Privacy policy

This policy explains what personal data HAUZ Africa Limited ("hauz.africa", "HAUZ", "we") collects, why, and your rights under Kenya's Data Protection Act, 2019. HAUZ is a data controller registered with the Office of the Data Protection Commissioner.

1. What we collect

• Account details: name, email, phone number, password (stored as a one-way hash), and any answers you give when signing up.
• Activity: places you save or add to a viewing list, searches and alerts, site-visit requests, messages with our team, enquiries to agents or developers, and reports you make.
• Payments: the M-Pesa number, amount, status and receipt number of payments to HAUZ. We never see or store your M-Pesa PIN.
• Rentals (if you are a tenant or landlord): tenancy details, invoices, receipts, repair requests and building-forum posts; for tenants, the ID number and emergency contact your landlord records; for landlords, payout details (stored encrypted).
• Agents and developers: profile, listings, developments and leads.
• Device and security data: sign-in times, IP address, the devices you're signed in on, and a push-notification token if you allow notifications in the app.

2. Why we use it (and the legal basis)

Purpose	Legal basis
Running your account, bookings, payments and rent collection	Performing our contract with you
Calling or messaging you about a site visit, rent or a repair	Contract
Keeping payment and rent records	Legal obligation (tax and accounting law)
Preventing fraud and fake listings, keeping HAUZ secure	Legitimate interests
Search alerts, newsletters and offers	Your consent — you can switch them off at any time

We do not sell your personal data.

3. Who we share it with

• The other side of your deal: e.g. the landlord of a place you're visiting or renting; the agent or developer you send an enquiry to (they receive the details you give them).
• Service providers who work for us under contract: Safaricom (M-Pesa), SMS and WhatsApp providers, email delivery, hosting, and Google Firebase (push notifications).
• Authorities, when the law requires it.

Some providers may process data outside Kenya. When they do, we rely on the safeguards the Act requires.

4. How long we keep it

We keep account data while your account is open. Payment and rent records are kept for at least 7 years for tax and accounting purposes. Messages and site-visit records are kept for up to 2 years after your last activity unless needed for a dispute. When you delete your account (see below), your identity is removed straight away and the records we must keep no longer show your name.

5. Your rights

You can ask to be told what we hold (access), correct it, object to or restrict its use, receive it in a portable format, and have it deleted. In your account:

• My account → Download my data gives you everything we hold as a file.
• My account → Delete my account removes your account and identity. If you have an active tenancy or a payment still being confirmed, we'll explain what needs to happen first.

You can also email hello@hauz.africa. If you're unhappy with our answer you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

6. Location privacy

We never publish a property's exact location. Public maps show an approximate area; the exact address is shared only with confirmed visitors and staff who need it.

7. Security

Data is sent over encrypted connections. Passwords are hashed; sensitive fields such as ID numbers, bank details and integration keys are encrypted. Staff access is limited by role and logged.

8. Children

HAUZ is for adults. We don't knowingly collect data from anyone under 18.

9. Cookies

We use essential cookies to keep you signed in, protect forms and remember your viewing list. We don't use advertising cookies.

10. Changes

We'll post any changes here and tell you about significant ones before they take effect.

Contact: HAUZ Africa Limited, Nairobi, Kenya — hello@hauz.africa