Legal

Privacy Policy

Last updated 22 September 2026 · Kenya

Who we are What we hold Tenants Rent Passport Who sees it Where it is kept How long Your rights Contact

Written to meet Kenya's Data Protection Act, 2019. It says what ZedProperty holds, why, who else sees it, and what you can ask for.

1. Who we are

ZedProperty is run by Fredrick Maina, trading as ZedProperty, Nanyuki, Laikipia County, Kenya.

For the records a landlord keeps about their own tenants, the landlord is the data controller and we process them on the landlord's behalf. For everything else on this page — accounts, listings, enquiries, reports and the Rent Passport — we are the data controller.

2. What we hold about landlords and hosts

Name, phone number, email, and your password, stored only as a hash we cannot read.
Your KRA PIN, only if you choose to add it, so it can be printed on your receipts and your rental income figure.
Your properties, units, listings with their photos and videos, and every way you are paid rent: paybill, till, Pochi, phone or bank account (bank name, account name and branch).
Your subscription payments to us: the M-Pesa code, the amount, the number it came from and the name Safaricom has registered on that line. We compare that name with yours and show only whether they agree; the other name is never shown to anyone.
Whether you confirmed your number by a texted code, and any reports made about your listings.

3. What we hold about tenants

This is the part that deserves attention. We hold tenants' names, phone numbers, email and ID numbers where entered, copies of IDs and tenancy agreements where uploaded, their lease terms, deposits, invoices and complete payment history — for people who may never have signed up with us.

M-Pesa messages. When a landlord's paybill reports a payment, or a landlord pastes the M-Pesa message they received, we keep what it said: the code, the amount, the sending number, the account typed and the payer name. It is kept unedited, because "what did the message actually say?" needs an answer months later.
Water and power. Meter readings, and photos of the meter dial where either side takes one.
Repairs. What was reported, when, and any photo.
Messages. Every reminder, receipt and notice sent to a tenant, readable by them in the app. Codes used to sign in are hidden from every list.
Signing in. A tenant's password, stored only as a hash, and the one-time codes that let them set it, stored only as a hash.

ID copies, agreements and official land searches are kept in private storage, never in the public photo storage, and open only for the landlord of that tenancy (or, for a search, for people who asked about that listing). A tenant may ask us what we hold about them and we will answer, whichever landlord entered it.

4. What we hold about visitors, buyers and guests

If you ask about a listing or book a visit: your name and number, your message, and the date and number of people you gave. The owner receives your number so they can answer you.
If you report a listing: your number and the reason, so we can follow it up. The owner is told a listing is being checked, never who reported it.
If you use Near me: your position is sent with that search so the nearest places come first. It is not saved.
Photos uploaded to a listing have the position the phone wrote into them removed before they are stored.

5. The Rent Passport

A tenant's rent record across every landlord who used ZedProperty, month by month, with how each payment was proved. It is a rent record, not a credit score, and we never send it to a credit reference bureau.

Only the tenant can share it. They make a code for one reader — a bank, a SACCO or their next landlord — that lasts 7, 30 or 90 days and can be withdrawn at any time.
The reader sees the months, whether each was paid on time, the proof behind each, and whether the name on the paying M-Pesa line agrees with the tenant's. They never see the tenant's full number, ID, or anybody else in the building.
Every look is counted, and the tenant sees the count on each code. We also write down when each look happened and the network address it came from, so a look nobody expected can be traced.

6. Why we hold it

To run the service you asked for — placing a payment against the right tenant, raising invoices, sending reminders and receipts, and showing a listing to people looking for a place.
Legal obligation — payment records for tax.
Keeping people safe — reports, the name check and number confirmation exist to keep fake listings and viewing-fee scams off.
With consent — sharing a Rent Passport, and using your location for Near me.

We do not sell personal data and we do not use it for advertising.

Only the companies the service cannot run without, each seeing only what its part needs:

A hosting and database provider, and a storage provider that holds photos, private papers and backups.
An email provider, which carries our emails.
A text-message provider, or a phone on our own Safaricom line. On the phone line, numbers and messages are encrypted before they leave our server, so the relay in between cannot read them.
Safaricom sends us the confirmation of a payment made to a landlord's paybill, where the landlord has connected one.
Authorities, only where the law requires it, and only as far as it requires.

Each is bound by contract to use what it holds only to provide its service to us. We will tell you which companies these are if you ask.

A listing shows its place, price, photos and the owner's name. The owner's number is given to somebody who asks about it or books a visit, together with a warning never to pay a viewing fee.

8. Where it is kept

On servers in Frankfurt, in the European Union, with photos and backups held by a storage provider. That means personal data leaves Kenya. We use providers there because European data protection law gives it at least the protection Kenya's Act requires, and each is bound by contract to use it only to provide its service to us. If we move this to servers in Kenya, we will say so here.

9. How long

Accounts, properties and listings — while the account is open.
Payment and invoice records — seven years, which is what Kenyan tax law requires.
Backups — a copy every night, kept 14 days, and the copy from the 1st of each month kept one year.
Learned payer numbers — until the tenancy ends or the landlord deletes them.
Sign-in and reset codes — until used or expired, which is minutes to days.

10. Your rights

Under the Act you may ask what we hold about you, have it corrected, ask for it to be deleted (except records the law makes us keep), object to a use, withdraw a consent you gave (for example by withdrawing a Rent Passport code), and receive a copy you can take elsewhere. Write to us at the address below: we answer within the time the law allows, at no charge. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

11. Security

Traffic is encrypted in transit; passwords and codes are stored only as hashes; changing a password signs out every other phone; one landlord cannot read another's records, and that is enforced in tests rather than assumed. If a breach puts your data at risk we will tell the Data Protection Commissioner within 72 hours of learning of it, and tell you without delay.

12. Children

ZedProperty is for adults. We do not knowingly hold an account for anyone under 18.

13. Contact

Fredrick Maina, trading as ZedProperty, Nanyuki, Laikipia County, Kenya.
Email: zedtraycom@gmail.com