Privacy Policy

1. Introduction

RentSpace ("we", "us", "our") is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have over your data.

We process personal data in accordance with the Kenya Data Protection Act, 2019 and applicable subsidiary regulations issued by the Office of the Data Protection Commissioner (ODPC).

By using the Platform, you consent to the practices described in this Privacy Policy.

2. Who We Are (Data Controller)

The data controller responsible for your personal information is:

• RentSpace Kenya
• Kitengela, Kajiado County, Kenya
• Email: info@rentspace.co.ke
• Phone: +254 723 562 484

For any data protection queries, you can reach our designated data contact at info@rentspace.co.ke.

3. Information We Collect

3.1 Information You Provide

• Account data: name, email, phone number, password (hashed), role (customer, agent, landlord).
• Profile data: optional agent information (company name, bio, website).
• Listing data: property details (title, description, price, location, images, amenities).
• Payment data: M-PESA transaction codes, subscription history. We never store your M-PESA PIN or full mobile wallet credentials.
• Communication data: messages sent to our support team via email or WhatsApp.

3.2 Information Collected Automatically

• Device data: browser type, operating system, device type.
• Usage data: pages viewed, time on page, click patterns (aggregated).
• Log data: IP address, referring URL, timestamp of access.

3.3 Information from Third Parties

• Google Sign-In: if you log in via Google, we receive your name, email, and profile picture URL.
• Payment processors: payment confirmation and transaction reference from IntaSend.

4. How We Use Your Information

We use your personal data for the following purposes:

• Providing the service: creating and managing your account, publishing listings, processing subscriptions.
• Payment processing: initiating M-PESA STK pushes, confirming payments, activating subscriptions.
• Communication: sending verification emails, password resets, subscription confirmations, renewal reminders, and service updates.
• Platform safety: detecting fraud, abuse, and violation of our Terms of Service.
• Improvements: analysing usage patterns to enhance the Platform.
• Legal compliance: complying with tax, accounting, and law enforcement obligations.

5. Legal Basis for Processing

Under the Kenya Data Protection Act 2019, we process personal data based on the following legal grounds:

• Contractual necessity: processing required to deliver the service you have signed up for.
• Consent: where you have explicitly agreed (e.g., marketing emails).
• Legitimate interest: improving the Platform, ensuring security, preventing fraud.
• Legal obligation: complying with applicable Kenyan laws.

6. Cookies & Similar Technologies

We use cookies and browser local storage to:

• Keep you signed in between sessions.
• Remember your display preferences.
• Analyse Platform performance (aggregate, not personal).
• Prevent fraudulent activity.

You can disable cookies in your browser settings, but doing so may affect Platform functionality (especially login).

7. Data Sharing & Disclosure

We do not sell your personal data. We share data only with:

• Service providers: Cloudinary (image hosting), IntaSend (payment processing), Resend (email delivery), MongoDB Atlas (database hosting), Render (server hosting), Google (OAuth authentication).
• Listing visibility: your property contact details (phone, email) may be displayed on public listings for active subscribers.
• Legal authorities: when required by law, court order, or to investigate fraud.
• Business transfers: in the event of a merger or acquisition, data may be transferred to the successor entity.

All third-party service providers are contractually required to protect your data and use it only for the agreed purpose.

8. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

• Active accounts: while your account remains active.
• After account closure: up to 24 months for legal, tax, and fraud-prevention reasons.
• Payment records: 7 years as required by Kenyan tax law.
• Listing history: archived listings retained for up to 12 months after expiry.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Password hashing using bcrypt (industry-standard).
• HTTPS encryption for all data transmitted to and from the Platform.
• JWT-based session tokens with expiration.
• Rate limiting and account lockout to prevent brute-force attacks.
• Regular security reviews of third-party dependencies.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Your Rights Under the Kenya DPA

You have the following rights regarding your personal data:

To exercise any of these rights, email info@rentspace.co.ke. We will respond within 30 days.

11. Marketing Communications

We may send you service-related emails (account verification, password reset, subscription confirmations, renewal reminders) as part of using the Platform. These are transactional and cannot be opted out of while your account is active.

We may occasionally send promotional emails about new features, plans, or partner offers. You can opt out of these at any time by:

• Clicking the "Unsubscribe" link in any promotional email.
• Emailing info@rentspace.co.ke with "Unsubscribe" in the subject.

12. Third-Party Services

Our Platform relies on the following third-party services, each with their own privacy practices:

• Cloudinary — image hosting and optimisation
• IntaSend — M-PESA payment processing
• Resend — transactional email delivery
• MongoDB Atlas — secure database hosting
• Render — server and application hosting
• Google — optional sign-in via Google OAuth

We encourage you to review their respective privacy policies for more information.

13. Children's Privacy

RentSpace services are intended for adults aged 18 and over. We do not knowingly collect information from individuals under 18 years of age. If we discover such information, we will delete it immediately. Parents or guardians who believe their child has provided us with personal information should contact us at info@rentspace.co.ke.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email or a prominent notice on the Platform. The "Last Updated" date at the top will always reflect the most recent revision.

Continued use of the Platform after changes constitutes acceptance of the updated policy.

15. Contact Us

For any questions, requests, or concerns about this Privacy Policy or your personal data, please contact: