Privacy Policy

1. Introduction

Kodipal ("we", "our", "us") is committed to protecting the privacy of every landlord, property manager, tenant, and visitor who interacts with our platform, mobile applications, and website. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.

This policy applies to all users of Kodipal services, including our web dashboard, the Kodipal Manager mobile app, the Kodipal Tenant mobile app, and this website. By using any of our services, you agree to the practices described in this policy.

We comply with the Kenya Data Protection Act, 2019, and where applicable, other regional and international data protection laws including the GDPR for users located in the European Union.

2. Information We Collect

We collect information that you provide directly to us, information that is generated automatically as you use our services, and information we receive from third party integrations such as mobile money providers and banks.

• •Account information: name, email address, phone number, password, and role (landlord, manager, caretaker, or tenant).
• •Property and tenant information: property names, unit numbers, lease terms, tenant details, and utility meter readings entered by you.
• •Payment information: mobile money transaction references, bank transaction confirmations, amounts, dates, and payer identifiers. We do not store full M-Pesa PINs or bank credentials.
• •Communication data: messages sent through the platform, support tickets, and correspondence with our team.
• •Device and usage data: IP address, browser type, operating system, device identifiers, and pages visited within our platform.
• •Mobile app data: push notification tokens, app crash reports, and diagnostic logs.
• •Location data: only when you voluntarily provide it, such as when submitting a maintenance request with a photo tagged to a specific property.

3. How We Use Your Information

We use the information we collect strictly to deliver, operate, and improve our services. Specifically, we use your data to:

• •Create and manage your account and grant appropriate access based on your role.
• •Reconcile rent and utility payments received through mobile money and bank integrations.
• •Generate invoices, statements, receipts, and financial reports for landlords and tenants.
• •Send transactional notifications such as payment confirmations, reminders, and statements via SMS, email, and push notifications.
• •Provide customer support and respond to enquiries submitted through our contact form.
• •Detect, prevent, and investigate fraud, unauthorized access, or misuse of the platform.
• •Comply with legal, regulatory, and tax obligations applicable to property management in Kenya.
• •Improve our platform through aggregated analytics, feature usage insights, and product research.

4. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your personal data on the following legal bases:

• •Performance of a contract: processing necessary to provide you with the Kodipal service you signed up for.
• •Legal obligation: processing required to comply with Kenyan tax, financial reporting, and anti-fraud laws.
• •Legitimate interest: processing for security, fraud prevention, service improvement, and business operations that do not override your rights.
• •Consent: where you have given us explicit permission, such as for marketing communications. You may withdraw consent at any time.

5. How We Share Your Information

We do not sell your personal data. We only share information with trusted third parties who help us operate the platform, and only to the extent necessary to deliver our services.

• •Payment and banking partners: to process and reconcile payments made through mobile money or bank transfers.
• •SMS and email providers: to deliver transactional notifications and receipts.
• •Cloud hosting providers: to store data securely on servers located in compliant jurisdictions.
• •Analytics and error monitoring services: to improve platform reliability and performance, using aggregated and anonymized data wherever possible.
• •Legal and regulatory authorities: when required by law, court order, or to protect the rights and safety of our users.
• •Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction, with notice provided to you.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law.

Financial records related to rent and utility payments are retained for a minimum of seven years to comply with Kenyan tax and financial regulations. Account data is retained while your account is active and for a reasonable period afterward to allow for reactivation or dispute resolution.

When data is no longer needed, we securely delete or anonymize it in accordance with industry best practices.

7. Data Security

We take the security of your data seriously. Kodipal uses industry standard technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

• •Encryption of data in transit using TLS and at rest using AES-256.
• •Role based access controls ensuring users only see data relevant to their role.
• •Multi factor authentication available for all manager and landlord accounts.
• •Regular security audits, penetration testing, and vulnerability scanning.
• •Full audit logs of every transaction and user action within the platform.
• •Secure development practices and staff training on data protection.

8. Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

• •Right to be informed: know what data we collect and how it is used.
• •Right to access: request a copy of the personal data we hold about you.
• •Right to rectification: request correction of inaccurate or incomplete data.
• •Right to erasure: request deletion of your personal data, subject to legal retention requirements.
• •Right to restrict processing: request that we limit how we use your data.
• •Right to object: object to processing based on legitimate interest or for direct marketing.
• •Right to data portability: receive your data in a structured, commonly used, machine readable format.
• •Right to lodge a complaint: file a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, contact us using the details in the Contact section below. We will respond to your request within 30 days.

9. Cookies and Tracking

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, and analyze how visitors use our site. You can control cookies through your browser settings.

Our mobile apps may collect diagnostic data and usage analytics to help us improve reliability and performance. This data is aggregated and does not identify you personally unless you opt in to share additional diagnostics.

10. Children's Privacy

Kodipal is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

11. International Data Transfers

Your data is primarily stored and processed within Kenya and other jurisdictions where our cloud infrastructure partners operate. Where data is transferred outside Kenya, we ensure appropriate safeguards are in place, including standard contractual clauses and equivalent legal protections.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will notify you by email or through a prominent notice on our platform before the changes take effect.

The "Last Updated" date at the top of this page indicates when this policy was last revised. We encourage you to review this page periodically.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your data is handled, please reach out to us using the details below.