Privacy Policy

1. Introduction

5 Square Homes (“5 Square Homes”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you visit https://5squarehomes.com (the “Website”), submit an enquiry, subscribe to our newsletter, download a brochure, use the ROI calculator, or contact us, and it describes your rights and how to exercise them.

This Policy is designed to comply with the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 of Uganda (together, the “DPPA”), and — because we market our developments to members of the Ugandan diaspora and other persons located in the United Kingdom, the European Union, and the United States — with the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, and applicable United States privacy laws. Region-specific rights are set out in the annexes (Sections 14–16).

2. Who we are (data controller)

The data controller responsible for your personal data is:

Data protection contact. Questions about this Policy or your personal data can be directed to info@5squarehomes.com.

Individuals in the EU/EEA and the UK. If you are located in the EU/EEA or the United Kingdom, you may contact us about any matter relating to the processing of your personal data — including any matter for which a data-protection representative would be contacted — at info@5squarehomes.com.

3. The personal data we collect

We collect only the data we need to respond to you and to operate our business. Depending on how you interact with us, this may include:

• Identity and contact data: your name, email address, telephone/WhatsApp number, and country or city of residence.
• Enquiry and preference data: the project(s) you are interested in (e.g. Venue, GIA, Gaiety Place), budget range, unit type, investment preferences, and the content of messages you send us through forms, email, or WhatsApp.
• Newsletter data: your email address and subscription preferences.
• Technical and usage data: IP address, browser type, device information, pages viewed, and similar information collected automatically through cookies and similar technologies (see Section 8).

We do not collect payment-card details, bank-account information, or identity-verification (KYC) documents through the Website. Any such information needed for an actual property transaction is collected separately, offline or through secure channels, during the sale process.

Special/sensitive data and children. We do not seek to collect special-category data through the Website, and the Website is not directed at children under 18. We do not knowingly collect data from children; where parental or guardian consent is required under the DPPA, we will obtain it. If you believe a child has provided us data, please contact us and we will delete it.

4. How we collect your data

We collect personal data:

• Directly from you — when you complete an enquiry or contact form, subscribe to the newsletter, download a brochure, use the ROI calculator, or message us by email, phone, or WhatsApp;
• Automatically — through cookies and similar technologies when you use the Website (see Section 8); and
• From third parties — for example, social-media platforms (Facebook, Instagram, LinkedIn, X, TikTok) where you interact with our profiles or advertising, and analytics providers.

5. Why we use your data and our lawful basis

We process your personal data for the purposes below. Under the GDPR/UK GDPR we rely on a lawful basis for each purpose; under the DPPA we rely principally on your consent and on the performance of, or steps toward, a contract.

Where we rely on legitimate interests, these are our interests in operating and growing our business and communicating with prospective buyers, balanced against your rights. Where we rely on consent, you may withdraw it at any time (see Section 11) without affecting processing carried out before withdrawal.

6. Marketing communications

With your consent, we may send you newsletters and updates about our developments and offers. Every marketing email contains a clear unsubscribe link, and you can opt out at any time by using that link or by contacting us. We treat WhatsApp and SMS marketing as opt-in: we will only send you business-initiated marketing messages where you have agreed to receive them, and you can opt out at any time. You have the right under the DPPA (section 26) to require us to stop processing your data for direct marketing.

7. Who we share your data with

We do not sell your personal data. We share it only as needed, with:

• Service providers (processors) acting on our instructions — for example, website hosting, email and newsletter platforms, customer-relationship-management (CRM) tools, analytics providers, and messaging providers (including WhatsApp/Meta). These providers are bound by contract to protect your data and use it only for the services they provide to us.
• Professional advisers — such as lawyers, accountants, and auditors, where necessary.
• Authorities and regulators — where required by law or to protect our legal rights.
• A successor — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

8. Cookies and similar technologies

We use cookies and similar technologies to operate the Website, remember your preferences, measure traffic, and (with your consent) for analytics and marketing.

• Strictly necessary cookies are required for the Website to function and do not require consent.
• Analytics and marketing cookies are used only where you have given consent through our cookie banner.

When you first visit the Website, you will be presented with a cookie banner allowing you to accept or reject non-essential cookies, with equally prominent options and granular control by category. You can change your preferences at any time through the cookie settings available on the Website, and you can manage cookies through your browser.

9. International data transfers

We are based in Uganda, and some of our service providers are located outside Uganda, the EU/EEA, or the UK. This means your personal data may be transferred to, and processed in, countries whose data-protection laws differ from those in your country.

• Under the DPPA, where your data is processed or stored outside Uganda, we take steps to ensure it receives protection at least equivalent to that required by the DPPA, and we do not transfer your data to a third country without an appropriate basis, which may include your express consent (DPPA section 19 and Regulation 30).
• Under the GDPR/UK GDPR, where we transfer data outside the EEA or the UK to a country without an “adequacy” decision (which includes Uganda), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) or Addendum, or another lawful transfer mechanism. You may request a copy of the relevant safeguards by contacting us.

10. Data retention and security

We keep personal data only for as long as necessary for the purposes described in this Policy, after which it is securely deleted or anonymised:

• enquiry data is retained for as long as needed to respond and for a reasonable period thereafter;
• newsletter data is retained until you unsubscribe;
• data related to a property transaction is retained for the period required by law (including tax and record-keeping obligations).

We apply appropriate administrative and technical security measures to protect your data against loss, misuse, and unauthorised access, alteration, or disclosure. In the event of a personal-data breach, we will notify the Personal Data Protection Office (PDPO) and, where required, affected individuals, in accordance with the DPPA (section 23 and Regulation 33) and any other applicable law.

11. Your rights

Subject to the law that applies to you, you have rights over your personal data. Under the DPPA, these include the right to: be informed about how your data is used; access your personal data; have inaccurate data corrected; prevent processing likely to cause damage or distress; prevent processing for direct marketing; have unlawfully held data blocked, erased, or destroyed; complain to the PDPO; and seek compensation for damage or distress.

Region-specific rights for the EU/EEA, the UK, and the United States are set out in Sections 14–16.

How to exercise your rights. Contact us at info@5squarehomes.com. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request. Exercising your rights is free in most cases, and we will not discriminate against you for doing so.

12. Third-party links

The Website links to third-party websites and platforms. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Website with a new “Last updated” date and, where the changes are material, take additional steps to notify you. Please review this Policy periodically.

14. Annex A — Additional information for the EU/EEA (GDPR)

If you are located in the European Economic Area, the GDPR gives you the following rights, which you may exercise free of charge by contacting us: the right of access (Art. 15); rectification (Art. 16); erasure (“right to be forgotten”, Art. 17); restriction of processing (Art. 18); data portability (Art. 20); to object to processing, including profiling and direct marketing (Art. 21); and rights regarding automated decision-making (Art. 22). You also have the right to withdraw consent at any time and the right to lodge a complaint with a supervisory authority in your EU member state.

Enquiries and requests may be directed to info@5squarehomes.com. Information about the purposes and lawful bases of processing, recipients, international transfers and safeguards, and retention is provided in Sections 5–10 above.

15. Annex B — Additional information for the United Kingdom (UK GDPR)

If you are located in the United Kingdom, the UK GDPR and Data Protection Act 2018 give you the same rights as set out in Annex A. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — https://ico.org.uk. Enquiries and requests may be directed to info@5squarehomes.com. We comply with the Privacy and Electronic Communications Regulations (PECR) in relation to cookies and electronic marketing, including obtaining consent for non-essential cookies and marketing messages.

16. Annex C — Additional information for the United States

We are not established in the United States and, given our size, we do not currently meet the applicability thresholds of state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), the Virginia CDPA, or the Colorado CPA. As a matter of good practice, however, if you are a US resident you may request to know what personal data we hold about you, request deletion or correction, and opt out of marketing. We do not sell or “share” (for cross-context behavioural advertising) your personal data. To make a request, contact us at info@5squarehomes.com. Our marketing emails to US recipients comply with the CAN-SPAM Act, including accurate sender information, a valid postal address, and a working opt-out honoured promptly.

17. Contact and complaints

If you are in Uganda and are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Office (PDPO) under the National Information Technology Authority – Uganda (NITA-U): https://www.pdpo.go.ug.