Privacy Policy & Data Protection

1. Introduction & Overview

Welcome to New Home Kenya. We are committed to safeguarding the privacy and confidential information of all visitors, tenants, buyers, property owners, and real estate agents who access our website, applications, and search tools. This Privacy Policy governs our data management practices in Kenya and guarantees transparent, lawful processing of your information.

2. Information We Collect

We only collect information necessary to deliver transparent real estate search, listing publication, and identity verification services:

• Account & Identification Data: Your full name, email address, Safaricom M-Pesa phone number, and physical city or county. For agents applying for verification, we collect National Identification Card / Passport numbers and regulatory certificates.
• Property Listing Information: Property titles, rental/sale prices, descriptions, GPS coordinates, high-resolution photography, and amenities.
• Usage & Location Telemetry: Anonymized IP addresses, browser specifications, and city/town search queries to power location centering and zoom adjustments on Google Maps.
• Financial Records: Transaction timestamps and M-Pesa transaction reference codes for subscription or featured ad payments. Note: We never record, process, or store personal banking PINs or card CVV numbers.

3. Lawful Basis for Processing Data in Kenya

In accordance with Section 30 of the Kenya Data Protection Act, 2019, our processing activities rest upon the following legal bases:

4. Protecting Agents & Landlords

We respect the commercial investments of real estate agents and property owners. We protect your business by:

• Implementing automated rate-limiting and anti-scraping defenses to prevent third-party harvesting of your client listings or phone numbers.
• Applying digital image protections to safeguard property photographs from duplicate re-listing by unauthorized brokers.
• Maintaining strict confidentiality over all title deed documents or tenancy verification records submitted during Verified Agent vetting.

5. Security Measures & Infrastructure

We employ multi-layered technical, physical, and administrative defenses:

• Transport Layer Security: All data in transit is protected using modern 256-bit SSL/TLS encryption.
• Access Controls: Administrative access follows the principle of least privilege, with mandatory role-based access control (RBAC) and audit logging.
• Database Protection: User passwords are cryptographically hashed using standard Bcrypt algorithms.
• Vulnerability Monitoring: Routine software updates and penetration checks are conducted by Royalmark IT Experts.

6. Your Rights Under the Kenya Data Protection Act

As a data subject in Kenya, you are entitled to exercise your statutory rights at any time:

1. Right to be Informed: To receive clear, transparent information regarding how your data is collected and processed.
2. Right of Access: To request a copy of the personal data we hold about you.
3. Right to Rectification: To update or correct outdated, incomplete, or inaccurate information.
4. Right to Erasure ("Right to be Forgotten"): To request permanent deletion of your account and associated listings, subject to statutory record retention laws.
5. Right to Object or Restrict Processing: To opt out of direct marketing, property alert emails, or non-essential telemetry.

To exercise any of these rights, contact our Data Protection Officer at alert@newhome.co.ke.

7. Third-Party Disclosures

We strictly do not sell, rent, or trade your personal information to third-party advertisers. Information is only shared with trusted service providers strictly necessary to operate the platform:

• Google Maps Platform: To render interactive property coordinates, nearby distance calculations, and autocomplete street names.
• Safaricom M-Pesa / Licensed Payment Gateways: To securely process fee payments via verified payment gateways.
• Law Enforcement & Judicial Authorities: If required by a valid warrant, statutory demand from the Directorate of Criminal Investigations (DCI), or order from a court of competent jurisdiction in Kenya.

8. Contact & Regulatory Escalation

If you have questions regarding this Privacy Policy or wish to lodge a complaint regarding data processing, contact: