whether Plinths and Pitches processes your personal data and request a copy and related information. |
| Rectification Ask Plinths and Pitches to correct inaccurate data and complete incomplete data. |
| Deletion Ask Plinths and Pitches to delete personal data where there is no lawful reason to continue processing it. |
| Restriction Ask Plinths and Pitches to limit processing in qualifying circumstances. |
| Object Object to processing based on legitimate interests or public interest, and object at any time to direct marketing. |
| Withdraw consent Withdraw consent where consent is the basis, without affecting earlier lawful processing. |
| Receive qualifying data in a structured, commonly used and Data portability machine-readable format or request transfer where technically feasible. |
| Obtain safeguards, information and human review in Automated decisions relation to qualifying decisions based solely on automated processing. |
| Complaint Lodge a complaint with Plinths and Pitches and with the Nigeria Data Protection Commission. |
These rights are not absolute. Plinths and Pitches may retain or continue processing data where required by law, necessary for legal claims, required to protect another person, covered by a lawful exemption, or otherwise permitted. Where a request cannot be fulfilled in full, Plinths and Pitches will explain the applicable reason to the extent legally permitted.
EXERCISING YOUR RIGHTS
Submit a request to [Privacy email address] or use the contact details in Clause 23. Clearly describe the right you wish to exercise and the data or interaction concerned.
Plinths and Pitches may request information reasonably necessary to confirm your identity and prevent unauthorised disclosure. An authorised representative may act for you where satisfactory authority and identity evidence are provided.
Plinths and Pitches will respond within the period required by Applicable Law. Requests are ordinarily handled without charge, but Plinths and Pitches may charge a lawful reasonable fee or refuse to act where a request is manifestly unfounded, excessive or repetitive, after providing the explanation required by law.
A rights request will not be treated as a reason to deny service or retaliate against you. However, deletion, restriction or withdrawal may affect a service where the relevant information is objectively necessary to provide it or comply with law.
AUTOMATED PROCESSING AND PROFILING
Plinths and Pitches may use automated rules, analytics or security tools to detect unusual activity, prioritise enquiries, personalise content, measure engagement or flag transactions for review.
Plinths and Pitches does not intend to make a decision producing legal or similarly significant effects solely by automated processing without an applicable lawful basis and required safeguards. Material transaction, compliance or account decisions flagged by automated tools will be subject to authorised human review where required.
Where a qualifying automated decision is used, you may request information about the decision, express your view, contest it and request human intervention, subject to legal exceptions.
CHILDREN
Plinths and Pitches' customer platform and property transaction services are intended for persons aged 18 years or older. We do not knowingly permit a child to enter a property transaction through the platform in the child's own capacity.
Where information about a child is necessary for a lawful beneficiary, family, succession or similar arrangement, Plinths and Pitches will seek appropriate authority from a parent, guardian or legally authorised person and apply safeguards required by law.
If you believe a child has provided personal data without proper authority, contact Plinths and Pitches so the matter can be reviewed and appropriate action taken.
PROPERTY VISITS, CCTV AND PHYSICAL SECURITY
Plinths and Pitches may collect appointment details, visitor records and access information when you attend an office, event, inspection, construction site or property location. This supports safety, access control, customer service, incident management and legal compliance.
CCTV may be used at locations where appropriate and will be indicated by signage or another notice. CCTV recordings will be accessed only by authorised persons and retained according to the incident, security need and retention schedule.
Photography or video at public or promotional events may be governed by event signage, a release or another notice. Where consent is the appropriate basis, a reasonable method to decline or withdraw will be provided.
THIRD-PARTY LINKS AND SOCIAL PLATFORMS
The platform may link to third-party websites, maps, social platforms, payment pages or applications. Plinths and Pitches does not control the independent processing of those services. Review their privacy notices before providing personal data.
Social-media interactions may be visible to the platform operator and other users. Information posted publicly should not include confidential transaction documents, identification documents, payment credentials or other sensitive information.
CHANGES TO THIS POLICY
Plinths and Pitches may revise this Policy to reflect changes in services, technology, legal requirements or processing practices. The current version will be published on the official platform and identified by its version number.
Where a change materially affects your rights or how personal data is used, Plinths and Pitches will provide an appropriate notice through the platform, account, email or another suitable channel before or when the change takes effect, as required by law.
Continued use of a service does not replace consent where Applicable Law requires a new consent. Processing will remain subject to the lawful basis and transparency requirements applicable to it.
QUESTIONS, COMPLAINTS AND CONTACT DETAILS
For questions, rights requests, complaints or concerns about this Policy or Plinths and Pitches' processing of personal data, contact:
| Data controller | Plinths and Pitches Investment Limited |
|---|---|
| [Privacy email address] | |
| Telephone | +234 907 996 444 |
| Address | 4/6 Ajose Adeogun Street, Victoria Island, Lagos, Nigeria |
Plinths and Pitches will investigate privacy complaints and seek to resolve them fairly. You also have the right to lodge a complaint with the Nigeria Data Protection Commission through its official complaint channels. Nothing in this Policy limits a non-waivable regulatory or judicial remedy available under Applicable Law.
SCHEDULE 1 - RETENTION FRAMEWORK
The following framework states the principal retention criteria. A record may be retained for a shorter or longer period where required by law, a regulator, a legal hold, an active dispute, security needs or the continuing nature of property rights and obligations.
| Record category | Retention criterion |
|---|---|
| Enquiries and prospect records | For the active enquiry and a reasonable follow-up period, then deletion or minimisation unless a transaction begins, consent supports continued marketing, or a legal reason requires retention. |
| Account and authentication records | While the account is active and for a reasonable period after closure to secure the service, resolve disputes and meet legal obligations. |
| Property transaction, allocation and title records | For the duration of the transaction and ownership or project relationship, and afterwards for the period required to evidence rights, obligations, title history, accounting and legal claims. |
| KYC, compliance and fraud-prevention records | For the statutory minimum period and any longer period required for an investigation, regulatory request, legal claim or continuing risk. |
| Record category | Retention criterion |
|---|---|
| Payment, invoice and accounting records | For statutory accounting, tax, audit, reconciliation, anti-fraud and legal-claim periods. |
| Complaints and support records | Until the matter is resolved and for the period needed to evidence the response, identify recurring issues and manage legal claims. |
| Marketing records | While marketing is active. A limited suppression record may be retained to honour an opt-out or objection. |
| Technical, security and audit logs | For the period reasonably necessary to secure services, investigate incidents, maintain auditability and meet legal obligations. |
| CCTV and visitor records | For a short security period unless footage or records are required for an incident, investigation, legal claim or regulatory purpose. |
| Recruitment records | For the recruitment exercise and a reasonable period afterwards, or longer with consent for future opportunities or where required by law. |
SCHEDULE 2 - COOKIE AND TRACKING CATEGORIES
The exact technologies in use should be listed in Plinths and Pitches' cookie-management panel. The categories below describe the purposes that may apply.
| Category | Typical purpose | Control |
|---|---|---|
| Strictly necessary | Authentication, session management, transaction flow, load balancing, security, fraud prevention, consent records and core platform functions. | Normally active because required to provide the requested service or protect the platform. |
| Preferences and functionality | Language, display, saved settings, remembered choices and enhanced features. | Used according to available consent or preference controls where required. |
| Analytics and performance | Audience measurement, page or feature usage, error diagnosis, performance and service improvement. | Used with consent where required, or another lawful basis where legally permitted and appropriately safeguarded. |
| Communications and campaign measurement | Measuring whether messages or campaigns are opened, clicked or lead to an enquiry. | Used according to consent and marketing preferences where required. |
| Advertising or personalisation | Selecting or measuring tailored content or advertising, if Plinths and Pitches deploys such technology. | Not used unless the required notice, choice and lawful basis are in place. |
| Mobile app permissions | Camera, photo library, notifications, location or storage, where a feature requires device access. | Controlled through the app prompt and device settings; permission can usually be withdrawn through the device. |
END OF PRIVACY POLICY