Privacy Policy
1. Who We Are
SafeProperty Ltd ("SafeProperty", "we", "our", "us") operates the SafeProperty platform — a Kenya-based property marketplace accessible at safeproperty.co.ke and via our mobile applications. We are incorporated under the laws of Kenya (Company No. PVT-XXXX).
Questions about this policy may be directed to our Data Protection Officer at privacy@safeproperty.co.ke.
2. Data We Collect
We collect information you provide directly and data generated by your use of the platform:
Account data: Full name, email address, phone number, and password (stored as a one-way hash).
Profile data: Profile photo, bio, agency affiliation, National ID / Passport number (for KYC verification only).
Property listings: Addresses, photos, floor plans, pricing, and descriptions you submit.
Transaction data: M-Pesa transaction references, subscription records, and payment history.
Usage data: Pages visited, searches performed, properties viewed, device type, IP address, and browser.
Communications: Messages sent between users on the platform, inquiry content, and viewing requests.
3. How We Use Your Data
We use collected data to:
• Provide, maintain, and improve the SafeProperty platform.
• Process payments and manage subscriptions.
• Verify user identity and property ownership (KYC/AML compliance).
• Send transactional emails and SMS (e.g. lease reminders, payment alerts).
• Power AI-driven search recommendations and property matching.
• Detect and prevent fraud, abuse, and policy violations.
• Comply with Kenyan legal obligations, including the Data Protection Act 2019.
4. Legal Basis for Processing
We process personal data on the following bases under the Kenya Data Protection Act 2019:
Contract performance: To deliver services you have signed up for.
Legitimate interests: To prevent fraud, improve our services, and communicate relevant updates.
Legal obligation: To comply with KRA reporting, anti-money laundering (AML), and other statutory requirements.
Consent: For marketing communications and optional features (you may withdraw consent at any time).
5. Data Sharing
We do not sell your personal data. We share data only with:
Service providers: Cloud hosting (AWS / Azure), SMS gateway (Africa's Talking), M-Pesa (Safaricom), and email delivery (SendGrid) — bound by data processing agreements.
Other users: Your name, property listings, and contact details you make public are visible to other platform users as intended.
Regulators: Where required by law (e.g. Kenya Revenue Authority, Office of the Data Protection Commissioner).
6. Data Retention
We retain account data for as long as your account is active. Deleted accounts are anonymised within 30 days, except where retention is required by law (e.g. financial records kept for 7 years under Kenyan tax law). Property listings are soft-deleted and purged after 12 months of inactivity.
7. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to:
• Access a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure ("right to be forgotten") where no legal retention obligation applies.
• Restrict or object to certain processing activities.
• Portability — receive your data in a machine-readable format.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
To exercise any right, email privacy@safeproperty.co.ke. We will respond within 21 days.
8. Cookies
We use session cookies to keep you logged in and functional cookies to remember your preferences. We do not use third-party advertising cookies. You can disable cookies in your browser settings, though this may affect platform functionality.
9. Security
We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, and role-based access controls. Despite our efforts, no transmission over the internet is 100% secure. Report suspected vulnerabilities to security@safeproperty.co.ke.
10. Changes to This Policy
We may update this policy periodically. Material changes will be communicated by email or via a prominent notice on the platform at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.