Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how Kilifi Real Estate ("Company," "we," "us," or "our") collects, processes, uses, stores, and discloses personal information obtained through the Platform's website, web application, mobile application, APIs, and related services (collectively, the "Platform").

This Policy applies to: all registered Users (Property Owners, Agents, Tenants, Buyers, Guests, and Administrators); unregistered Visitors; and individuals whose information is submitted by other Users.

Regulatory Framework. We process personal data in compliance with the Data Protection Act, 2019 (Kenya), the Kenya Information and Communications Act (Cap. 411A), and where applicable, the EU General Data Protection Regulation (GDPR).

Data Controller. Kilifi Real Estate is the data controller of personal information collected through the Platform.

2. Information We Collect

We collect information you provide directly, information generated through Platform use, and information from third parties.

2.1 Personal Information

2.2 Account Information

Name, email, phone, encrypted password, account role, profile photo, and activity timestamps.

2.3 Listing and Property Data

Property address, GPS coordinates, type, pricing, description, amenities, photos/videos, availability calendar, and listing status (Featured/Verified).

2.4 Transaction Data

Payment amounts, currency, dates, payment method, gateway references, booking records, rental applications, and sale inquiry details.

2.5 Device and Technical Data

IP address, device type, browser, OS, referral URLs, pages visited, session duration, and error/crash logs — collected automatically on access.

2.6 Information from Third Parties

Data from payment processors (fraud signals), Google OAuth (name, email, photo), and verification partners.

3. How We Use Your Information

4. Legal Bases for Processing

5. Data Sharing and Third Parties

We do not sell your personal data.

5.1 Other Users. Listing details, owner/agent names, and contact info are visible to prospective Tenants, Buyers, and Guests as needed. In-platform messages are shared with the intended recipient only.

5.2 Service Providers. We engage third-party processors including:

5.3 Legal Disclosures. We may disclose data to comply with legal obligations, court orders, or lawful government requests.

5.4 Business Transfers. In a merger or acquisition, data may transfer to the acquiring entity with prior notice to you.

6. Payment Processor Data Handling

7. Data Retention Policy

8. Data Security Measures

Our security measures include:

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Industry-standard password hashing (bcrypt)
• Payment tokenisation via PCI-DSS compliant processors
• Role-based access control (RBAC)
• CSRF protection, SQL injection prevention via ORM
• API rate limiting via Laravel Sanctum
• Regular security audits and penetration testing

Breach Notification. We will notify the Office of the Data Protection Commissioner of Kenya within 72 hours and affected Users without undue delay in the event of a reportable data breach.

9. International Data Transfers

Data may be processed outside Kenya by cloud and infrastructure providers (e.g., AWS, Stripe, Google). We implement appropriate safeguards including contractual clauses, recognised security certifications (PCI-DSS, ISO 27001), and GDPR Standard Contractual Clauses where applicable.

10. Your Data Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

To exercise any right, email: privacy@kilifirealestate.co.ke

You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

11. Cookie Policy

Cookies are small text files placed on your device when you visit the Platform.

You can manage cookies through your browser settings. Disabling strictly necessary cookies (e.g., session cookies) may impair login and transaction functionality.

12. Children's Privacy

The Platform is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors.

If you believe your child has provided data to us, contact privacy@kilifirealestate.co.ke and we will delete the information promptly.

13. Marketing Communications and Opt-Out

Where permitted by law or with your consent, we may send property recommendations, newsletters, and promotional content.

You may opt out at any time by:

• Clicking "Unsubscribe" in any marketing email;
• Updating notification preferences in Account Settings;
• Emailing privacy@kilifirealestate.co.ke.

Opting out does not affect transactional or security communications (e.g., booking confirmations, payment receipts).

14. Automated Decision-Making and Profiling

The Platform uses automated processes for search ranking, fraud detection, and property recommendations. These do not constitute fully automated decision-making with legal or similarly significant effects. Contact privacy@kilifirealestate.co.ke with any concerns.

15. Changes to this Privacy Policy

We may update this Policy from time to time. Material changes will be notified via email to your registered address, a prominent Platform notice, and an updated "Last Updated" date. Continued use after the effective date constitutes acceptance.

16. Contact Information