Privacy Policy · Gbanjo

This Privacy Policy explains how Griid Network LTD, trading as Gbanjo ("Gbanjo", "we", "us", or "our"), collects, uses, shares, stores, and protects personal data when you use the Gbanjo mobile applications, public website, auction pages, support channels, and related services.

Our registered address is 7 Ibiyinka Olorunbe, Victoria Island, Lagos.

For privacy questions or requests, contact privacy@gbanjo.auction.

This Policy is intended to be read together with the Gbanjo Terms of Service and, for sellers, the Seller Terms.

1. Scope

This Policy applies to personal data we process in connection with:

Gbanjo accounts;
public and private auctions;
listings;
bids and bid deposits;
purchase payments;
seller payouts;
public seller profiles;
private listing inquiries and seller replies;
transaction chat;
pickup, delivery, handoff, and completion states;
disputes and reports;
customer support;
Gbanjo's public website and app acquisition flows.

It does not govern a third party's independent processing where that third party acts under its own privacy policy.

2. Who controls your data

For the processing described in this Policy, Griid Network LTD is generally the data controller because we determine why and how personal data is processed for Gbanjo.

Some providers, such as payment or identity-verification providers, may also act as independent controllers for some processing they perform under law or their own terms.

3. Personal data we collect

3.1 Account and identity data

We may collect:

full name;
display name;
username;
email address;
phone number;
profile photo;
date of birth or age confirmation;
account identifiers;
verification status;
identity-verification information where required;
records showing acceptance of Terms, Seller Terms, or other policies.

3.2 Seller and listing data

We may collect:

listing title and description;
photos and videos;
category and item type;
condition;
known defects;
included items;
approximate item location;
seller-selected pickup or seller-delivery options;
seller representations;
category-specific information.

Depending on the item, category-specific data may include:

vehicle VIN/chassis or document information;
phone serial/IMEI;
watch or jewellery papers;
artwork provenance information;
machinery serial numbers or documentation;
ticket references, transfer information, or seller proof.

Some of this information may be classified as private and not shown publicly.

3.3 Auction and bidding data

We may collect:

bids;
bid timestamps;
current and historical bid status;
auction-watch activity;
bidder eligibility state;
deposit amount;
deposit status;
top-up requirements;
winner status;
auction extensions;
reserve-met status;
auction participation records.

Public bid history is anonymized or pseudonymized where shown publicly.

3.4 Payment and payout data

We may collect or receive:

payment amount;
transaction reference;
payment status;
deposit payments;
purchase balance;
refund status;
payout amount;
payout status;
seller payout destination metadata;
limited payment-method metadata made available by our payment provider.

Full card or bank authentication details may be collected directly by the payment service provider rather than Gbanjo.

3.5 Contact and transaction-chat data

Before the winning buyer completes the required purchase payment, private seller contact information and transaction chat remain locked.

After the winning buyer's purchase payment is confirmed, we may:

disclose the seller's approved contact details to the paid winning buyer;
enable private transaction chat between the winning buyer and seller;
process messages, attachments, and transaction coordination information.

We process this information to help the parties arrange pickup, seller delivery, inspection, transfer, or handoff and to support disputes or safety investigations.

3.6 Handoff and transaction-completion data

We may collect:

seller delivery / pickup method;
approximate meeting or delivery location;
seller handoff confirmations;
buyer receipt confirmations;
completion timestamps;
dispute status;
refund or payout result.

Gbanjo does not require a logistics-provider integration to process these transaction states.

3.7 Tickets and events

For event tickets, we may collect:

event name;
organizer/performer/team;
venue;
city;
event date and time;
ticket type;
quantity;
section, row, or seat where relevant;
ticket format;
transfer method;
transfer deadline;
transfer restrictions;
seller proof or ticket reference where required.

Usable ticket QR codes, barcodes, or access credentials should not be displayed publicly.

3.8 Reports, disputes, reviews, and support

We may collect:

dispute reason;
reports;
photographs, videos, PDFs, or other evidence;
user statements;
support communications;
review and rating content;
internal case notes;
fraud and safety investigation records.

3.9 Device, usage, and technical data

We may collect:

IP address;
device type;
operating system;
app version;
browser;
language;
time zone;
device identifiers where permitted;
session information;
crash logs;
security logs;
approximate location derived from IP or user-provided location;
page and feature interactions.

3.10 Cookies and similar technologies

Our public website may use:

necessary cookies for security, session management, network stability, and core functionality;
Google Analytics cookies, when you allow analytics, plus limited cookieless measurements with storage denied for aggregate reporting and modelling;
preference cookies;
LinkedIn Insight Tag cookies for advertising measurement and campaign audience insights, when you separately allow marketing measurement.

Where consent is required, non-essential cookies will not be used until you choose to accept them.

3.11 Mobile app analytics and install attribution

Mobile app measurement may include app-installation, session, and randomly generated event identifiers; app and device technical information; sign-up, listing, auction, and purchase activity; and campaign, ad creative, referral, or supported deep-link information. Campaign information may be unavailable for some installations, including where platform privacy limits apply.

We disable Apple IDFA and Android advertising-ID collection in the mobile analytics and attribution integrations described here. We do not send names, email addresses, phone numbers, account identifiers, messages, payment credentials, or listing descriptions through these integrations. Auction and order identifiers may be used to measure item interactions and completed transactions.

4. How we use personal data

We use personal data to:

Provide the marketplace

create and secure accounts;
display public seller profiles;
publish and manage listings;
operate auctions;
accept bids;
determine winners;
manage deposits and top-ups;
process payments and refunds;
control seller payout;
operate protected payment.

Complete transactions

unlock seller contact information after the required purchase payment;
enable transaction chat;
record pickup, seller delivery, handoff, or ticket transfer;
confirm transaction completion;
resolve transaction problems.

Maintain trust and safety

verify identity where required;
detect suspicious activity;
prevent auction manipulation;
detect fraud or account abuse;
investigate reports;
moderate prohibited listings;
enforce marketplace rules.

Improve and operate Gbanjo

troubleshoot;
monitor performance;
understand feature usage;
improve search and discovery;
maintain security;
produce aggregated analytics.

Gbanjo currently does not use an AI listing-recognition or AI category-suggestion feature as part of the seller flow.

Communicate with you

send transaction notifications;
send bid/outbid/win notifications;
send payment, refund, handoff, dispute, and payout notifications;
respond to support;
provide policy or security notices.

Marketing

Where permitted and where any required consent has been obtained, we may send marketing about Gbanjo.

You can opt out of direct marketing at any time.

5. Lawful bases

Depending on the processing, we rely on one or more lawful bases recognized under applicable data-protection law, including:

Contract

Processing necessary to:

create and operate your account;
process auctions and bids;
process deposits and purchase payments;
unlock transaction contact/chat;
complete transactions;
process seller payouts.

Legal obligation

Processing necessary to comply with:

applicable law;
lawful regulatory requests;
tax, accounting, payment, fraud-prevention, or recordkeeping obligations.

Legitimate interests

Where permitted, processing necessary for interests such as:

fraud prevention;
service security;
dispute investigation;
platform integrity;
preventing auction manipulation;
improving the Service;
defending legal claims.

We balance these interests against your rights and expectations.

Consent

Where required, we rely on consent for:

non-essential cookies;
direct marketing;
certain optional personal-data processing;
other processing for which applicable law requires consent.

You may withdraw consent where processing is based on consent.

6. Public information

Some Gbanjo information is intentionally public.

Depending on your activity, public information may include:

display name;
profile photo;
verification badge/status;
rating;
completed-sales count;
public reviews;
approximate location;
public listings;
listing photos and videos;
listing descriptions;
public auction state;
anonymized or pseudonymized bid activity.

Public auction pages may be shared outside Gbanjo.

Public pages may also be indexed by search engines unless the page is configured as unlisted or private.

Do not include private information in listing descriptions if you do not want it to become public. Listing inquiries and seller replies are limited to the buyer who asked, the seller, and authorized Gbanjo personnel where needed for safety, support, or moderation.

7. Unlisted and invite-only auctions

Unlisted auctions

Unlisted auctions are excluded from normal Gbanjo discovery but may be accessible to anyone who has the link, subject to applicable access controls.

Invite-only auctions

Invite-only auctions are restricted to authorized participants.

Unauthorized visitors should not receive private auction details merely because they possess a URL.

We may process invite records, account identifiers, email addresses, or phone numbers as needed to control access.

8. When we share personal data

We may share personal data with:

The other transaction party

After required payment conditions are satisfied, we may share seller contact information with the paid winning buyer to enable transaction handoff.

We may also enable private transaction chat.

We do not publish seller private contact information to ordinary bidders or public visitors.

Payment service providers

We share information necessary to:

collect deposits;
collect purchase payments;
initiate refunds;
send seller payouts;
reconcile transactions.

Identity-verification and compliance providers

Where verification is required, we may share information necessary to verify identity, prevent fraud, or satisfy legal obligations.

Hosting, infrastructure, analytics, and communications providers

We may use providers for:

cloud hosting;
databases;
storage;
analytics;
crash reporting;
communications;
security;
customer support.

Google Analytics receives limited cookieless, consent-denied measurements on public acquisition or discovery pages for aggregate reporting and modelling. Analytics cookies and full analytics storage are enabled only when analytics consent is granted. LinkedIn Insight Tag is used only when marketing-measurement consent is granted and only on public acquisition or discovery pages; it is not loaded on authentication, checkout, payment, order, payout, dispute, support, profile, or other authenticated transaction pages.

In our mobile apps, Google Analytics for Firebase receives product-usage events and installation/session information to help us understand how Gbanjo is used. Ad personalization is disabled for this integration.

Linkrunner processes app-installation and referral attribution information to identify how an installation reached Gbanjo and restore supported referral or community links. When available for a fresh installation, we send campaign source and campaign or ad creative identifiers from this attribution information to Firebase to measure campaign performance. We do not send Firebase installation/session identifiers or Gbanjo account identifiers to Linkrunner for this association.

On iOS, Apple's privacy-preserving attribution frameworks (SKAdNetwork and AdAttributionKit) may send delayed, limited installation reports to the advertising network, including Meta, with copies to Linkrunner. These reports support aggregate campaign measurement without advertising identifiers and are separate from optional app-event sharing.

If you enable Marketing measurement, Meta receives a limited set of app events, such as completed registration, auction views, listing submission or publication, and confirmed purchases, to measure and optimize Gbanjo ads.

In app versions whose Marketing measurement setting names both Meta and Linkrunner, enabling that setting also allows Linkrunner to receive three types of product event: completed registration (sign_up), accepted listing publication, including scheduled publication (listing_published), and a confirmed purchase following a payment started on that installation (purchase). We send the event name and a randomly generated event identifier to help prevent duplicate recording. These calls do not include account, order, auction or payment identifiers, including hashes of those identifiers, or transaction amounts, currencies, contact details, messages or listing descriptions. The Linkrunner SDK adds installation identifiers and app/device technical information, so these events are not anonymous or solely Apple aggregate reports.

We use these optional Linkrunner events to measure Gbanjo advertising. In this configuration, Linkrunner does not forward these product events to Meta; Meta receives its app events through the separate Meta SDK. Optional app-event sharing is distinct from first-party Firebase analytics, existing Linkrunner install/referral attribution, and Apple's aggregate install reports. Section 10 explains the controls.

These providers receive only the information reasonably needed for their role and are subject to contractual or legal obligations where required.

Professional advisers

We may share information with lawyers, accountants, auditors, insurers, or other professional advisers where reasonably necessary.

Authorities and legal process

We may disclose personal data where:

required by law;
required by a valid court order, warrant, or regulatory request;
necessary to investigate fraud or protect users;
necessary to establish, exercise, or defend legal claims.

Corporate transactions

If Gbanjo is involved in a merger, acquisition, financing, restructuring, or sale of assets, personal data may be disclosed subject to appropriate safeguards.

9. International data transfers

Some service providers may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we will use a lawful transfer basis and appropriate safeguards required by applicable law.

Depending on the transfer, safeguards may include:

an adequacy basis;
contractual protections;
binding rules;
certifications or codes;
another lawful transfer mechanism.

We will maintain records of the legal basis for relevant cross-border transfers as required.

10. Cookies and tracking

Necessary cookies may be used for core functionality without optional consent where permitted by law.

For non-essential cookies, the website should provide a clear choice to:

Accept;
Reject.

The cookie notice should explain:

what categories of cookies are used;
their purpose;
who is responsible for them;
how to change or withdraw consent.

Closing a banner should not be treated as consent to non-essential tracking.

Mobile app measurement choices

Marketing measurement is off by default on each installation. You can enable or disable it in the app's Sign-in & security settings. App versions that add optional Linkrunner product events require a fresh choice that names both Meta and Linkrunner; an earlier Meta-only choice does not enable this expanded sharing. On iOS, optional app-event sharing with Meta and Linkrunner also requires Apple's tracking permission. Gbanjo does not require that permission to browse or use marketplace features.

Turning Marketing measurement off stops new optional app-event sharing with Meta and Linkrunner. Events already sent or waiting to be sent by a provider's SDK cannot be recalled by turning off the setting. This setting applies to optional app events and is separate from first-party Firebase product analytics, campaign association within Firebase, and Linkrunner install and referral attribution. On iOS, system privacy protections can also block connections to Linkrunner's shared attribution and event service when tracking permission is not granted. As a result, install attribution or recovery of a referral after installing the app may be unavailable. Apple's aggregate install-attribution reports operate independently of this setting and App Tracking Transparency permission, subject to Apple's privacy protections. Advertising-ID collection remains disabled even when Marketing measurement is on. Optional crash diagnostics have a separate setting.

To request access, deletion, or restriction of analytics or attribution data, contact privacy@gbanjo.auction as described in Section 13.

11. Data security

We use reasonable technical and organizational measures appropriate to the nature and risk of the processing.

Measures may include:

access controls;
encryption where appropriate;
logging;
monitoring;
secure development practices;
backups and recovery processes;
role-based access;
provider security reviews;
incident-response procedures.

No system is completely secure, but we work to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Where required by law, we will notify the Nigeria Data Protection Commission and affected individuals of qualifying personal-data breaches.

12. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, fraud-prevention, dispute, and security needs.

The separately versioned Gbanjo Data Retention Schedule supplements this section and governs where it provides a more specific period. User-level analytics and crash diagnostics are retained for no longer than 14 months, subject to available provider controls and user consent where required.

Retention schedule:

Data type	Retention period
Account/profile data	While account is active, then up to 7 years after closure where needed for legal/transaction records
Auction, bid, deposit, payment, refund, payout, and order records	Up to 7 years after transaction completion or longer where law requires
Transaction chat and dispute evidence	Up to 7 years after transaction completion or final dispute resolution
Identity-verification records held directly by Gbanjo	Only as long as necessary for verification/compliance; final period must match provider and legal obligations
Unsuccessful pre-contract verification data where no account/transaction is completed	Up to 6 months unless a lawful reason requires longer retention
Support records	Up to 3 years after closure of the support case
Security and application logs	Typically up to 12 months, unless a security investigation requires longer
Marketing preference records	While relevant and for as long as needed to honor opt-out choices
Cookies	According to each cookie's stated expiry period

Where deletion is required, data may remain in limited backups for a short period until backup rotation completes, subject to restricted access.

We may retain information longer where reasonably necessary to:

comply with law;
resolve disputes;
enforce agreements;
prevent fraud;
defend legal claims.

13. Your rights

Subject to applicable law and valid exceptions, you may have rights to:

know whether we process your personal data;
access your personal data;
receive a copy of your data;
correct inaccurate, incomplete, or outdated data;
request deletion where there is no lawful reason to keep the data;
request restriction of processing;
object to certain processing;
object to direct marketing at any time;
withdraw consent where processing is based on consent;
request data portability where applicable;
challenge certain decisions based solely on automated processing where applicable;
complain to the Nigeria Data Protection Commission;
seek legal remedies available under law.

To make a request, contact privacy@gbanjo.auction.

We may need to verify your identity before completing a request.

Some rights are not absolute. For example, we may need to retain transaction information to comply with law, resolve disputes, protect other users, or defend legal claims.

14. Account deletion

You may request account deletion.

Deleting an account does not necessarily mean that all information can be erased immediately.

We may retain information where required or permitted for:

completed transactions;
outstanding payments;
refunds;
seller payouts;
disputes;
fraud prevention;
marketplace enforcement;
legal obligations;
legal claims.

Public listings may be removed or de-identified where appropriate, but historical transaction records may remain where necessary.

15. Marketing choices

You may opt out of marketing emails, SMS, or push notifications using:

the unsubscribe mechanism;
app notification settings;
account preferences;
support@gbanjo.auction where necessary.

Transaction, security, legal, and account notices are not marketing and may still be sent where necessary to provide the Service.

16. Children

Gbanjo is intended for adults aged 18 and above.

We do not knowingly offer auction accounts to children.

If you believe a child has provided personal data to Gbanjo, contact privacy@gbanjo.auction so we can review and take appropriate action.

17. Automated decision-making

Gbanjo may use automated rules for operational purposes such as:

enforcing bid minimums;
checking deposit qualification;
determining auction state;
detecting technical abuse;
routing security or risk signals.

The current Gbanjo seller flow does not include AI item recognition or AI category suggestion.

If Gbanjo later introduces automated decisions that produce legal or similarly significant effects, we will provide the information and safeguards required by applicable law.

18. Third-party links and services

The Service may link to third-party websites or apps.

Their privacy practices are governed by their own policies.

Gbanjo is not responsible for a third party's independent privacy practices.

19. Changes to this Privacy Policy

We may update this Policy.

The latest version will show its effective date.

Where a change is material, we will provide appropriate notice.

Where required, we will request renewed consent for processing that depends on consent.

20. Complaints

If you have a privacy concern, contact us first at:

privacy@gbanjo.auction

You also have the right to lodge a complaint with the Nigeria Data Protection Commission.

21. Contact

Griid Network LTD
7 Ibiyinka Olorunbe, Victoria Island, Lagos
Privacy: privacy@gbanjo.auction
Support: support@gbanjo.auction