Privacy Policy

GETYOURHOME Limited is the data controller for personal data processed through the Platform, registered with the Office of the Data Protection Commissioner (ODPC) as required under section 18 of the Act. This policy applies to every person who visits, browses, registers on, or otherwise interacts with the Platform, in every role the Platform supports: a Seeker looking for a home, plot or commercial space; a Landlord/Owner listing property they own; an Agent/Broker representing buyers, sellers or landlords; a Developer/Investor managing a portfolio or new-development project; a Service Provider listed in our directory; or a member of a Provider's team invited into their workspace.

Where GETYOURHOME acts as a data processor rather than controller — for example, financial records a Provider enters into their own workspace's console for their own bookkeeping — that data remains under the Provider's control as the data controller for their guests' and clients' information, and this policy describes GETYOURHOME's obligations as their processor, addressed separately in section 9.

We collect only what the Platform genuinely needs to function, verify trust, and keep you safe — never data collected speculatively for resale or undisclosed profiling. In full, the categories are:

Most data comes directly from you: information you type when you register, list a property, message another user, or update your profile. Some is generated automatically by your use of the Platform (usage and device data, above). A smaller amount comes from third parties acting on our instructions and yours — principally our identity-verification partner confirming a KYC check you initiated, and our payment partner (Safaricom M-Pesa, via Daraja) confirming a subscription payment you made. We do not purchase data about you from data brokers, and we do not receive data about you from third-party advertising networks, because the Platform carries no advertising.

Kenya's Data Protection Act, 2019 requires that every instance of processing personal data have a lawful basis. Depending on the specific processing activity, we rely on one or more of the following, each specified in the relevant section below:

We process personal data to: create and administer your account and workspace; publish, search and rank Listings by trust score, verification level and freshness — never by payment, per our zero-advertising commitment; run the trust-verification system described in our Trust & Verification page, including the KYC, ownership and proof-of-life checks; facilitate consent-gated introductions between Seekers and Providers; process subscription payments; operate Safe-Meet viewing confirmations; provide the Financial Suite, calendar, booking inbox, team-permission and reporting tools included in Provider plans; detect and prevent fraud, scam reports, duplicate listings and abusive conduct; send you service communications (account, security, transaction) and, only with your separate opt-in, the GETYOURHOME Brief newsletter; and comply with our legal and regulatory obligations. We never process your data to build an advertising profile of you, to sell to third parties, or to influence a Trust Score by payment — the last of these is structurally impossible, as described on our Trust & Verification page.

This is the single most important promise in this policy. A Seeker's phone number and email are never shown to a Landlord, Agent or Developer/Investor automatically. Contact details are released only after the Seeker takes an explicit, in-app consent action — for example, sending an inquiry or confirming a Safe-Meet viewing — and every reveal is individually logged with a timestamp, the Provider it was shared with, and the action that triggered it, so the full history is auditable by you at any time from your account.

Because GETYOURHOME carries zero advertising and sells zero placement, there is no commercial mechanism by which any Provider can pay to see your contact details faster, more often, or without your consent. This is not a policy we could quietly change without also rewriting the product; it is structural.

The Trust Score shown on every Listing and provider profile is computed automatically from weighted, published components (verification-ladder progress, proof-of-life freshness, review history, response rate, listing completeness, completed Safe-Meet viewings and account tenure), with automatic penalty deductions for confirmed fraud, scam reports, duplicate photos and overdue re-verification. This is automated processing under section 35 of the Act. It does not, on its own, produce a legal or similarly significant effect on you of the kind that would trigger a right to demand human review under section 35(2) — a low Trust Score affects ranking visibility, not your legal rights — but in the interest of transparency we go further than the Act requires: the full formula, every weight and every penalty is published in full on our Trust & Verification page, and the only way a score can be manually touched at all is a documented, audit-logged fraud review, never a routine edit.

We do not sell your personal data. We share it only with the following categories of recipients, each under a data-processing agreement that binds them to use it solely for the purpose we specify and to Kenyan data-protection standards:

Some of our processors (including cloud hosting and Cloudinary) may process data on servers located outside Kenya. Where we transfer personal data outside Kenya, we do so only where the Act's section 48 conditions are met — either the recipient jurisdiction has adequate data-protection safeguards, or we have contractual clauses in place with the processor that impose Kenya-equivalent protections, or the transfer is necessary for the performance of a contract with you (for example, delivering an image you uploaded via a global content-delivery network). We do not transfer data internationally for any purpose beyond operating the Platform's genuine technical infrastructure.

We keep personal data only for as long as we can justify a specific purpose for it:

We apply layered technical and organisational security measures proportionate to the sensitivity of the data involved, including: encryption of data in transit (TLS) across the entire Platform; hashed, salted password storage (scrypt) such that we cannot ourselves read your password; strict organisation-level data isolation enforced at the database query layer, not merely in the interface, so one Provider's workspace can never see another's data even in the event of an application bug; role-based permission controls within every workspace; rate limiting and automated fraud-signal detection; and an internal audit log for every sensitive administrative or fraud-review action. No system is perfectly secure, and in the unlikely event of a data breach affecting your personal data, we will notify the ODPC without undue delay as required by section 43 of the Act, and will notify you directly where the breach is likely to result in a risk to your rights and freedoms.

Sections 26 and 34–39 of the Act give you the following rights over your own personal data, all of which we honour in practice, most of them instantly and self-service from your account settings, without needing to submit a formal request:

The Platform is intended for use by persons who have reached the age of legal majority in Kenya (18 years) and are capable of entering a binding contract, consistent with our Terms of Use. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

We use only strictly necessary cookies: an authenticated-session cookie so you stay signed in, and a locale-preference cookie so the Platform remembers whether you prefer English or Kiswahili. We do not use third-party advertising or cross-site tracking cookies, because the Platform carries no advertising and builds no advertising profile of you. Because these cookies are strictly necessary for the Platform to function, no separate cookie-consent banner is required under the Act's guidance; you can still clear cookies at any time through your browser settings, which will simply sign you out.

The Platform may link to third-party websites (for example, a Provider's own external website, or a government registry we reference for verification methodology). This policy does not extend to those third-party sites, and we encourage you to review their own privacy practices before providing them with personal data.

We may update this policy as the Platform evolves or as Kenyan data-protection law changes. Where a change is material, we will notify active users in-app or by email in advance of it taking effect, and the "Last updated" date at the top of this page will always reflect the current version. Continued use of the Platform after a change takes effect constitutes acceptance of the revised policy; if you do not agree with a material change, you may close your account under section 11.

For any question, request or concern about your personal data — including exercising any right listed in section 11 — reach our team through the Help Center, or write to our Data Protection contact point referenced there. We aim to substantively respond to every data-subject request within the timelines set by the Act.

If you believe we have not adequately addressed your concern, or you wish to raise it independently, you may contact the Office of the Data Protection Commissioner of Kenya directly: Office of the Data Protection Commissioner, Britam Towers, Nairobi, Kenya — odpc.go.ke. Exercising this right does not require you to raise the matter with us first.