Privacy Policy

Glossy Real Estate & Property Management is the Data Controller for the personal data described in this Policy and is registered (or in the process of registration) with the Office of the Data Protection Commissioner (ODPC) of Kenya.

Contact for privacy matters: glossyrealestate26@gmail.com · +254 715 501719.

• Identity data — full name, national ID / passport number, KRA PIN (where required for tenancy or contract).
• Contact data — postal address, physical address, phone number, email.
• Financial data — bank details, M-Pesa number, payment history (for landlords, tenants and contractors).
• Property data — title numbers, tenancy history, service requests, inspection reports.
• Employment / income data — where required for tenant screening, in line with the Landlord and Tenant Act.
• Technical data — IP address, browser type, device information and cookies via our website.

We process personal data only where a lawful basis exists under section 30 of the Data Protection Act, 2019, namely: (a) your consent; (b) performance of a contract with you; (c) compliance with a legal obligation (e.g. anti-money-laundering, tax, tenancy legislation); (d) protection of your vital interests; (e) exercise of official authority; or (f) our legitimate interests, provided those interests are not overridden by your rights.

• To respond to enquiries and provide consultancy, management, maintenance and construction services.
• To prepare tenancy agreements, sale agreements and construction contracts.
• To conduct tenant screening (identity, income and reference checks).
• To collect rent, issue receipts and remit owner payouts.
• To coordinate maintenance requests and dispatch technicians.
• To comply with tax, AML/CFT and other legal obligations.
• To send service-related and (with your consent) marketing communications.
• To improve, secure and analyse the performance of our website and services.

We share personal data only where necessary and with appropriate safeguards, including:

• Property owners, landlords or tenants where required to deliver our services.
• Vetted contractors and technicians for maintenance and construction work.
• Licensed advocates, valuers, surveyors, banks and insurers involved in a transaction.
• Government authorities, including KRA, county governments, NCA, NEMA, the Land Registry and the Judiciary, when legally required.
• IT service providers under written data-processing agreements.

We do not sell your personal data to any third party.

Where personal data is transferred outside Kenya (for example, cloud storage), we do so in accordance with sections 48–50 of the Data Protection Act, 2019 — either on the basis of your consent, contractual necessity, or by ensuring that the recipient country or third party provides an adequate level of protection through appropriate safeguards.

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with applicable legal, tax, accounting and regulatory requirements. Client and transaction records are typically retained for 7 years after the end of the engagement, in line with the Tax Procedures Act.

• To be informed of the use to which your personal data is put.
• To access your personal data in our custody.
• To object to the processing of all or part of your personal data.
• To correct false or misleading data about you.
• To request deletion of false, misleading or unlawfully obtained data.
• To withdraw consent to processing at any time.
• To lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

Our website uses cookies and similar technologies to enable core functionality, remember your preferences and understand site usage in accordance with regulation 39 of the Data Protection (General) Regulations, 2021. You can control or disable cookies through your browser settings; some features may not work correctly without them.

We apply appropriate technical and organisational measures — including access controls, encryption in transit, segregated client accounts, staff confidentiality obligations and vendor due diligence — to protect personal data from unauthorised access, alteration, disclosure or destruction, as required by section 41 of the Data Protection Act, 2019.

Our services are not directed at children under 18. We do not knowingly collect personal data from minors without verifiable parental or guardian consent, as required by section 33 of the Data Protection Act, 2019.

In the event of a personal data breach that is likely to result in a real risk of harm, we will notify the ODPC without undue delay and, where required, the affected data subjects, in line with section 43 of the Data Protection Act, 2019.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated ‘Last updated’ date. Continued use of our services after any change constitutes acceptance of the revised Policy.

For any privacy-related question, request or complaint, contact our Data Protection contact at glossyrealestate26@gmail.com or on +254 715 501719. If you are not satisfied with our response, you may escalate to the ODPC at complaints@odpc.go.ke.