Privacy Policy

House for Rent Kenya ("HFR", "we", "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use houseforrentkenya.com, our concierge services, and our property management offerings.

We process personal data in accordance with the Constitution of Kenya (2010), the Kenya Data Protection Act, 2019 ("DPA"), and the Data Protection (General) Regulations, 2021. Our Data Protection Officer can be reached at info@houseforrentkenya.com.

We collect the following categories of personal data:

• Identification data — name, email, phone, national ID (landlords only), passport number (diaspora concierge only).

• Property data — listing details, photos, address, tenancy agreements, deposit records.

• Transaction data — M-Pesa STK receipts, Stripe charges, bank transfers, escrow balances.

• Usage data — pages visited, listings viewed, search queries, IP address, device and browser information.

• Communication data — WhatsApp, email, chat, and call records between you, our team, and (where applicable) the landlord.

We use your personal data to: (a) provide verified listings and concierge services; (b) process rent, deposit, and fee payments; (c) verify landlord identities and prevent fraud; (d) respond to your enquiries and provide customer support; (e) send you property alerts and newsletters (only with your opt-in consent, which you may withdraw at any time); (f) comply with our legal obligations under Kenyan law.

We do not sell your personal data to third parties. We do not use your personal data for direct marketing without your consent.

Under the DPA, we process your personal data on the following lawful bases:

• Consent — for marketing emails, property alerts, and non-essential cookies. You may withdraw consent at any time.

• Contract — to deliver the listings, concierge, and management services you've requested.

• Legal obligation — to comply with KYC, anti-fraud, tax, and court-order obligations under Kenyan law.

• Legitimate interest — to detect and prevent fraud, secure our platform, and improve our services. We balance this interest against your privacy rights and never use it to override those rights.

We share your personal data only in the following circumstances:

• With landlords (or tenants) you choose to engage via HFR — we share the contact details you've provided to enable the tenancy conversation.

• With payment processors (Safaricom M-Pesa, Stripe, Paystack, our bank) — to process payments you've authorised.

• With our service providers (hosting, email, SMS, analytics) — under written contracts that require them to protect your data to the same standard we do.

• With Kenyan regulators, law enforcement, or courts — where we are legally required to do so.

We never transfer your personal data outside Kenya without your explicit consent and a lawful transfer mechanism under the DPA.

We retain your personal data only for as long as necessary to provide the services you've requested, comply with legal obligations (typical Kenyan retention: 6–7 years for tax and contract records), and resolve disputes.

We use industry-standard security measures: HTTPS in transit, encrypted databases at rest, access controls, audit logging, and regular security reviews. Despite our efforts, no system is 100% secure — if a breach occurs that is likely to adversely affect your rights, we will notify you and the Office of the Data Protection Commissioner (ODPC) without undue delay, in line with section 43 of the DPA.

Under the Kenya Data Protection Act, 2019, you have the right to:

• Be informed — about how we process your data (this Policy).

• Access — request a copy of the personal data we hold about you.

• Rectification — correct inaccurate or incomplete data we hold about you.

• Deletion ("right to be forgotten") — request deletion where retention is no longer necessary or lawful.

• Restriction and objection — ask us to limit or stop processing your data.

• Data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, email our Data Protection Officer at info@houseforrentkenya.com. We respond to valid requests within 30 days, free of charge (we may charge a reasonable fee for manifestly unfounded or excessive requests).

We use essential cookies to keep you logged in and remember your saved searches. We use optional analytics cookies to understand how the platform is used and improve it. You can manage your cookie preferences at any time via the cookie banner on first visit.

We do not use cookies to track you across third-party websites or to serve behavioural advertising.

HFR is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have collected such data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be notified via email (where we have your email) or a prominent notice on the platform before they take effect.

If you have any questions about this Privacy Policy or how we process your personal data, please contact our Data Protection Officer at info@houseforrentkenya.com or by post at Westlands, Nairobi, Kenya.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) — see https://www.odpc.go.ke.