Privacy Policy

Section 1

Overview

Nyumba254 ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect when you use Nyumba254, how we use it, and what choices you have.

This policy applies to all users of Nyumba254 — including buyers, renters, sellers, and landlords — accessing the platform via any device.

By using Nyumba254 you agree to the collection and use of information as described in this policy. If you do not agree, please stop using the platform.

        Data controller: Nyumba254 operates as the data controller for personal information collected on this platform. For any privacy enquiries contact us at hello@nyumba254.co.ke.
      

Section 2

Data we collect

We collect personal data in the following ways:

Data type	What we collect	When
Account info	Full name, email address, phone number, password (hashed)	When you register as a seller
Listing info	Property details, photos, price, area, contact phone number	When you post a listing
Enquiry info	Buyer name, phone number, and message content	When a buyer sends an enquiry
Viewing request info	Viewer name and phone number, requested date and time, notes, disclosed viewing-fee snapshot, and whether the viewer acknowledged the fee	When a buyer requests a viewing
Lister Page analytics	Page or listing event, approved traffic-source label, date, and a random session identifier. Public Lister Pages show the profile details the lister has made public, their selected role, and whether that role is verified.	When source analytics are enabled and a visitor uses a Lister Page
Payment info	M-Pesa phone number, transaction reference, amount paid	When you pay a listing fee
Usage data	Pages visited, search queries, browser type, IP address	Automatically when you use the site
Communications	Emails or messages sent to our support team	When you contact us

We do not collect your national ID number, bank account details, or any sensitive personal data beyond what is listed above. Role labels on public Lister Pages are selected by the lister; role verification is shown separately and does not verify identity or guarantee a transaction.

Section 3

How we use your data

We use the personal data we collect for the following purposes:

To run the platform — creating and managing your account, publishing your listings, and delivering buyer enquiries to you
To process payments — verifying M-Pesa transactions and activating listings after payment confirmation
To communicate with you — sending listing confirmation emails, payment receipts, and important platform updates
To manage viewing requests — recording requested dates, times, fee disclosures, and viewer acknowledgement so the lister and viewer can refer to the request
To improve the platform — analysing how people use Nyumba254 so we can make it better
To detect and prevent fraud — identifying suspicious listings or accounts and protecting other users
To comply with legal obligations — responding to lawful requests from Kenyan authorities where required

        We will never: sell your personal data to advertisers or third parties, send you unsolicited marketing from other businesses, or use your data for any purpose not listed above without your consent.
      

Section 4

Who we share data with

We share your data only in the following limited circumstances:

Other users (limited): When you post a listing, your contact phone number and listing details are visible to buyers on the platform. Buyers who send you an enquiry share their name, phone number, and message with you.
Safaricom M-Pesa: Payment processing is handled by Safaricom. We share your phone number and payment amount with Safaricom to process the STK Push. We do not store your M-Pesa PIN — this is handled entirely by Safaricom.
QR codes: QR codes for your Lister Page and listings are generated in your browser. The page URL is not sent to any third-party QR service.
Legal authorities: We may disclose personal data to Kenyan authorities if required by law, court order, or to protect the rights and safety of our users.

We do not sell, rent, or trade your personal data to any third party for marketing purposes. We do not use advertising networks that track you across other websites.

Section 5

Data storage & security

Your data is stored with a reputable cloud infrastructure provider on servers located in the EU (Ireland). Our infrastructure provider maintains SOC 2 compliance and encrypts data both at rest and in transit.

We take the following measures to protect your data:

All data transmitted between your browser and our servers uses HTTPS encryption
Passwords are hashed using industry-standard bcrypt — we cannot see your password
Your M-Pesa PIN is never passed through our systems — it goes directly to Safaricom
Database access controls ensure sellers can only access their own listings and enquiries
Admin access to the database is protected by strong authentication

No system is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. If you suspect your account has been compromised, change your password immediately and contact us at hello@nyumba254.co.ke.

Section 6

Cookies

Nyumba254 uses a small number of cookies and local storage items to make the platform work. We do not use advertising cookies or third-party tracking cookies.

Cookie / storage	Purpose	Duration
Login session	Keeps you logged in to your seller account	7 days or until you sign out
Search preferences	Remembers your last search filters	Session only
Google Fonts	Loads the Inter and Playfair Display fonts from Google	Cached by browser

You can disable cookies in your browser settings, but this may prevent you from logging in or using some features of the platform.

We use Google Maps embeds on individual listing pages to show approximate location. Google Maps may set its own cookies subject to Google's Privacy Policy.

Section 7

M-Pesa & payments

When you pay a listing fee via M-Pesa, here is exactly what happens with your data:

You provide your M-Pesa phone number on our platform
We send your phone number and the payment amount to Safaricom's Daraja API
Safaricom sends an STK Push directly to your phone
You enter your M-Pesa PIN on your phone — this PIN is never seen or stored by Nyumba254
Safaricom confirms the payment to us with a transaction reference number (e.g. QF12AB3CD4)
We store the transaction reference, amount, and payment status in our database linked to your listing

        We do not store card numbers, bank account details, or your M-Pesa PIN. All payment processing is handled entirely by Safaricom. For M-Pesa payment disputes, contact Safaricom on 234.
      

Section 8

How long we keep your data

Data type	How long we keep it
Account information	Until you delete your account, plus 30 days for recovery
Active listings	For the duration of the listing (60 or 90 days), then archived
Expired listings	12 months after expiry, then permanently deleted
Buyer enquiries	90 days after the listing expires
Payment records	7 years (required for financial record-keeping under Kenyan law)
Usage / access logs	90 days, then automatically deleted
Lister Page analytics	Event-level records for up to 90 days; daily source totals for up to 13 months
Account activity history	24 months, then automatically deleted (draft, needs legal review)
Support emails	2 years from the date of the last communication

Activity history: your account keeps a readable record of key actions (such as listings, enquiries, viewings and payments, with M-Pesa references masked and no message text) so you can view and download your own copy from Activity in your dashboard or profile. Admins may view it only with a recorded reason. Draft, needs legal review.

When data is deleted, it is permanently removed from our systems and cannot be recovered. Payment records are the exception — we are required by Kenyan tax and financial regulations to retain these for 7 years.

Section 9

Your rights

You have the following rights over your personal data. To exercise any of them, email us at hello@nyumba254.co.ke and we will respond within 7 business days.

Access Request a copy of all personal data we hold about you

Correction Ask us to correct inaccurate or incomplete data

Deletion Request deletion of your account and personal data

Objection Object to processing of your data for specific purposes

Portability Request your data in a machine-readable format

Restriction Ask us to limit how we process your data in certain cases

We will process all requests free of charge. In some cases we may be unable to delete certain data (such as payment records required by law) and will explain this clearly.

You can also update or delete your own profile information directly from your seller dashboard at any time.

Section 9A

Kenya Data Protection Act, 2019

Draft, needs legal review. This section describes how we intend to meet the Data Protection Act, 2019 and may change after review.

What we do with data	Lawful basis (draft)
Create and run your account, listings, enquiries and viewing requests	Performance of the service you asked for
Identity and role verification	Your consent, and our legitimate interest in keeping the platform safe
Payment and tax records	Legal obligation
Fraud prevention, reports and moderation	Legitimate interest
Optional analytics and advertising cookies (if ever used)	Your consent, which you can change under Cookie settings
Account activity history you can view and download	Performance of the service, and your right of access

Your rights are listed in Section 9. You can see and download a readable copy of your account activity from Activity in your dashboard or profile. You may also complain to the Office of the Data Protection Commissioner (ODPC) if you think we have mishandled your data.

        Data Protection Officer contact: hello@nyumba254.co.ke (a named officer is to be confirmed).

        ODPC registration status: to be confirmed before launch. We will state the registration status here once it is confirmed.

Section 10

Children's privacy

Nyumba254 is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18.

If you believe a child under 18 has provided us with personal information, please contact us at hello@nyumba254.co.ke and we will delete that information promptly.

Section 11

Third-party links

Nyumba254 may contain links to external websites — for example, links to WhatsApp, Google Maps, or other services. This Privacy Policy does not apply to those websites.

We encourage you to read the privacy policies of any external websites you visit. We are not responsible for the privacy practices of third-party sites.

When you click a WhatsApp link on a listing page, you are opening WhatsApp directly and your conversation with the seller is subject to WhatsApp's and Meta's privacy policies.

Section 12

Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page and notify registered sellers by email.

We encourage you to review this policy periodically. Your continued use of Nyumba254 after any changes constitutes your acceptance of the updated policy.

Section 13

Contact us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: hello@nyumba254.co.ke
Subject line: "Privacy Request — [your name]"
Response time: Within 7 business days
Head office: Kisumu, Kenya — serving sellers and buyers nationwide

For M-Pesa payment disputes specifically, contact Safaricom directly on 234 (free from Safaricom lines) as we do not have access to change M-Pesa transaction records.