Privacy Policy

1. Introduction

5 Square Homes (“5 Square Homes”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit https://5squarehomes.com (the “Website”), submit an enquiry, subscribe to our newsletter, download a brochure, use the ROI calculator, or contact us, and it describes your rights and how to exercise them.

This Policy is designed to comply with the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 of Uganda (together, the “DPPA”), and — because we market our developments to members of the Ugandan diaspora and other persons located in the United Kingdom, the European Union, and the United States — with the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and applicable United States privacy laws. Region-specific rights are set out in the annexes (Sections 14–16).

2. Who we are (data controller)

The data controller responsible for your personal data is:

Data protection contact. Questions about this Policy or your personal data can be directed to info@5squarehomes.com.

Regulatory registration. As a data controller operating in Uganda, we are registered (or are in the process of registering) with the Personal Data Protection Office (PDPO) under the National Information Technology Authority – Uganda (NITA-U), as required by the DPPA.

EU/UK representative (Article 27 exemption). We have not appointed a representative in the EU or the UK because we rely on the exemption in Article 27(2) of the GDPR and UK GDPR: our processing of the personal data of individuals in the EU/EEA and the UK is occasional, does not include large-scale processing of special-category data, and is unlikely to result in a risk to the rights and freedoms of those individuals. We keep this position under review and will appoint a representative if the nature or scale of our processing changes. If you are located in the EU/EEA or the United Kingdom, you may contact us directly about any matter relating to the processing of your personal data at info@5squarehomes.com.

3. The personal data we collect

We collect only the data we need to respond to you and to operate our business. Depending on how you interact with us, this may include:

• Identity and contact data: your name, email address, telephone/WhatsApp number, and country or city of residence.
• Enquiry and preference data: the project(s) you are interested in (e.g. Venue, GIA, Gaiety Place), budget range, unit type, investment preferences, and the content of messages you send us through forms, email, or WhatsApp.
• Newsletter data: your email address and subscription preferences.
• Technical data: limited information such as your IP address and basic browser or device information, processed through strictly-necessary cookies and standard server logs to keep the Website secure and working (see Section 8).

We do not collect payment-card details, bank-account information, or identity-verification (KYC) documents through the Website. Any such information needed for an actual property transaction is collected separately, offline or through secure channels, during the sale process.

Special/sensitive data and children. We do not seek to collect special-category data through the Website, and the Website is not directed at children under 18. We do not knowingly collect data from children; where parental or guardian consent is required under the DPPA, we will obtain it. If you believe a child has provided us data, please contact us and we will delete it.

Is providing your data required? Providing your personal data is voluntary and is not a statutory or contractual requirement. However, if you choose not to provide the information requested in an enquiry or contact form (such as your name and contact details), we may be unable to respond to your enquiry or provide the information or assistance you have requested.

4. How we collect your data

We collect personal data:

• Directly from you — when you complete an enquiry or contact form, subscribe to the newsletter, download a brochure, use the ROI calculator, or message us by email, phone, or WhatsApp;
• Automatically — through strictly-necessary cookies and standard server logs when you use the Website (see Section 8); and
• From third parties — for example, identity and contact data and interaction data from social-media platforms (Facebook, Instagram, LinkedIn, X, TikTok) where you engage with our profiles or advertising. Where we receive your data from these sources, the categories of data and the source are as described in this section and in Section 3.

5. Why we use your data and our lawful basis

We process your personal data for the purposes below. Under the GDPR/UK GDPR we rely on a lawful basis for each purpose; under the DPPA we rely principally on your consent and on the performance of, or steps toward, a contract.

Where we rely on legitimate interests, these are our interests in operating and growing our business and communicating with prospective buyers, balanced against your rights. Our legitimate-interests balancing test is documented and available on request. Where we rely on consent, you may withdraw it at any time (see Section 11) without affecting processing carried out before withdrawal.

6. Marketing communications

With your consent, we may send you newsletters and updates about our developments and offers. Every marketing email contains a clear unsubscribe link, and you can opt out at any time by using that link or by contacting us. We treat WhatsApp and SMS marketing as opt-in: we will only send you business-initiated marketing messages where you have agreed to receive them. To opt out of WhatsApp or SMS marketing, reply STOP to any message, or email info@5squarehomes.com. You have the right under the DPPA (section 26) to require us to stop processing your data for direct marketing.

7. Who we share your data with

We do not sell your personal data. We share it only as needed, with:

• Service providers (processors) acting on our instructions — for example, website hosting, email and newsletter platforms, customer-relationship-management (CRM) tools, and messaging providers (including WhatsApp/Meta). These providers are bound by contract to protect your data and use it only for the services they provide to us.
• Professional advisers — such as lawyers, accountants, and auditors, where necessary.
• Authorities and regulators — where required by law or to protect our legal rights.
• A successor — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

8. Cookies and similar technologies

We use only a limited number of cookies and similar technologies that are strictly necessary to operate the Website, keep it secure, and remember your session. We do not currently use analytics, advertising, or other non-essential cookies, and we do not track your activity across other websites.

Because we use only strictly-necessary cookies, your consent is not required for them and we do not display a cookie consent banner. You can still block or delete cookies through your browser settings, although parts of the Website may not function properly if you do. If we introduce analytics or marketing cookies in the future, we will update this Policy and obtain your consent before any non-essential cookies are used.

9. International data transfers

We are based in Uganda, and some of our service providers are located outside Uganda, the EU/EEA, or the UK. This means your personal data may be transferred to, and processed in, countries whose data-protection laws differ from those in your country.

• Under the DPPA, where your data is processed or stored outside Uganda, we take steps to ensure it receives protection at least equivalent to that required by the DPPA, and we do not transfer your data to a third country without an appropriate basis, which may include your express consent (DPPA section 19 and Regulation 30).
• Under the GDPR/UK GDPR, where we transfer data outside the EEA or the UK to a country without an “adequacy” decision (which includes Uganda), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) or Addendum, or another lawful transfer mechanism. You may request a copy of the relevant safeguards by contacting us.

10. Data retention and security

We keep personal data only for as long as necessary for the purposes described in this Policy, after which it is securely deleted or anonymised:

• Enquiry data is retained for 24 months from your last contact with us, unless an ongoing relationship requires us to keep it longer;
• Newsletter data is retained until you unsubscribe, and then deleted within 30 days;
• Transaction and property-sale records are retained for 7 years to meet tax, accounting, and other legal record-keeping obligations.

We apply appropriate administrative and technical security measures to protect your data against loss, misuse, and unauthorised access, alteration, or disclosure. In the event of a personal-data breach, we will notify the Personal Data Protection Office (PDPO) and, where required, affected individuals, in accordance with the DPPA (section 23 and Regulation 33). Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, and will inform affected individuals where it is likely to result in a high risk to their rights and freedoms.

11. Your rights

Subject to the law that applies to you, you have rights over your personal data. Under the DPPA, these include the right to: be informed about how your data is used; access your personal data; have inaccurate data corrected; prevent processing likely to cause damage or distress; prevent processing for direct marketing; have unlawfully held data blocked, erased, or destroyed; complain to the PDPO; and seek compensation for damage or distress.

Automated decision-making. We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Region-specific rights for the EU/EEA, the UK, and the United States are set out in Sections 14–16.

How to exercise your rights. Contact us at info@5squarehomes.com. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request. Exercising your rights is free in most cases, and we will not discriminate against you for doing so.

12. Third-party links

The Website links to third-party websites and platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Website with a new “Last updated” date and, where the changes are material, take additional steps to notify you. Please review this Policy periodically.

14. Annex A — Additional information for the EU/EEA (GDPR)

If you are located in the European Economic Area, the GDPR gives you the following rights, which you may exercise free of charge by contacting us: the right of access (Art. 15); rectification (Art. 16); erasure (“right to be forgotten”, Art. 17); restriction of processing (Art. 18); data portability (Art. 20); to object to processing, including profiling and direct marketing (Art. 21); and rights regarding automated decision-making (Art. 22). You also have the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority in your EU member state.

Enquiries and requests may be directed to info@5squarehomes.com. Information about the purposes and lawful bases of processing, recipients, international transfers and safeguards, and retention is provided in Sections 5–10 above.

15. Annex B — Additional information for the United Kingdom (UK GDPR)

If you are located in the United Kingdom, the UK GDPR and Data Protection Act 2018 give you the same rights as set out in Annex A. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — https://ico.org.uk. Enquiries and requests may be directed to info@5squarehomes.com. We comply with the Privacy and Electronic Communications Regulations (PECR) in relation to cookies and electronic marketing; because we use only strictly-necessary cookies, no cookie consent is required, and we obtain consent before sending marketing messages.

16. Annex C — Additional information for the United States

We are not established in the United States and, given our size, we do not currently meet the applicability thresholds of state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), the Virginia CDPA, or the Colorado CPA. As a matter of good practice, however, if you are a US resident you may request to know what personal data we hold about you, request deletion or correction, and opt out of marketing. We do not sell or “share” (for cross-context behavioural advertising) your personal data. Because we do not sell or share personal data, there is no need to opt out; where you have set an opt-out preference signal such as Global Privacy Control (GPC), our practice of not selling or sharing is consistent with it. Browsers’ older “Do Not Track” signals are not standardised, and we do not respond to them separately. To make a request, contact us at info@5squarehomes.com. Our marketing emails to US recipients comply with the CAN-SPAM Act, including accurate sender information, a valid postal address, and a working opt-out honoured promptly.

17. Contact and complaints

When you contact us with a privacy request or complaint, we will acknowledge it within 5 business days and respond fully within 30 calendar days, unless a longer period is permitted by applicable law, in which case we will tell you.

If you are in Uganda and are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Office (PDPO) under the National Information Technology Authority – Uganda (NITA-U): https://www.pdpo.go.ug.