Privacy Policy for Palm City

Effective Date: 12 April 2026  

Last Updated: 12 April 2026

—

1. Introduction

Palm City (referred to as “we,” “us,” or “our“) operates the website `www.thepalmcity.ng`. We are committed to protecting your personal data and respecting your privacy in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025 issued by the Nigeria Data Protection Commission (NDPC).

This Privacy Policy explains:

– What personal data we collect

– How we use and share your data

– Your legal rights under Nigerian law

– How to contact us

By using our website, providing your information via our forms, or engaging with our ads (including on Meta platforms), you agree to the terms of this Privacy Policy.

—

2. Interpretation and Definitions

Interpretation  

Words with initial capital letters have meanings defined below, whether singular or plural.

Definitions  

– Account means a unique account created for you to access our Service.  

– Company (referred to as “We“, “Us“, or “Our“) means Xymbolic Development Limited, T7, Emperor Estate, off Monastery Road, KM 34 Lekki-Epe Expressway, Sangotedo, Lagos, Nigeria.  

– Cookies are small files placed on your device containing browsing history details.  

– Country refers to Nigeria.  

– Device means any device that can access the Service (computer, cellphone, tablet).  

– Personal Data is any information relating to an identified or identifiable individual.  

– Service refers to the Website.  

– Service Provider means any third party processing data on our behalf.  

– Usage Data refers to data collected automatically (e.g., page visit duration).  

– Website refers to The Palm City Project, accessible from `https://thepalmcity.ng/`.  

– You means the individual accessing or using the Service, or the legal entity on whose behalf they act.

—

3. Data Controller Contact

Business Name: Xymbolic Development Limited  

Email: info@xymbolicdevelopment.com  

Phone: +2349063533357 & +2348068186293  

Address: Emperor Estate, KM 34 Lekki-Epe Expressway, Sangotedo, Ajah, Lagos, Nigeria  

Postcode: 100001  

Data Protection Officer: Daniel Chidozie – +2348105700721  

If you have any questions about this policy or your data, please contact us using the details above.

—

4. Personal Data We Collect

We collect the following categories of personal data:

| Category | Examples | Source |

| Identity Data | Full name, title, date of birth (if provided) | Contact forms, investment enquiry forms, phone calls |

| Contact Data | Email address, phone number, postal address | Forms, SMS opt‑ins, email communications |

| Financial Data | Bank account details (only if you become an investor) | Separate investment agreement forms |

| Technical Data | IP address, browser type, device type, operating system | Automatic collection via cookies and analytics tools (e.g., Google Analytics) |

| Usage Data | Pages visited, time spent, clicks, form interactions | Website analytics and tracking scripts |

| Marketing & Communications Data | Your preferences for receiving marketing from us (email, SMS, WhatsApp) | Consent checkboxes, opt‑in forms |

Sensitive Personal Data: We do not knowingly collect sensitive data (e.g., biometric, health, political opinions) unless required by law or with explicit consent.

Children’s Data: Our website is not intended for persons under the age of 18. We do not knowingly collect data from minors.

—

5. How We Use Your Personal Data (Lawful Basis)

We use your data only for legitimate business purposes and where we have a lawful basis under the NDPA/GAID:

| Purpose | Data Categories| Lawful Basis |

| To process your investment enquiry | Identity, Contact | Contract performance (pre‑contractual steps) |

| To send you marketing information (emails, SMS) about Palm City | Identity, Contact, Marketing preferences | Consent (you must opt‑in) |

| To operate and improve our website | Technical, Usage | Legitimate interest (ensuring website security and performance) |

| To run retargeting and lookalike advertising campaigns on Meta (Facebook/Instagram) | Identity (hashed), Contact (hashed), Usage | Consent (via cookie banner and Meta Pixel opt‑in) |

| To comply with legal obligations (e.g., tax, anti‑fraud) | Identity, Contact, Financial | Legal obligation |

Important: Where we rely on consent, you have the right to withdraw it at any time.

—

6. Cookies and Similar Technologies

We use cookies and tracking technologies as described in our [Cookie Policy](www.thepalmcity.ng/cookie-policy). Our cookie banner (powered by Complianz) will ask for your consent before placing non‑essential cookies, including those used for analytics and advertising (e.g., Meta Pixel, Google Analytics).

You can manage your cookie preferences at any time via the “Cookie Settings” link in our website footer.

We use both Session and Persistent Cookies for the following purposes:

| Type | Purpose |

|:—|:—|

| Necessary / Essential Cookies | Essential to provide services and enable features (e.g., authentication, fraud prevention). |

| Cookies Policy / Notice Acceptance Cookies | Identify if users have accepted the use of cookies. |

| Functionality Cookies | Remember choices you make (e.g., login details, language preference) for a more personal experience. |

For more information, please visit our Cookies Policy or the Cookies section of this Privacy Policy.

—

7. How We Share Your Personal Data (Data Sharing)

We do not sell your personal data to third parties. However, we may share your data with the following categories of recipients for legitimate purposes:

| Recipient Category | Purpose | Data Shared | Location |

| Meta Platforms Ireland Ltd. (Facebook/Instagram) | To show retargeting ads, measure conversions, and build lookalike audiences (Meta Pixel and Conversions API) | Hashed email, phone number, IP address, browser information | Ireland / USA |

| Google LLC (Analytics, Ads) | To analyse website traffic and serve relevant Google Ads | IP address, device data, usage data | USA |

| Email & SMS Marketing Platforms (e.g., Mailchimp, Kajabi) | To send newsletters, offers, and updates (only with your consent) | Name, email, phone number | Varies |

| Payment Processors | To process investment payments securely | Name, bank details, payment amount | Varies (PCI‑compliant) | 

| Professional Advisors (lawyers, auditors) | To comply with legal and regulatory obligations | Relevant data as required | Nigeria |

| Government / Law Enforcement | When required by Nigerian law or court order | As required | Nigeria |

International Data Transfers: Some of our service providers are located outside Nigeria (e.g., Meta, Google). When we transfer your data internationally, we ensure an adequate level of protection by relying on standard contractual clauses (SCCs) or equivalent safeguards as required by the GAID 2025.

We may also share your information:

– For business transfers (merger, sale of assets, restructuring)

– With affiliates (requiring them to honour this Privacy Policy)

– With business partners to offer products or services

– With other users if you interact in public areas

– With your consent for any other purpose

—

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.

| Data Category | Retention Period |

| Enquiry / lead data (not converted) | 12 months from last contact |

| Investor/client data | 7 years after the end of the investment relationship (for tax/legal purposes) |

| Marketing consent records | Until you withdraw consent, plus 1 year after last active engagement |

| Website analytics data (anonymised) | Up to **26 months (Google Analytics default) |

| Cookie consent logs (Complianz) | 12 months (for proof of consent) |

After the retention period, your data will be securely deleted or anonymised.

—

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

– SSL encryption on our website

– Access controls and strong passwords

– Regular security updates and backups

– Restricted access to personal data on a need‑to‑know basis

However, no method of transmission over the Internet is 100% secure. You share your data at your own risk.

—

10. Your Legal Rights (Data Subject Rights)

Under the NDPA 2023, you have the following rights:

– Right to be informed – You are receiving this policy.

– Right to access – Request a copy of your data.

– Right to rectification – Correct inaccurate data.

– Right to erasure (right to be forgotten – Request deletion of your data (subject to legal obligations).

– Right to restrict processing – Limit how we use your data.

– Right to data portability – Receive your data in a machine‑readable format.

– Right to object – Object to processing for direct marketing or legitimate interests.

– Right to withdraw consent – Withdraw any consent you have given.

– Right to lodge a complaint – File a complaint with the Nigeria Data Protection Commission (NDPC).

How to exercise your rights: Contact us at info@xymbolicdevelopment.com. We will respond within one month (or up to two months for complex requests). There is no fee for reasonable requests.

—

11. Transfer of Your Personal Data

Your information, including Personal Data, may be processed at our operating offices and in other places where processing parties are located. This means data may be transferred to computers outside Nigeria where data protection laws may differ.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer. We will take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy.

—

12. Disclosure of Your Personal Data

Business Transactions: If we are involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before it becomes subject to a different Privacy Policy.

Law enforcement: We may disclose your data if required by law or in response to valid requests by public authorities (e.g., a court or government agency).

Other legal requirements: We may disclose your data in good faith to:

– Comply with a legal obligation

– Protect and defend our rights or property

– Prevent or investigate possible wrongdoing

– Protect the personal safety of users or the public

– Protect against legal liability

—

13. Children’s Privacy

Our Service does not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under 13 without verification of parental consent, we take steps to remove that information from our servers.

If we need to rely on consent as a legal basis and your country requires parental consent, we may require your parent’s consent before collecting and using that information.

For minors under 18, we also do not knowingly collect data; please contact us if you believe we have.

—

14. Links to Other Websites

Our Service may contain links to other websites not operated by us. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third‑party sites or services.

—

15. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the “Last updated” date at the top. For significant changes, we will notify you via email and/or a prominent notice on our Service prior to the change becoming effective.

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when they are posted.

—

16. Complaints to the NDPC

If you believe we have violated your data protection rights under Nigerian law, you have the right to lodge a complaint with:

Nigeria Data Protection Commission (NDPC)  

Website: [https://ndpc.gov.ng](https://ndpc.gov.ng)  

Address: No.12 DR Clement Isong Street, Abuja, Nigeria  

Email: info@ndpc.gov.ng  

Phone: 0916 061 5551  

We encourage you to contact us first so we can try to resolve your concern.

—

17. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the NDPA 2023 and GAID 2025.

—

18. Contact Us

For all privacy‑related questions, requests, or concerns:

Email: info@xymbolicdevelopment.com  

Phone: +2349063533357 & +2348068186293  

Address: Emperor Estate, KM 34 Lekki-Epe Expressway, Sangotedo, Ajah, Lagos, Nigeria