Privacy Notice
How GERAN handles your personal data, under the Personal Data Protection Act 2010 (PDPA).
Who handles your data
GERAN (gerantanah.com) is operated by GeranTanah (GT). GT is the data user responsible for the personal data described here.
What is collected, and why
When you create an account
Full name, phone number, email address, and a one-way encrypted form of your password.
To identify you, let you log back in, and contact you about your listings. Your password is stored as a bcrypt hash — nobody at GT can read it.
When you log in
The date and time of each successful login, linked to your account.
So GT can see how the platform is being used and spot unusual account activity.
When you list land
A copy of your name, phone number and email attached to the listing, the land details you enter, photos you upload, and the full copy of the land title you attach as a PDF.
The title copy lets GT check the lot details, caveats, charges and any restriction in interest before your land is published. Buyers never see it.
When you contact GT about buying land
Your name, phone number and email, what you are looking for (budget, state, land type, size, cash or loan), notes from calls and WhatsApp messages, viewing appointments, offers, and — if you buy — the booking, payment and sale documents.
So a GT consultant can follow up with you, suggest land that matches what you want, arrange site viewings and handle the sale. If you also have a GERAN account with the same email, GT can see the listings you saved as favorites.
When you save a favorite
Which listings you have saved.
So your saved land is there when you come back.
Providing this data is voluntary, but without it GT cannot create your account or publish your land, because there would be nothing to verify and no way to reach you.
What is shown publicly
When a listing is approved, the public directory shows the land details, the photos, and whether the listing came from GT, KJ Land Consultant or a land owner. Your name, phone number and email are not published, and neither is the copy of the land title. Buyers reach you through GT.
Who else sees it
Your data is seen by GT staff who review listings, and — for buyers — by the GT consultant assigned to help you. It is stored on service providers GT uses to run the site — Supabase for the database, Vercel for hosting and file storage, and an email provider for the verification codes. Human verification on the account forms is handled by Cloudflare Turnstile. GT does not sell your data and does not share it for advertising.
GERAN does not run Google Analytics, advertising pixels, or any other third-party tracking on its pages.
Cookies and visit counts
GERAN counts how many people visit the site and how often each listing is viewed, so GT can see which land attracts interest. The counts are totals per day only — no IP address, device details or browsing history are recorded, and nothing is linked to you or your account.
To avoid counting the same visitor twice in a day, the site sets one small cookie named gt_hari. It holds only the date of your last visit and expires after about a day and a half. If you are signed in, a separate cookie keeps you logged in. Neither cookie is used for advertising or shared with anyone.
How long it is kept
Account data is kept while your account is open. An unfinished sign-up — where the emailed code was never confirmed — is discarded automatically once the code expires. Listings and their title copies are kept for as long as the listing exists, and afterwards only as long as GT needs them as a record of what was published.
Buyer enquiry records are kept while GT is helping you find land. Records of a completed purchase — the sale price, payments and documents — are kept as long as GT needs them for its business and legal records.
Your rights
- Ask for a copy of the personal data GT holds about you.
- Ask GT to correct anything inaccurate or out of date.
- Withdraw your consent and ask for your account and data to be deleted.
- Limit how GT processes your data, or object to a particular use of it.
To exercise any of these, email info@gerantanah.com. Deleting your account also removes your listings from the directory.
Keeping it safe
Passwords are stored as bcrypt hashes, never in readable form. Copies of land titles are stored as private files and can only be opened through the GT admin dashboard after signing in — the file links do not work on their own. Repeated failed login attempts lock an account temporarily.
Changes to this notice
If GT changes how it handles your data, this page is updated. Keeping your account open after a change means you accept the updated notice.
This notice explains GT's current practice. It is not legal advice — if you need advice about your own obligations, speak to a lawyer.