Privacy Policy

PropiyoKE Ltd ("PropiyoKE", "we", "us") operates the PropiyoKE property management platform. We are the data controller for personal data processed through our platform, as defined under the Kenya Data Protection Act 2019 (DPA 2019).

Our Data Controller registration details are available on request. For all privacy-related enquiries, contact our data lead at edgarjerry0@gmail.com.

We collect the following categories of personal data:

Account holders (landlords / property managers)

• Full name, email address, phone number
• Business or company name (if applicable)
• Property addresses and unit details
• Subscription and billing history
• Login activity and session data

Tenant data (entered by you, the account holder)

• Tenant full name, national ID number, phone number, and email
• Lease dates, monthly rent, and payment history
• M-Pesa transaction references associated with rent payments
• Maintenance request descriptions submitted by or on behalf of tenants

Technical data

• IP address, browser type, device identifiers
• Pages visited, features used, and error logs
• Cookies and similar tracking technologies (see Section 8)

We process personal data on the following legal bases under DPA 2019:

• Performance of a contract — to create your account, provide the platform, process subscription payments, and deliver support.
• Legitimate interests — to improve platform features, detect fraud, ensure security, and send product updates directly related to your use.
• Legal obligation — to retain financial records as required by Kenyan tax and companies law.
• Consent — for optional marketing communications. You can withdraw consent at any time by unsubscribing or contacting us.

Tenant data specifically: As an account holder, you are a data controller in your own right for the tenant personal data you enter. You are responsible for ensuring you have a lawful basis (typically your lease agreement) for recording and processing that data, and for informing tenants that their information is held on PropiyoKE.

When you use the M-Pesa sync feature, PropiyoKE receives transaction reference numbers, amounts, dates, and the sender's phone number from Safaricom's API. This data is stored against the relevant tenant's payment record in your account.

PropiyoKE does not store M-Pesa PINs, card numbers, or full financial account credentials. Safaricom's own privacy policy governs the data held on their systems.

We do not sell your personal data. We share data only in these limited circumstances:

• Service providers: Cloud infrastructure and hosting providers who process data on our behalf under data processing agreements. These providers are bound to process data only on our instructions.
• Safaricom / M-Pesa: To enable payment synchronisation as described above.
• Legal requirements: Where we are required to disclose data by a court order, government authority, or applicable Kenyan law.
• Business transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users before any such transfer.

We retain personal data for as long as necessary for the purposes described above:

• Active accounts: Data is retained for the duration of your subscription.
• After account closure: We retain your data for up to 30 days to allow export, then delete it from active systems. Backups may retain data for a further 90 days.
• Financial and lease records: Retained for 7 years from the end of the relevant tenancy or billing period, in line with Kenyan tax and tenancy law requirements.
• Security logs: Retained for 12 months.

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Request deletion of your data where we no longer have a lawful basis to retain it.
• Restriction: Ask us to restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Data portability: Receive your data in a machine-readable format.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at edgarjerry0@gmail.com with the subject line "Data Rights Request". We will respond within 21 days as required by DPA 2019. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC).

PropiyoKE uses essential cookies required for authentication and session management. We also use analytics cookies (first-party only) to understand how the platform is used and improve it.

We do not use third-party advertising cookies or sell data to ad networks. You can control cookies through your browser settings, though disabling essential cookies will prevent you from logging in.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS), access controls, and regular security reviews.

No system is completely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ODPC within 72 hours of becoming aware of it, as required by DPA 2019.

PropiyoKE is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected a child's data, contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. We will notify you by email or in-app notice at least 14 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

For any privacy questions, data rights requests, or concerns, contact us:

• Email: edgarjerry0@gmail.com
• WhatsApp: 0757 923 876
• Response time: within 2 business days for general enquiries; 21 days for formal data rights requests