Privacy notice

Who holds your information

Lavender Properties Ltd, an estate agency in Nairobi, is the data controller for the information described here. Yutie Consulting operates the Leads system on the agency's behalf and acts as a data processor. Neither party sells your information and neither party shares it for advertising.

What is held, and why

If you have made an enquiry. Your name, your telephone number, your email address where you gave one, the property or area you asked about, how you reached us, and the notes an agent made while working with you. This is held so that somebody can answer you, arrange a viewing, and complete a letting or a sale.

If you work at the agency. Your name, your nickname, your work email address and telephone number, your role, the leads you posted or claimed, the commission attributed to you, and a record of when you signed in. This is held to run the business and to pay people correctly.

The lawful basis

Answering an enquiry you made is handled on the basis of taking steps at your request before entering a contract, and on the agency's legitimate interest in running an estate agency. Staff records are handled on the basis of the employment relationship.

Where your information is used to market other properties to you, that is done on your express consent under section 37 of the Data Protection Act 2019, recorded against your enquiry with the date you gave it. You may withdraw that consent at any time and it costs you nothing to do so.

How long it is held

Each kind of record has a retention period, and a scheduled job enforces it under section 25 of the Act. Enquiries that came to nothing are reduced to an anonymous record within twelve months. Records connected to a signed tenancy or sale are held while a question about that transaction could still reasonably arise. The current periods are listed on the data protection page inside the system.

When a record reaches its period, the personal details are removed and the anonymous commission record is kept, because the agency must be able to show who was paid what and when.

How it is protected

Access is limited by role, and every person can reach only what their work requires. Client names, telephone numbers and email addresses are encrypted where they are stored. Every claim, approval, payment and permission change is written to an append only trail that nobody, including the administrator, can edit or delete. These are the measures required by sections 41 and 42 of the Act.

Your rights

You may ask what is held about you, ask for it to be corrected, ask for it to be erased, object to how it is used, and ask for a copy in a portable form. Write to the agency and the request is logged and answered. Where a request would remove a record the agency must keep for its own accounts, the personal details are removed and the anonymous financial record remains.

If a landlord, tenant or buyer is in the European Union, the equivalent rights under the General Data Protection Regulation are honoured in the same way.

Where it sits

The system and its database run on hosting used by the agency. Where a measurement connection is switched on, aggregate figures are retrieved from that provider; no client name or telephone number is ever sent to any advertising or analytics platform.

If you are not satisfied

Raise it with the agency first, because most things are settled quickly. If you remain unsatisfied you may complain to the Office of the Data Protection Commissioner, which regulates the handling of personal information in Kenya.

A note on this document

This document describes controls that are built and working. It is not legal advice. An advocate should confirm the retention periods, the consent wording and the ODPC registration before the system holds live client data.