Privacy Policy

Compliant with the Kenya Data Protection Act, 2019

Last Updated: 09 July 2026

Welcome to HOMUtopia. We are committed to protecting your personal information and your rights under the Kenya Data Protection Act, 2019 ("the Act"). This Privacy Policy explains what data we collect, why, and how we safeguard it.

1. Data We Collect (Transparency)

To operate the Platform's core mechanics, we collect the following personal and, in places, sensitive data:

• Identity: Full names, phone numbers, and National ID / Passport photos submitted during KYC verification.
• Property data: Property locations, unit details, and lease agreements.
• Biometric / signature data: Drawn digital signatures captured when signing tenancy agreements.
• Financial indicators: Rent amounts, payment proofs, and ledger balances used to run the rent-tracking features.

2. Purpose of Processing

We collect and process this data solely to operate the Platform's core functions: generating lease contracts, verifying user profiles (KYC), mapping properties, and running the automated rent ledger. We will never sell your data to third-party marketing companies. Data is shared only with the specific counterparties necessary to perform the tenancy (e.g., your landlord sees the records you submit to them) and with vetted infrastructure processors (cloud storage, SMS/email delivery) under contractual confidentiality.

3. Data Controller vs. Data Processor

This distinction is central under Kenyan law:

• The Landlord / Agency is the Data Controller. They decide whose data is entered, and they decide to approve or reject tenants and documents. They determine the purposes and means of processing.
• HOMUtopia is strictly the Data Processor. We process personal data only on the landlord's / agency's behalf and under their instructions, as instructed through the Platform's features.
• Why this matters: If a tenant is concerned that their landlord holds their ID or lease on the system, the dispute is with the Controller (the landlord/agency) — not with HOMUtopia as the Processor. We act only on documented instructions.

4. Data Retention and the Right to be Forgotten

In compliance with Section 40 of the Data Protection Act, we retain personal data only for as long as necessary to provide the service and to meet legal/operational obligations. When an account is closed, we will permanently erase or anonymise the user's files and records after a reasonable operational window, unless retention is required by law. Users may request deletion by contacting compliance@homutopia.co.ke.

5. Data Protection Registration

HOMUtopia is registered as a Data Processor / Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya, in line with the Act. Our registration certificate and compliance badge are displayed in the footer of the Platform.

6. Your Rights

Under the Act you have the right to access, correct, port, and erase your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact our Data Protection Officer at compliance@homutopia.co.ke.

For questions, contact compliance@homutopia.co.ke.