Privacy Policy

KejaSure is the data controller for personal data processed through our app and website. We are registered (or in the process of registering) with the ODPC as required by the Data Protection Act. Contact our Data Protection Officer at support@kejasure.com.

• Account data: name, phone number, email, password (encrypted).
• Verification (KYC) data: National ID / passport details, selfie, KRA PIN and proof of ownership or agency authority for listers.
• Listing data: property photos, location, price, descriptions.
• Communications: in-app chats, reports and reviews.
• Payment data: M-Pesa transaction references for your KejaSure subscription (e.g. receipt code and the mobile number used). We do not process or store card details.
• Device & usage data: device type, IP address, approximate location (with permission), app activity.

• To create and manage your account and deliver our services (contract).
• To verify identities and detect fraud, scams and fake listings (legitimate interest & legal obligation).
• To process subscriptions and issue receipts/eTIMS invoices as required by KRA (legal obligation).
• To send service notices, and marketing only where you have consented (consent — you can opt out anytime).
• To comply with lawful requests from Kenyan authorities (legal obligation).

ID documents and biometric data (e.g. selfies for face matching) are sensitive personal data under Section 44 of the Data Protection Act. We collect them only for verification, with your explicit consent, protect them with extra safeguards and never sell them.

• Other users, only as needed to connect you (e.g. a lister's verified badge and name, a tenant's inquiry).
• Trusted processors: identity verification, cloud hosting, payment and messaging providers, under written data processing agreements.
• Government bodies (e.g. ODPC, KRA, National Police Service, courts) where required by law.

Some providers may store data outside Kenya. We only transfer data where adequate safeguards exist as required by Sections 48–50 of the Data Protection Act and its Regulations.

We keep data only as long as needed for the purposes above. Account data is deleted or anonymised after account closure, except where retention is required by law (e.g. tax records are kept for at least 5 years under the Tax Procedures Act).

Under Section 26 of the Data Protection Act you have the right to:

• Be informed of how your data is used.
• Access your personal data.
• Correct false or misleading data.
• Delete your data, subject to legal limits.
• Object to processing, including direct marketing.
• Data portability.

Email support@kejasure.com to exercise any right. We respond within the timelines set by law. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

We use encryption, access controls and monitoring to protect your data. If a breach is likely to put you at risk, we will notify the ODPC within 72 hours and inform affected users without undue delay.

KejaSure is for users aged 18 and above. We do not knowingly collect data from children.

We may update this policy. Significant changes will be communicated in the app or by email.