Privacy Policy

Draft v0.1 · Last updated: [date]

Who we are

[Company legal name] (“MwaRent”, “we”) of [registered address], Nairobi, Kenya, is the data controller for personal data collected through this website. Our registration number with the Office of the Data Protection Commissioner (ODPC) is [ODPC registration number].

Contact for data protection matters: [data protection contact email].

The law that applies

We process personal data in line with the Data Protection Act, 2019 of Kenya and its regulations.

What we collect on this website

• The “Request a pilot” form. Your name, WhatsApp number, email address, company or property name, number of units, the bank you use, how you track rent today, and the optional message you write. You must tick a consent box to send it. Sending the form does not create an account.
• Messages you send us. If you contact us on WhatsApp or by email instead, we receive your name, phone number or email address, and what you write.
• Spam protection. The form uses Cloudflare Turnstile to tell people from bots. Cloudflare may receive your IP address and browser signals to do this. The form also checks how long it took to fill in and has a hidden field that real visitors never see.
• Technical logs. Our hosting provider records standard request data such as IP address, browser type and the pages requested, for security and reliability.

This website does not use advertising cookies or analytics. [Confirm before launch.]

Why we use it, and on what basis

• To respond to your pilot request or message and arrange a walkthrough. Basis: steps you ask us to take, your consent, and our legitimate interest in answering enquiries. We do not use form details for anything else.
• To keep the form free of spam and abuse. Basis: legitimate interest.
• To keep the site secure and working. Basis: legitimate interest.
• To meet legal obligations. Basis: legal obligation.

We only collect what we need for these purposes and do not sell personal data. The form does not create an account, and we do not keep a database of form submissions: each request is sent to us as an email.

Landlord and tenant data inside MwaRent

When a landlord uses MwaRent, the landlord decides what tenant data is entered and why. For that data the landlord is the data controller and MwaRent acts as a data processor. The terms for that service will be set out in the customer agreement. [Draft: describe processor terms here.]

Who we share it with

We use these processors, only as needed to run the site and reply to you:

• Cloudflare (Turnstile): checks that a form submission comes from a person.
• Resend: delivers the form details to us by email. Data may be processed in the European Union.
• Vercel: hosts this website and runs the form’s server code.
• WhatsApp, if you choose to message us there.

[Confirm the full list of providers and their locations before launch.] If any of them process data outside Kenya, we will make sure the transfer meets sections 48 to 50 of the Data Protection Act.

How long we keep it

Pilot request details: [retention period, for example 12 months] after our last contact with you, unless you become a customer. Other enquiry messages: [12] months after our last contact. Server logs: [30] days. [Confirm periods before launch.]

Your rights

Under the Data Protection Act you may ask us to tell you what we hold about you, give you a copy, correct it, delete it, stop or limit how we use it, and object to certain uses. Write to [data protection contact email]. We will reply within the time the Act allows.

If you are not satisfied, you can complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Security and breaches

We use reasonable technical and organisational measures to protect personal data. If a breach is likely to put your rights at risk, we will notify the ODPC and affected people within the periods set by the Act.

Changes

We will update this page when our practices change and show the date at the top.