Privacy Policy

Goldyn Limited is a company registered in Nigeria with the Corporate Affairs Commission, RC BN 2011841, incorporated in 2022. We work across Real Estate, Construction, Mining and Energy, with Trade across all four.

Our registered office is at 24K Kwawel 24 Mall, Atlantic Nominee Estate, Ajiwe, Lekki, Lagos, Nigeria. We are the data controller for the personal data described in this policy. Questions about it go to [email protected], and we answer in writing.

We collect only what a service needs to work, and we ask for it at the point we need it. There are four kinds of it.

• Account details: your name, email address, phone number, country of residence and country of your phone number. Your password is never stored: we keep a one-way Argon2id hash, so we cannot read it back.
• Verification details: when you verify your identity, we hold your date of birth, nationality, address, type and number of your identity document, and, for a company, its name, registration number and your role in it. We also hold the images or scans you upload.
• Transaction details: what you bought or asked about, the amount, the reference, and the records of the conversations our desks had with you.
• Technical details: your IP address, your browser's user agent, the country your connection comes from, and the times you signed in.

We do not ask for your bank details, your card details, or a copy of your utility bill unless a specific step needs it. Payment card data never reaches our servers: it goes straight from you to our payment provider.

We hold personal data for the purposes below and no others. Where the law requires a lawful basis for processing, the basis is stated with the purpose.

• To create and operate your account, to sign you in and to keep your session working: performance of our contract with you.
• To verify your identity, because the law requires identity checks before a property deposit or a commodity trade can be settled: legal obligation, and our legitimate interest in preventing fraud.
• To answer your enquiries, to process a payment and to send the receipt: performance of our contract with you.
• To keep the site secure, to investigate a sign-in that looks wrong and to keep the audit trail: our legitimate interest in protecting the platform, our staff and our users.
• To meet our obligations under Nigerian law, including tax and company records: legal obligation.
• To send you service messages about an account you hold. We do not send marketing email, and there is no newsletter to sign up for.

The site sets one cookie to keep you signed in, and staff who sign into the admin dashboard get a second of the same kind. Neither is an advertising cookie and neither tracks you across other websites.

We do not use advertising cookies, cross-site trackers, analytics cookies or pixels. There is no third-party advertising or social media script on this site. Your browser's local storage is not used to identify you.

We do use a small script from Cloudflare, the company that hosts our DNS and proxies our traffic, to measure how the site performs. It is allowed by our content security policy, and it does not set a cookie or build a profile of you across other sites. If that changes, this section changes with it.

• gld_session: a random session token that keeps you signed in. It lasts seven days, is marked HttpOnly so no script can read it, is marked Secure in production, and is set for the whole of goldynltd.com so that one sign-in works across the public site, the listing portal and the exchange. The database stores only a SHA-256 hash of it, so a copy of our database cannot be replayed as a login.
• gld_admin_session: the same kind of token, set only when staff sign into the admin dashboard, with the same protections. Keeping it separate means a sign-in to the dashboard never replaces the sign-in on the public site in the same browser.

These are the only organisations outside Goldyn that receive your personal data. Each one receives only what its part of the service needs.

• Cloudflare: our DNS and traffic proxy. It sees the request and the address it came from, and tells us the country the connection comes from so we can apply our country rules.
• Vercel: our hosting provider. It runs the site and the API, and supplies the country of the connection at its edge.
• Neon: our database host. All application data, including the encrypted verification records, is stored in a database they run.
• Mailgun: our email provider. It receives every message we send you, and the messages our desks send you. If your message to us reaches the wrong desk, it reaches a Goldyn mailbox, and the desk that received it sees what you wrote.
• Paystack: our payment provider. It receives your email address, the amount, the currency and a reference, and it tells us whether the payment succeeded. It receives your card details, not us. We read back only the status, the amount, the currency and the date.
• Google: only if you choose to sign in with Google. We ask for your email address and your name. We do not ask for your contacts, your calendar, your files or your location, and we do not use Google Analytics or Google Ads.

Buyers on the commodity exchange are anonymous to sellers. A seller is given a random buyer code and never receives a buyer's name, company, email, phone, destination, message, account or address. This is enforced by the shape of the data we query, not by hiding it afterwards. Sellers are hidden from buyers in the same way. Only our desk sees both sides.

Access to a Goldyn account needs a password or a passkey, and sessions live in the database rather than in the cookie, so signing out on one device ends that session everywhere. Sign-ins are checked against a list of countries we do not do business with, and a sign-in that looks like travel which is not possible ends the session.

• Verification details and identity documents are encrypted at rest with AES-256-GCM. Each record is bound to the account it belongs to, so a file copied onto someone else's record will not decrypt.
• Passwords are hashed with Argon2id. Session tokens, one-time links and passkey challenges are stored only as SHA-256 hashes.
• Documents are served only to staff on a permission-checked route, and every staff read is written to the audit log.
• Your data in transit is protected by TLS. The session cookie is marked Secure in production.
• Every change made in the admin dashboard is written to an audit log with the values before and after.

We share personal data outside Goldyn only where a service cannot run without it, which is the list in section 5, and in these situations:

We do not sell personal data. We do not share it for advertising. We do not use it to build a profile of you for anything you did not ask for.

• With a professional adviser, auditor or regulator where Nigerian law requires us to disclose it.
• With a buyer or seller on the exchange where a trade requires it. Even then, the identity of a buyer is withheld from the seller, as described in section 5.
• If we are restructured or sold, so that a transaction you entered into with us is honoured. We will tell you before your data moves.
• Where we must protect the safety of a person, the site or the public, including telling the police where the law allows it.

We keep records for as long as the purpose that justified them continues, and no longer.

• Account details: for as long as the account is open, and for as long afterwards as Nigerian company and tax law requires us to keep the record.
• Sessions: seven days, or until you sign out. Admin sessions also end after twelve hours without activity.
• Verification records: for as long as the account is open, because identity checks have to survive the transactions they support. If you want them removed earlier, write to us and we will do it.
• Payment records: for the period Nigerian tax law requires a business to keep them. Payments keep their record permanently, as the law expects of them.
• Audit entries: for as long as the account or the record they describe exists, so that the trail stays complete.
• One-time links: they expire, and a link that has been used cannot be used again.

Under the Nigeria Data Protection Act, you have the right to ask us to tell you what personal data we hold about you, to correct it, to delete it, to restrict how we use it, to object to certain uses, to withdraw a consent you gave, and to complain to the Nigeria Data Protection Commission.

Write to [email protected] with the subject "My data" and say which right you want to use. We answer within thirty days. We may ask you to confirm your identity first, so that we do not release your data to somebody else.

There is one thing to be clear about: the site has no button that deletes your account. Deleting an account takes a person, because it has to reach the records we keep for tax, audit and dispute purposes as well as the ones you can see. If you ask us to close your account, we close it, we end every session, we remove your verification documents, and we tell you in writing what we could not remove and why.

If you ask us to delete your verification records, we do it. Those are the records with the most sensitive content, they are ours to hold for the purpose they were collected, and there is no legal reason to keep them once the transactions they supported are closed.

If a breach of your personal data happens and it is likely to cause you harm, we will tell you and the Nigeria Data Protection Commission, and we will tell you what we are doing about it. Where we can, we will tell you what we believe happened, which records were involved and what you should do next.

To report a concern, or to tell us about something that looks wrong on an account, write to [email protected]. If your account may have been taken over, sign out of every device from your account page and contact us.

This site is for business use. A person must be at least eighteen years old to open an account, and we do not knowingly collect data from anyone younger. Where we discover that data from a child has reached us, we delete it.

When this policy changes, the version number and date at the top change with it. If the change affects what we do with your data, we will ask you to accept the new Terms and acknowledge the new policy from your account page, and we will record which version you accepted and when. The version number for this policy is 2026-10-21.

Goldyn Limited, RC BN 2011841. 24K Kwawel 24 Mall, Atlantic Nominee Estate, Ajiwe, Lekki, Lagos, Nigeria. Email [email protected]. Telephone +234 811 931 0702.

If you have a question about this policy, or want to use one of the rights in section 9, that address reaches a person who can act on it.