Privacy Policy

Last updated: 26 May 2026

Draft. This Privacy Policy is a working draft published for transparency ahead of public launch. It will be reviewed by counsel and finalised before EzRent is opened to the public. If anything here is unclear, please write to privacy@ezrent.co.ke.

EzRent Kenya Ltd ("EzRent", "we") is committed to protecting personal data and to complying with the Kenya Data Protection Act, 2019 and regulations made under it. This Policy explains what personal data we collect, why, who we share it with, and the rights individuals have. For details specific to landlords as data controllers and EzRent as data processor, see our Data Protection statement.

1. Who this policy applies to

  • Landlords and property managers who hold accounts on EzRent;
  • Tenants and applicants whose data is uploaded by landlords or who use the FindHome listing site or tenant portal;
  • Visitors to ezrent.co.ke and our marketing pages;
  • Suppliers and partners who interact with us.

2. What we collect

We collect only what we need to operate the Service:

  • Account data, names, email, phone number, role, password hash, MFA secrets.
  • Tenant records uploaded by landlords, names, ID/passport numbers, contact details, employer/guarantor information, lease terms, charges and payments. Landlords are the controllers of this data; we process it on their instructions.
  • Payment and reconciliation data, M-Pesa transaction codes and amounts received from Safaricom Daraja, bank-statement entries you import, invoice/receipt records.
  • Property data, property addresses, unit information, photos, documents you upload.
  • Communications, messages exchanged with tenants via SMS, WhatsApp, or email through the Service.
  • Technical data, IP address, browser, device identifiers, pages viewed, error logs, security events.
  • Cookies, strictly necessary cookies for authentication and CSRF protection; analytics cookies only with consent.

We do not intentionally collect special-category personal data (health, biometric, sexual life, political views) and we ask customers not to upload it.

3. Why we collect it (lawful bases)

Under section 30 of the Data Protection Act, our lawful bases are:

  • Performance of a contract, to deliver the Service to landlords and to allow tenants to use the tenant portal.
  • Compliance with a legal obligation, to retain transaction and tax records as required by Kenyan law (e.g. Income Tax Act, VAT Act, KRA eTIMS).
  • Legitimate interests, securing the platform, preventing fraud, debugging, and improving the product, balanced against your privacy rights.
  • Consent, for optional analytics cookies and marketing communications, which you can withdraw at any time.

4. Who we share data with

We never sell personal data. We share with a limited set of vetted sub-processors who help us operate the Service. The current list:

  • Safaricom PLC (M-Pesa Daraja), payment authorisation and reconciliation.
  • Kenya Revenue Authority (eTIMS), invoice transmission where required.
  • AfricasTalking, SMS delivery to tenants and landlords.
  • WhatsApp Business / Meta Platforms, tenant messaging where the customer has enabled it.
  • Resend, transactional and notification email.
  • Cloudflare Inc., content delivery, DDoS protection, and R2 object storage for documents and photos.
  • Sentry, error and performance monitoring.
  • Cloud infrastructure providers, for hosting the Service in the EU / South Africa region.

We will publish a full sub-processor list and notify customers of material changes in advance. We may also disclose data to law enforcement or regulators where required by law (court order, ODPC investigation, KRA request) and we will notify affected customers unless legally prohibited.

5. Cross-border transfers

Some sub-processors are based outside Kenya. Where personal data is transferred outside Kenya, we rely on the conditions in section 49 of the Data Protection Act and, where appropriate, contractual safeguards equivalent to standard contractual clauses.

6. How long we keep data

We retain account data for as long as the Service is in use, plus seven years after termination to meet Kenyan tax and audit retention requirements. Backups are rotated on a 90-day cycle. Photos and documents are deleted within 30 days of customer request unless retention is required by law.

7. Security

We encrypt personal data in transit (TLS 1.2+) and at rest. Access to production systems is restricted to a small number of staff under multi-factor authentication and logged. M-Pesa webhook endpoints are signed and IP-restricted. We maintain an immutable audit log of changes to financial records.

8. Your rights under the Data Protection Act

You have the right to:

  • Be informed about how your data is used (this Policy);
  • Access your personal data and request a copy;
  • Have inaccurate data corrected;
  • Object to processing in specified circumstances;
  • Request deletion where there is no continuing lawful basis;
  • Withdraw consent where consent is the basis for processing;
  • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

Tenants whose data was uploaded by a landlord should first contact that landlord, who is the controller. We will pass requests on if needed.

9. Children

The Service is not directed to children under 18. If you believe we have collected data about a child without parental consent, please contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email and in-app at least 14 days before they take effect.

11. Contact

For privacy questions, requests, or to exercise your rights, email privacy@ezrent.co.ke or write to:

EzRent Kenya Ltd
Data Protection Office
Nairobi, Kenya