Privacy Policy · Gbanjo

This Privacy Policy explains how Griid Network LTD, trading as Gbanjo ("Gbanjo", "we", "us", or "our"), collects, uses, shares, stores, and protects personal data when you use the Gbanjo mobile applications, public website, auction pages, support channels, and related services.

Our registered address is 7 Ibiyinka Olorunbe, Victoria Island, Lagos.

For privacy questions or requests, contact privacy@gbanjo.auction.

This Policy is intended to be read together with the Gbanjo Terms of Service and, for sellers, the Seller Terms.

1. Scope

This Policy applies to personal data we process in connection with:

Gbanjo accounts;
public and private auctions;
listings;
bids and bid deposits;
purchase payments;
seller payouts;
public seller profiles;
private listing inquiries and seller replies;
transaction chat;
pickup, delivery, handoff, and completion states;
disputes and reports;
customer support;
Gbanjo's public website and app acquisition flows.

It does not govern a third party's independent processing where that third party acts under its own privacy policy.

2. Who controls your data

For the processing described in this Policy, Griid Network LTD is generally the data controller because we determine why and how personal data is processed for Gbanjo.

Some providers, such as payment or identity-verification providers, may also act as independent controllers for some processing they perform under law or their own terms.

3. Personal data we collect

3.1 Account and identity data

We may collect:

full name;
display name;
username;
email address;
phone number;
profile photo;
date of birth or age confirmation;
account identifiers;
verification status;
identity-verification information where required;
records showing acceptance of Terms, Seller Terms, or other policies.

3.2 Seller and listing data

We may collect:

listing title and description;
photos and videos;
category and item type;
condition;
known defects;
included items;
approximate item location;
seller-selected pickup or seller-delivery options;
seller representations;
category-specific information.

Depending on the item, category-specific data may include:

vehicle VIN/chassis or document information;
phone serial/IMEI;
watch or jewellery papers;
artwork provenance information;
machinery serial numbers or documentation;
ticket references, transfer information, or seller proof.

Some of this information may be classified as private and not shown publicly.

3.3 Auction and bidding data

We may collect:

bids;
bid timestamps;
current and historical bid status;
auction-watch activity;
bidder eligibility state;
deposit amount;
deposit status;
top-up requirements;
winner status;
auction extensions;
reserve-met status;
auction participation records.

Public bid history is anonymized or pseudonymized where shown publicly.

3.4 Payment and payout data

We may collect or receive:

payment amount;
transaction reference;
payment status;
deposit payments;
purchase balance;
refund status;
payout amount;
payout status;
seller payout destination metadata;
limited payment-method metadata made available by our payment provider.

Full card or bank authentication details may be collected directly by the payment service provider rather than Gbanjo.

3.5 Contact and transaction-chat data

Before the winning buyer completes the required purchase payment, private seller contact information and transaction chat remain locked.

After the winning buyer's purchase payment is confirmed, we may:

disclose the seller's approved contact details to the paid winning buyer;
enable private transaction chat between the winning buyer and seller;
process messages, attachments, and transaction coordination information.

We process this information to help the parties arrange pickup, seller delivery, inspection, transfer, or handoff and to support disputes or safety investigations.

3.6 Handoff and transaction-completion data

We may collect:

seller delivery / pickup method;
approximate meeting or delivery location;
seller handoff confirmations;
buyer receipt confirmations;
completion timestamps;
dispute status;
refund or payout result.

Gbanjo does not require a logistics-provider integration to process these transaction states.

3.7 Tickets and events

For event tickets, we may collect:

event name;
organizer/performer/team;
venue;
city;
event date and time;
ticket type;
quantity;
section, row, or seat where relevant;
ticket format;
transfer method;
transfer deadline;
transfer restrictions;
seller proof or ticket reference where required.

Usable ticket QR codes, barcodes, or access credentials should not be displayed publicly.

3.8 Reports, disputes, reviews, and support

We may collect:

dispute reason;
reports;
photographs, videos, PDFs, or other evidence;
user statements;
support communications;
review and rating content;
internal case notes;
fraud and safety investigation records.

3.9 Device, usage, and technical data

We may collect:

IP address;
device type;
operating system;
app version;
browser;
language;
time zone;
device identifiers where permitted;
session information;
crash logs;
security logs;
approximate location derived from IP or user-provided location;
page and feature interactions.

3.10 Cookies and similar technologies

Our public website may use:

necessary cookies for security, session management, network stability, and core functionality;
Google Analytics cookies, when you allow analytics, plus limited cookieless measurements with storage denied for aggregate reporting and modelling;
preference cookies;
LinkedIn Insight Tag cookies for advertising measurement and campaign audience insights, when you separately allow marketing measurement.
separate Meta, TikTok, X and Snapchat website measurement choices. These are off by default; an existing analytics, LinkedIn or mobile-app choice does not enable these providers on the website. After you allow a provider, we may retain its advertising click identifier in this browser tab for a measurement window of up to 24 hours. We remove expired identifiers when the website next runs and stop using them after expiry. They are also removed when you withdraw that provider's choice. A new visit from an advertising link may start a new measurement window.

Where consent is required, non-essential cookies will not be used until you choose to accept them.

3.11 Mobile app analytics and install attribution

Mobile app measurement may include app-installation, session, and randomly generated event identifiers; app and device technical information; sign-up, listing, auction, and purchase activity; and campaign, ad creative, referral, or supported deep-link information. Campaign information may be unavailable for some installations, including where platform privacy limits apply.

We disable Apple IDFA and Android advertising-ID collection in the existing Meta and Linkrunner mobile integrations. The separate X and Snapchat ad measurement settings permit AppsFlyer to use advertising identifiers only after you opt in to at least one of them; iOS also requires Apple tracking permission. AppsFlyer IDFV, Android ID and AppSet ID collection are disabled. We do not send names, email addresses, phone numbers, account identifiers, messages, payment credentials, or listing descriptions through these integrations. Auction and order identifiers may be used to measure item interactions and completed transactions.

4. How we use personal data

We use personal data to:

Provide the marketplace

create and secure accounts;
display public seller profiles;
publish and manage listings;
operate auctions;
accept bids;
determine winners;
manage deposits and top-ups;
process payments and refunds;
control seller payout;
operate protected payment.

Complete transactions

unlock seller contact information after the required purchase payment;
enable transaction chat;
record pickup, seller delivery, handoff, or ticket transfer;
confirm transaction completion;
resolve transaction problems.

Maintain trust and safety

verify identity where required;
detect suspicious activity;
prevent auction manipulation;
detect fraud or account abuse;
investigate reports;
moderate prohibited listings;
enforce marketplace rules.

Improve and operate Gbanjo

troubleshoot;
monitor performance;
understand feature usage;
improve search and discovery;
maintain security;
produce aggregated analytics.

Gbanjo currently does not use an AI listing-recognition or AI category-suggestion feature as part of the seller flow.

Communicate with you

send transaction notifications;
send bid/outbid/win notifications;
send payment, refund, handoff, dispute, and payout notifications;
respond to support;
provide policy or security notices.

Marketing

Where permitted and where any required consent has been obtained, we may send marketing about Gbanjo.

You can opt out of direct marketing at any time.

5. Lawful bases

Depending on the processing, we rely on one or more lawful bases recognized under applicable data-protection law, including:

Contract

Processing necessary to:

create and operate your account;
process auctions and bids;
process deposits and purchase payments;
unlock transaction contact/chat;
complete transactions;
process seller payouts.

Legal obligation

Processing necessary to comply with:

applicable law;
lawful regulatory requests;
tax, accounting, payment, fraud-prevention, or recordkeeping obligations.

Legitimate interests

Where permitted, processing necessary for interests such as:

fraud prevention;
service security;
dispute investigation;
platform integrity;
preventing auction manipulation;
improving the Service;
defending legal claims.

We balance these interests against your rights and expectations.

Consent

Where required, we rely on consent for:

non-essential cookies;
direct marketing;
certain optional personal-data processing;
other processing for which applicable law requires consent.

You may withdraw consent where processing is based on consent.

6. Public information

Some Gbanjo information is intentionally public.

Depending on your activity, public information may include:

display name;
profile photo;
verification badge/status;
rating;
completed-sales count;
public reviews;
approximate location;
public listings;
listing photos and videos;
listing descriptions;
public auction state;
anonymized or pseudonymized bid activity.

Public auction pages may be shared outside Gbanjo.

Public pages may also be indexed by search engines unless the page is configured as unlisted or private.

Do not include private information in listing descriptions if you do not want it to become public. Listing inquiries and seller replies are limited to the buyer who asked, the seller, and authorized Gbanjo personnel where needed for safety, support, or moderation.

7. Unlisted and invite-only auctions

Unlisted auctions

Unlisted auctions are excluded from normal Gbanjo discovery but may be accessible to anyone who has the link, subject to applicable access controls.

Invite-only auctions

Invite-only auctions are restricted to authorized participants.

Unauthorized visitors should not receive private auction details merely because they possess a URL.

We may process invite records, account identifiers, email addresses, or phone numbers as needed to control access.

8. When we share personal data

We may share personal data with:

The other transaction party

After required payment conditions are satisfied, we may share seller contact information with the paid winning buyer to enable transaction handoff.

We may also enable private transaction chat.

We do not publish seller private contact information to ordinary bidders or public visitors.

Payment service providers

We share information necessary to:

collect deposits;
collect purchase payments;
initiate refunds;
send seller payouts;
reconcile transactions.

Identity-verification and compliance providers

Where verification is required, we may share information necessary to verify identity, prevent fraud, or satisfy legal obligations.

Hosting, infrastructure, analytics, and communications providers

We may use providers for:

cloud hosting;
databases;
storage;
analytics;
crash reporting;
communications;
security;
customer support.

Google Analytics receives limited cookieless, consent-denied measurements on public acquisition or discovery pages for aggregate reporting and modelling. Analytics cookies and full analytics storage are enabled only when analytics consent is granted. LinkedIn Insight Tag is used only when marketing-measurement consent is granted and only on public acquisition or discovery pages; it is not loaded on authentication, checkout, payment, order, payout, dispute, support, profile, or other authenticated transaction pages.

With your separate website permission for Meta, TikTok or X, we send that provider a limited report after a click from its advertising: the advertising click identifier, the time, a randomly generated event identifier, a fixed public page category, and the type of public page view or app-link click. Meta also receives browser user-agent information and the time we first observed its click identifier. These identifiers are not anonymous. We use server-to-server event APIs; we do not include contact details, form contents, private page URLs, search terms, listing descriptions, transaction amounts, or Gbanjo account identifiers. We do not load Meta, TikTok or X browser advertising scripts in this configuration. Gbanjo's hosting provider receives the website request in the normal course of serving it; we do not forward its IP address or raw referrer to these event APIs.

With your separate Snapchat website permission and a Snapchat ad click identifier, we use Snap's server-to-server Conversions API to report public page views, auction-content views and app-link clicks. Snap receives the click identifier, IP address and browser user-agent information for matching, together with the event time, a random event identifier and a fixed public page category. We do not send email addresses, phone numbers, form contents, private URLs, raw referrers, search terms, listing descriptions, account identifiers or transaction amounts. No Snap browser advertising script is loaded in this configuration.

This website measurement does not report an app-link click as an installation, registration, bid, listing publication or purchase. It applies only to public acquisition or discovery pages and requires a valid advertising click identifier. Visits without one, or without consent, are not sent through these Meta, TikTok, X and Snapchat website integrations. Your choices and saved click information are separate on the marketing site and marketplace; they are not automatically transferred between them. Use Cookie settings on each site to review or withdraw permission. Withdrawal stops new sharing but cannot recall reports already sent. This website choice does not change your mobile-app privacy settings.

In our mobile apps, Google Analytics for Firebase receives product-usage events and installation/session information to help us understand how Gbanjo is used. Ad personalization is disabled for this integration.

Linkrunner processes app-installation and referral attribution information to identify how an installation reached Gbanjo and restore supported referral or community links. When available for a fresh installation, we send campaign source and campaign or ad creative identifiers from this attribution information to Firebase to measure campaign performance. We do not send Firebase installation/session identifiers or Gbanjo account identifiers to Linkrunner for this association.

On iOS, Apple's privacy-preserving attribution frameworks (SKAdNetwork and AdAttributionKit) may send delayed, limited installation reports to the advertising network, including Meta, X and Snapchat, with copies to the attribution provider used by that app version: Linkrunner in earlier releases, or AppsFlyer in releases using the AppsFlyer measurement integration. These reports support aggregate campaign measurement without advertising identifiers and are separate from optional app-event sharing.

If you enable Marketing measurement, Meta receives a limited set of app events, such as completed registration, auction views, listing submission or publication, and confirmed purchases, to measure and optimize Gbanjo ads.

In app versions whose Marketing measurement setting names both Meta and Linkrunner, enabling that setting also allows Linkrunner to receive three types of product event: completed registration (sign_up), accepted listing publication, including scheduled publication (listing_published), and a confirmed purchase following a payment started on that installation (purchase). We send the event name and a randomly generated event identifier to help prevent duplicate recording. These calls do not include account, order, auction or payment identifiers, including hashes of those identifiers, or transaction amounts, currencies, contact details, messages or listing descriptions. The Linkrunner SDK adds installation identifiers and app/device technical information, so these events are not anonymous or solely Apple aggregate reports.

We use these optional Linkrunner events to measure Gbanjo advertising. In this configuration, Linkrunner does not forward these product events to Meta; Meta receives its app events through the separate Meta SDK. Optional app-event sharing is distinct from first-party Firebase analytics, existing Linkrunner install/referral attribution, and Apple's aggregate install reports. Section 10 explains the controls.

The separate X ad measurement and Snapchat ad measurement settings are each off by default. Enabling either lets AppsFlyer receive installation/session information, permitted advertising identifiers, app/device technical information, and fresh sign-up, listing-publication and confirmed-purchase occurrences. Our event payload contains only the event name and a random event identifier, not account, auction, order or payment identifiers, contact details, transaction amounts or listing descriptions. AppsFlyer may forward supported occurrences attributed to a network to that network only when its separate choice is on, without event values or revenue. Listing publication is not relabelled as a purchase. Existing Meta or Linkrunner permission does not enable either choice; enabling X does not enable Snapchat, or vice versa. We set AppsFlyer's partner-sharing exclusions before ordinary startup and when these choices change.

On iOS, AppsFlyer also retrieves the SKAN configuration and updates Apple conversion values without starting ordinary AppsFlyer session/event sharing when both ad measurement choices are off or Apple tracking permission is off. Apple aggregate reporting remains separate from permission to track across companies. Use Profile, Sign-in & security, X ad measurement or Snapchat ad measurement to withdraw the corresponding permission. Turning both off stops new ordinary AppsFlyer sharing. Changing recipients clears Gbanjo's pending events; data already sent to or queued within a provider's SDK cannot be recalled.

These providers receive only the information reasonably needed for their role and are subject to contractual or legal obligations where required.

Professional advisers

We may share information with lawyers, accountants, auditors, insurers, or other professional advisers where reasonably necessary.

Authorities and legal process

We may disclose personal data where:

required by law;
required by a valid court order, warrant, or regulatory request;
necessary to investigate fraud or protect users;
necessary to establish, exercise, or defend legal claims.

Corporate transactions

If Gbanjo is involved in a merger, acquisition, financing, restructuring, or sale of assets, personal data may be disclosed subject to appropriate safeguards.

9. International data transfers

Some service providers may process personal data outside Nigeria.

Where personal data is transferred outside Nigeria, we will use a lawful transfer basis and appropriate safeguards required by applicable law.

Depending on the transfer, safeguards may include:

an adequacy basis;
contractual protections;
binding rules;
certifications or codes;
another lawful transfer mechanism.

We will maintain records of the legal basis for relevant cross-border transfers as required.

10. Cookies and tracking

Necessary cookies may be used for core functionality without optional consent where permitted by law.

For non-essential cookies, the website should provide a clear choice to:

Accept;
Reject.

The cookie notice should explain:

what categories of cookies are used;
their purpose;
who is responsible for them;
how to change or withdraw consent.

Closing a banner should not be treated as consent to non-essential tracking.

Mobile app measurement choices

Marketing measurement is off by default on each installation. You can enable or disable it in the app's Sign-in & security settings. App versions that add optional Linkrunner product events require a fresh choice that names both Meta and Linkrunner; an earlier Meta-only choice does not enable this expanded sharing. On iOS, optional app-event sharing with Meta and Linkrunner also requires Apple's tracking permission. Gbanjo does not require that permission to browse or use marketplace features.

Turning Marketing measurement off stops new optional app-event sharing with Meta and Linkrunner. Events already sent or waiting to be sent by a provider's SDK cannot be recalled by turning off the setting. This setting applies to optional app events and is separate from first-party Firebase product analytics, campaign association within Firebase, and Linkrunner install and referral attribution. On iOS, system privacy protections can also block connections to Linkrunner's shared attribution and event service when tracking permission is not granted. As a result, install attribution or recovery of a referral after installing the app may be unavailable. Apple's aggregate install-attribution reports operate independently of this setting and App Tracking Transparency permission, subject to Apple's privacy protections. Advertising-ID collection remains disabled even when Marketing measurement is on. Optional crash diagnostics have a separate setting.

To request access, deletion, or restriction of analytics or attribution data, contact privacy@gbanjo.auction as described in Section 13.

11. Data security

We use reasonable technical and organizational measures appropriate to the nature and risk of the processing.

Measures may include:

access controls;
encryption where appropriate;
logging;
monitoring;
secure development practices;
backups and recovery processes;
role-based access;
provider security reviews;
incident-response procedures.

No system is completely secure, but we work to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Where required by law, we will notify the Nigeria Data Protection Commission and affected individuals of qualifying personal-data breaches.

12. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, fraud-prevention, dispute, and security needs.

The separately versioned Gbanjo Data Retention Schedule supplements this section and governs where it provides a more specific period. User-level analytics and crash diagnostics are retained for no longer than 14 months, subject to available provider controls and user consent where required.

Retention schedule:

Data type	Retention period
Account/profile data	While account is active, then up to 7 years after closure where needed for legal/transaction records
Auction, bid, deposit, payment, refund, payout, and order records	Up to 7 years after transaction completion or longer where law requires
Transaction chat and dispute evidence	Up to 7 years after transaction completion or final dispute resolution
Identity-verification records held directly by Gbanjo	Only as long as necessary for verification/compliance; final period must match provider and legal obligations
Unsuccessful pre-contract verification data where no account/transaction is completed	Up to 6 months unless a lawful reason requires longer retention
Support records	Up to 3 years after closure of the support case
Security and application logs	Typically up to 12 months, unless a security investigation requires longer
Marketing preference records	While relevant and for as long as needed to honor opt-out choices
Cookies	According to each cookie's stated expiry period

Where deletion is required, data may remain in limited backups for a short period until backup rotation completes, subject to restricted access.

We may retain information longer where reasonably necessary to:

comply with law;
resolve disputes;
enforce agreements;
prevent fraud;
defend legal claims.

13. Your rights

Subject to applicable law and valid exceptions, you may have rights to:

know whether we process your personal data;
access your personal data;
receive a copy of your data;
correct inaccurate, incomplete, or outdated data;
request deletion where there is no lawful reason to keep the data;
request restriction of processing;
object to certain processing;
object to direct marketing at any time;
withdraw consent where processing is based on consent;
request data portability where applicable;
challenge certain decisions based solely on automated processing where applicable;
complain to the Nigeria Data Protection Commission;
seek legal remedies available under law.

To make a request, contact privacy@gbanjo.auction.

We may need to verify your identity before completing a request.

Some rights are not absolute. For example, we may need to retain transaction information to comply with law, resolve disputes, protect other users, or defend legal claims.

14. Account deletion

You may request account deletion.

Deleting an account does not necessarily mean that all information can be erased immediately.

We may retain information where required or permitted for:

completed transactions;
outstanding payments;
refunds;
seller payouts;
disputes;
fraud prevention;
marketplace enforcement;
legal obligations;
legal claims.

Public listings may be removed or de-identified where appropriate, but historical transaction records may remain where necessary.

15. Marketing choices

You may opt out of marketing emails, SMS, or push notifications using:

the unsubscribe mechanism;
app notification settings;
account preferences;
support@gbanjo.auction where necessary.

Transaction, security, legal, and account notices are not marketing and may still be sent where necessary to provide the Service.

16. Children

Gbanjo is intended for adults aged 18 and above.

We do not knowingly offer auction accounts to children.

If you believe a child has provided personal data to Gbanjo, contact privacy@gbanjo.auction so we can review and take appropriate action.

17. Automated decision-making

Gbanjo may use automated rules for operational purposes such as:

enforcing bid minimums;
checking deposit qualification;
determining auction state;
detecting technical abuse;
routing security or risk signals.

The current Gbanjo seller flow does not include AI item recognition or AI category suggestion.

If Gbanjo later introduces automated decisions that produce legal or similarly significant effects, we will provide the information and safeguards required by applicable law.

18. Third-party links and services

The Service may link to third-party websites or apps.

Their privacy practices are governed by their own policies.

Gbanjo is not responsible for a third party's independent privacy practices.

19. Changes to this Privacy Policy

We may update this Policy.

The latest version will show its effective date.

Where a change is material, we will provide appropriate notice.

Where required, we will request renewed consent for processing that depends on consent.

20. Complaints

If you have a privacy concern, contact us first at:

privacy@gbanjo.auction

You also have the right to lodge a complaint with the Nigeria Data Protection Commission.

21. Contact

Griid Network LTD
7 Ibiyinka Olorunbe, Victoria Island, Lagos
Privacy: privacy@gbanjo.auction
Support: support@gbanjo.auction