Privacy policy

Nyumba (“Nyumba”, “we”) runs the Nyumba rent management service for landlords, the Nyumba tenant app and Nyumba Homes, the public house listings. We are based in Nairobi, Kenya.

For landlords, their staff and house hunters, we decide how your data is used, so we are the data controller.

For tenants, your landlord adds your details to Nyumba to manage your tenancy. Your landlord is the data controller for that information and we process it on their behalf. We are the controller for your app account itself, such as your sign-in and notification settings.

Landlords and their staff: name, phone number, email, password (stored only as a one-way hash), KRA PIN, the bank or M-Pesa account rent settles to, your properties and units, and a reference to the card you pay your subscription with. Your card number is held by Paystack, never by us.

Tenants: name, phone number, email, national ID number and KRA PIN (where your landlord records them), your lease, invoices, payments, water meter readings, notices and repair requests with any photos you add.

House hunters: when you ask about a home we collect your name, phone number, message and when you want to move in. Browsing Nyumba Homes does not need an account.

Sign-in with Google: if you choose it, Google shares your name, email address and an account identifier with us.

Technical data: your IP address (to stop abuse and limit repeated requests), a device token if you allow push notifications in the app, and error reports when something breaks.

• To run the service you signed up for (performance of a contract): invoices, rent collection, receipts, reminders, reports, the tenant app and listings.
• To meet legal duties: keeping payment records and helping landlords work out their monthly rental income tax for KRA.
• To keep the service safe (legitimate interest): preventing fraud, securing accounts and fixing errors.
• With your consent: when you register you agree to us storing and using your details as described here. You can withdraw consent by closing your account, subject to the records we must keep by law.

We do not sell personal data, show adverts or use advertising trackers.

We share only what each service needs to do its job:

• Paystack processes rent and subscription payments, including M-Pesa payments through Safaricom.
• Africa's Talking sends text messages such as reminders, receipts and sign-in codes.
• Resend sends emails.
• Google provides Google sign-in and app push notifications (Firebase Cloud Messaging).
• DigitalOcean hosts our servers, database and listing photos. Cloudflare protects our web traffic.
• Sentry receives error reports so we can fix problems.
• Banks a landlord connects to Nyumba send us notifications of payments into that landlord's account.

Between landlords and tenants: your landlord and the staff they authorise see your tenancy, payments and requests. When you ask about a listed home, the landlord and their staff see your name, phone number and message. Your phone number is never shown publicly.

We may also disclose data when Kenyan law or a court order requires it.

Some of the providers above store data on servers outside Kenya. We use them only where the protections required by sections 48 to 50 of the Data Protection Act, 2019 are in place, such as contractual safeguards and security measures at least as strong as those in Kenya.

• Payment records are kept for 7 years, as tax and financial records must be.
• Text message logs are kept for 12 months.
• Tenant details are anonymised 3 years after the tenant's last lease ends.
• Everything else is kept while the account is open and deleted or anonymised when it is closed, except what we must keep by law.

Data travels over encrypted connections. National ID numbers, KRA PINs, payment card references and bank credentials are encrypted before they are stored. Staff accounts at Nyumba need two-factor authentication, and access to customer data is limited and logged. If a breach puts your data at risk we will tell the Data Protection Commissioner within 72 hours and tell you without delay.

Under the Data Protection Act, 2019 you can:

• be told how your data is used, and get a copy of it;
• have wrong or incomplete data corrected;
• have your data deleted, or object to how it is used;
• receive your data in a format you can take elsewhere.

To make a request, email privacy@nyumbapms.co.ke and include the phone number on your account. We answer within the time the law requires. An account with an active lease can't be deleted until the lease ends, because the landlord still needs those records. Tenants can also ask their landlord directly.

If you are not happy with how we handle your data, you can complain to the Office of the Data Protection Commissioner.

We store your sign-in token in your browser so you stay signed in. We use no advertising or analytics cookies.

Nyumba is for adults. You must be 18 or older to create an account or send an enquiry.

When we change this policy we update the date at the top. If a change affects how we use your data, we tell account holders by email or in the app before it applies.

Questions or requests about your data: privacy@nyumbapms.co.ke. Post: Nyumba, Nairobi, Kenya.