1. Who We Are

Data Controller: Devmust Technologies Limited
Platform: RealtifyPro (realtifypro.com)
Contact: privacy@devmust-technologies.com
Phone: +254 719 715 248
Jurisdiction: Nairobi, Kenya

For the purposes of the Kenya Data Protection Act, 2019, Devmust Technologies Limited acts as the Data Controller for information collected directly from organisation owners (agents and independent landlords) during registration and billing. When handling data relating to tenants, landlords invited by agents, and other workspace members, we act as a Data Processor on behalf of the organisation that owns the workspace.

2. Information We Collect

We collect the minimum personal data necessary to deliver the RealtifyPro service. The categories below reflect what is actually stored in the platform:

2.1 Identity & Account Data

• Full name, email address, phone number, and password (hashed using bcrypt).
• Role assigned (Agent, Landlord, Tenant, or Administrator).
• Organisation / workspace name and subdomain slug.
• For tenants: National ID number, date of birth, employer, emergency contact, and next of kin (collected and controlled by the managing agent or landlord).

2.2 Property & Lease Data

• Property addresses, GPS coordinates (via Google Maps), photographs, amenities, and unit details.
• Lease start and end dates, monthly rent, deposit amounts, and lease status.
• Maintenance requests, priority levels, conversation history, and attachments.
• Meter readings (water, electricity), utility charges, and consumption data.

2.3 Financial & Payment Data

• Invoice numbers, amounts, line items, and payment history.
• M-Pesa transaction references, receipt numbers, and phone numbers used for STK Push.
• Bank account details for landlord payouts (bank name, account number).
• Stripe customer IDs and subscription references (card details are held by Stripe, not by us).

2.4 Technical & Usage Data

• IP address, browser type, device information, and referring URL.
• Session cookies required for authentication and CSRF protection.
• Activity logs recording critical actions (invoice creation, payment recording, lease changes, role changes).
• Email delivery and SMS delivery logs.

3. Lawful Basis for Processing

Under Section 30 of the Kenya Data Protection Act, 2019, we rely on the following lawful bases:

• Consent — You expressly agree to our terms when creating an account or accepting an invitation.
• Contract — Processing is necessary to deliver the rental management services you have subscribed to.
• Legal Obligation — We process certain data to comply with Kenyan tax law, anti-money laundering obligations, and court orders.
• Legitimate Interest — We process limited technical data to secure the platform, prevent fraud, and improve service quality.

4. How We Use Your Data

• Providing, operating, and maintaining the RealtifyPro platform.
• Processing rent payments via M-Pesa (Safaricom Daraja API) and Stripe.
• Generating invoices, receipts, PDF statements, and reports.
• Sending transactional notifications by email (via SMTP) and SMS (via Africa's Talking).
• Providing customer support and resolving disputes.
• Complying with Kenyan law, including tax reporting and regulatory requests.
• Detecting, preventing, and investigating fraud or abuse of the service.

We do not sell your personal data, and we do not use it for advertising or profiling unrelated to the service.

5. Data Sharing & Disclosure

We share personal data only when necessary and only with the following parties:

• Within your workspace: Agents and landlords can see tenant data necessary to manage the lease; tenants can see the managing agent's contact details.
• Safaricom PLC: For M-Pesa STK Push, phone numbers and amounts are transmitted to Daraja API.
• Stripe, Inc.: For card subscription billing (processed in the United States under Standard Contractual Clauses).
• Google LLC: For Google Maps geocoding and Places Autocomplete (property addresses only).
• Africa's Talking Ltd: For SMS delivery to tenants and landlords.
• Our hosting provider (HostPinnacle Kenya): For server hosting within Kenya.
• Law enforcement or courts: When legally compelled to do so under Kenyan law.

6. Cross-Border Data Transfer

Your data is hosted in Kenya. Some processors (Stripe, Google) may transfer data outside Kenya. In such cases, we rely on Standard Contractual Clauses, adequacy decisions, or other safeguards permitted under Section 48 of the Data Protection Act, 2019. You may request details of these safeguards by contacting us.

7. Data Retention

• Active accounts: Data is retained for as long as the workspace is active.
• Financial records (invoices, payments): Retained for seven (7) years after the relevant transaction to comply with the Kenya Income Tax Act and Tax Procedures Act.
• Deleted accounts: Personal data is soft-deleted immediately and hard-deleted after 90 days, except financial records which remain subject to the 7-year rule.
• Backups: Encrypted backups are retained for 30 days then permanently deleted.
• Activity logs: Retained for 12 months for security and audit purposes.

8. Your Rights Under the DPA

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access a copy of your personal data we hold.
• Rectify inaccurate or incomplete data.
• Erasure of personal data where there is no lawful basis to retain it.
• Restrict or object to processing in certain circumstances.
• Data portability — receive your data in a commonly used, machine-readable format (CSV or JSON).
• Withdraw consent at any time without affecting the lawfulness of prior processing.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke or by emailing info@odpc.go.ke.

To exercise any of these rights, email privacy@devmust-technologies.com. We will respond within thirty (30) days.

9. Security

We employ technical and organisational measures appropriate to the risk, including:

• TLS/SSL encryption in transit (HTTPS everywhere).
• Bcrypt password hashing (12 rounds).
• Database-level multi-tenancy isolation via organisation scoping.
• Role-based access control (Agent, Landlord, Tenant, Admin).
• IP whitelisting for M-Pesa callbacks.
• Signed URLs for invitation links with expiry.
• CSRF protection and session encryption.
• Regular security patches and dependency updates.

No system is completely secure. In the event of a data breach likely to result in high risk to your rights, we will notify you and the ODPC within 72 hours as required by Section 43 of the DPA.

10. Cookies

We use strictly necessary cookies for authentication, session management, and CSRF protection. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. You can disable cookies in your browser, but this will prevent you from logging in.

11. Children

RealtifyPro is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, contact us immediately and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. When we make material changes, we will notify active users by email at least 14 days before the changes take effect. The "Effective Date" at the top of this page indicates when the current version took effect.

13. Contact Us