Legal
Privacy Policy
Effective date: 1 June 2026
1. Who We Are
RealtyFlow (“we”, “us”, “our”) operates the RealtyFlow real-estate marketplace and customer relationship management platform. We are a data controller under the Kenya Data Protection Act 2019 (Cap. 411C) and its subsidiary Data Protection (General) Regulations 2021.
Questions or requests about this policy may be sent to privacy@realtyflow.co.ke.
2. Personal Data We Collect
We collect personal data in the following circumstances:
- Account registration: name, email address, phone number, and password (stored as a one-way hash).
- Property inquiries: name, email address, and phone number submitted when you contact an agent or developer.
- Saved searches & wishlists: records of properties or projects you save and search filters you store.
- Usage data: pages viewed, search queries, and interaction logs, collected automatically via cookies and server logs.
- Device & technical data: IP address, browser type, and operating system collected automatically.
We do not collect special-category data (health, biometric, or national identity numbers) through the marketplace.
3. How We Use Your Data
| Purpose | Legal basis (DPA 2019) |
|---|---|
| Provide and operate your account | Performance of a contract (Art. 30(1)(b)) |
| Process and route your property inquiries to agents | Legitimate interests (Art. 30(1)(f)) |
| Send transactional emails (inquiry confirmations, notifications) | Performance of a contract |
| Personalise search results and recommendations | Consent / Legitimate interests |
| Improve our services and diagnose technical issues | Legitimate interests |
| Comply with legal obligations | Legal obligation (Art. 30(1)(c)) |
4. Sharing Your Data
We share your personal data only as described below:
- Real-estate agencies and agents: when you submit an inquiry, your name, email, phone, and message are shared with the agency that listed the property. That agency becomes an independent data controller for the purposes of following up with you.
- Service providers (data processors): we use third-party providers to operate our platform, including cloud hosting, email delivery, error-tracking, and analytics. See Section 7 for cross-border transfer details.
- Legal requirements: we may disclose data if required to do so by a court order, regulator, or law-enforcement authority under Kenyan law.
We do not sell your personal data to third parties.
5. Inquiry Data & CRM Disclosure
When you submit an inquiry through RealtyFlow, your contact details (name, email, and phone number) are transferred into the receiving agency’s internal CRM system and treated as a sales lead. The agency will use this information to contact you regarding the property you enquired about. You may contact the relevant agency directly to exercise your data subject rights in relation to that record.
6. Data Retention
- Buyer accounts: retained while your account is active. You may delete your account at any time from your account settings.
- Inquiry records: retained by us for up to 12 months from submission, after which they are deleted or anonymised.
- Usage and technical logs: retained for up to 90 days.
- Email communications: retained for up to 24 months for legal and dispute-resolution purposes.
7. International Data Transfers
We use service providers whose infrastructure is located outside Kenya, including in the United States and the European Union. These transfers are necessary to operate the platform and are carried out under appropriate safeguards, including contractual clauses consistent with the requirements of the Kenya Data Protection Act 2019, Section 48 (cross-border transfers).
Categories of data transferred internationally include account identifiers, usage data, and error-reporting data. We do not transfer special-category data internationally.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erasure (“right to be forgotten”) of your data where there is no overriding legitimate reason to retain it.
- Restrict processing in certain circumstances.
- Data portability — receive a copy of your data in a machine-readable format.
- Object to processing based on legitimate interests or direct marketing.
- Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, email us at privacy@realtyflow.co.ke. We will respond within 21 days as required by law.
9. Security
We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, hashed password storage, access controls, and regular security reviews. No system is completely secure; in the event of a data breach that is likely to affect your rights, we will notify the Office of the Data Protection Commissioner (ODPC) and affected individuals within 72 hours as required by law.
10. Cookies
We use essential cookies required for the platform to function (e.g. session management) and analytics cookies to understand how visitors use the site. You may adjust cookie preferences via your browser settings; disabling essential cookies may prevent some features from working.
11. Children
Our services are not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with their data, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users by email and update the effective date above. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.
13. Complaints
If you are not satisfied with how we handle your data, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.