Privacy Policy

This Privacy Policy explains how Makazi ("we", "us", "our") collects, uses, and protects your personal data when you use our Kenyan property marketplace at makazi.co.ke and related services (the "Platform").

We process personal data in line with the Constitution of Kenya (Article 31), the Data Protection Act, 2019 ("DPA"), and the Data Protection (General) Regulations, 2021. This policy is not legal advice. A qualified Kenyan counsel should review it before publication.

1. Who we are

Data controller: Makazi Goldcrest Homes Limited trading as Makazi
Registration: [COMPANY REGISTRATION NUMBER]
Registered office: [REGISTERED OFFICE ADDRESS, KENYA]
Data Protection Officer: [DATA PROTECTION OFFICER EMAIL]
ODPC registration: [ODPC REGISTRATION NUMBER — if registered]

For privacy requests, contact us at [DATA PROTECTION OFFICER EMAIL] or through our Contact page.

2. Personal data we collect

Depending on how you use Makazi, we may collect:

• Account data: name, email, phone number, password (stored hashed), profile photo, and account preferences.
• Property activity: saved homes, search filters, viewing requests, inquiries, and in-app messages with agents or landlords.
• Agent and landlord data: business name, licence details, listing content, property documents, and verification materials submitted for KYC.
• Technical data: device type, browser, IP address, cookies, and usage analytics (pages viewed, clicks, and similar events).
• Communications: support messages, feedback, and marketing preferences.

Some information is sensitive under Kenyan law (for example government ID images submitted for verification). We only collect this where necessary and with appropriate safeguards.

3. How we use your data and lawful bases

We use personal data to:

• Provide the Platform, including search, listings, messaging, and saved homes.
• Verify agents, landlords, and listings where trust and safety features apply.
• Respond to inquiries and connect buyers or renters with listing parties.
• Improve security, prevent fraud, and enforce our Terms of Service.
• Send service-related notices (for example account or security alerts).
• Send marketing about properties or Makazi features, only where permitted.

Our typical lawful bases under the DPA include:

• Contract: to deliver the services you sign up for.
• Consent: for optional cookies, marketing emails/SMS, and some verification steps.
• Legitimate interests: to secure the Platform, analyse usage, and improve listings quality — balanced against your rights.
• Legal obligation: where we must retain records for tax, regulatory, or law-enforcement purposes.

4. Sharing your data

We may share personal data with:

• Agents and landlords when you enquire about a property, book a viewing, or message through Makazi.
• Service providers who help us host, email, analyse, or verify data (for example cloud hosting, email delivery, or identity checks). They process data only on our instructions.
• Regulators or authorities when required by Kenyan law or a valid legal request.

We do not sell your personal data.

5. International transfers

Some service providers may process data outside Kenya (for example cloud infrastructure in the EU or US). Where we transfer personal data abroad, we rely on appropriate safeguards under the DPA — such as adequacy decisions, approved contractual clauses, or your explicit consent where required — and we assess risks before transfer.

6. Cookies and similar technologies

We use essential cookies to keep you signed in and remember basic preferences. With your consent, we may also use analytics cookies to understand how the Platform is used.

You can accept or reject non-essential cookies via our cookie banner. You may also control cookies in your browser settings. See section 12 for how to withdraw consent.

7. Marketing communications

We send marketing (for example property alerts or Makazi updates) only if you opt in or where permitted by law. You can opt out at any time using unsubscribe links in emails, by updating preferences in your account, or by contacting us.

8. How long we keep data

• Active accounts: for as long as your account exists and as needed to provide services.
• Deleted accounts:we anonymise or delete personal data without undue delay. Some records may be retained in anonymised form (for example message threads labelled "Former user") for up to 24 months for dispute resolution and platform integrity.
• Listings and transactions: property listing data linked to agents may be retained longer where needed for legal, tax, or fraud-prevention purposes, even after account deletion.
• KYC documents: deleted when no longer required for verification, unless law requires longer retention.
• Server logs: typically up to 12 months unless needed for security investigations.

9. Your rights under Kenyan law

Subject to the DPA, you have the right to:

• Access personal data we hold about you.
• Rectification of inaccurate or incomplete data (update your profile in Settings).
• Erasure of your data in certain circumstances (see account deletion below).
• Restriction of processing in limited cases.
• Data portability — receive your data in a structured, commonly used format.
• Object to processing based on legitimate interests or direct marketing.
• Withdraw consent at any time where processing is consent-based.

To exercise these rights, contact [DATA PROTECTION OFFICER EMAIL]. We may need to verify your identity before responding. We aim to respond within 30 days.

Download your data: signed-in users can export a copy from Account settings → Personal information.

Delete your account: signed-in users can request erasure from Account settings → Personal information. You will need to confirm by typing DELETE and entering your password. This anonymises your profile and removes saved data; some listing or message records may be retained in anonymised form as described above.

10. Security

We use technical and organisational measures — including encryption in transit, access controls, and staff training — to protect personal data. No system is completely secure; please use a strong password and keep your login details confidential.

11. Children

Makazi is not directed at children under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

12. Complaints to the ODPC

If you are unhappy with how we handle your data, contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke.

13. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use of Makazi after changes means you accept the updated policy.