Legal
Privacy Policy
Effective date: 1 June 2026
1. Who We Are
RealtyFlow (“we”, “us”, “our”) operates the RealtyFlow CRM platform for real-estate professionals. We are a data controller under the Kenya Data Protection Act 2019 (Cap. 411C) and its subsidiary Data Protection (General) Regulations 2021.
Questions or requests about this policy may be sent to privacy@realtyflow.co.ke.
2. Personal Data We Collect
- Account data: name, email address, and password (stored as a one-way hash).
- Organisation data: agency or organisation name provided at registration.
- Usage data: pages viewed, features used, and interaction logs collected automatically.
- CRM data you enter: contact records, leads, properties, and notes you create within the platform belong to you and your organisation.
- Technical data: IP address, browser type, and session identifiers.
- Onboarding preferences: optional information about your role, team size, and professional experience collected during account setup to personalise your experience.
3. How We Use Your Data
| Purpose | Legal basis (DPA 2019) |
|---|---|
| Provide, maintain, and improve the platform | Performance of a contract |
| Send transactional emails (account, notifications) | Performance of a contract |
| Personalise onboarding and feature recommendations | Legitimate interests / Consent |
| Enforce security and prevent fraud | Legitimate interests |
| Comply with legal and regulatory obligations | Legal obligation |
| AI-assisted description generation (processes listing content) | Legitimate interests |
4. CRM Data Ownership
Data you enter into the CRM (contacts, leads, properties, notes, etc.) is owned by you and your organisation. We process it only as instructed by you through the platform. You are the data controller for that information; we are your data processor. You are responsible for ensuring you have the appropriate legal basis to collect and store information about your contacts and leads.
5. Sharing Your Data
- Within your organisation: data is shared with other users in your organisation as configured by your administrator.
- Service providers (data processors): we use third-party providers for cloud hosting, email delivery, error tracking, analytics, and AI features. See Section 7.
- SuperAdmin access: RealtyFlow platform administrators may access account-level data for support, security, and compliance purposes. All such access is logged.
- Legal requirements: we may disclose data where required by law, court order, or regulatory authority.
We do not sell your personal data to third parties.
6. Data Retention
- Active accounts: retained while your subscription is active.
- Deleted accounts: personal account data is deleted within 30 days of account closure. CRM data may be retained for up to 90 days to allow recovery before permanent deletion.
- Audit logs: retained for up to 24 months for security and compliance purposes.
- Usage and technical logs: retained for up to 90 days.
7. International Data Transfers
We use service providers whose infrastructure is located outside Kenya, including in the United States and the European Union. These transfers are necessary to operate the platform and are carried out under contractual safeguards consistent with Section 48 of the Kenya Data Protection Act 2019.
Categories of data transferred internationally include account identifiers, usage data, error-reporting data, and where you use the AI description feature, property listing content. We enter into data processing agreements with all third-party processors.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data — you can update most profile data directly in Settings.
- Erasure of your account and personal data.
- Data portability — request a copy of your data in a portable format.
- Object to processing for legitimate interest purposes.
- Withdraw consent where processing is consent-based.
Email privacy@realtyflow.co.ke to exercise any right. We will respond within 21 days.
9. Security
We implement TLS encryption in transit, hashed password storage, role-based access controls, and regular security reviews. In the event of a data breach likely to affect your rights, we will notify the ODPC and affected individuals within 72 hours as required by law.
10. Changes to This Policy
We may update this Privacy Policy from time to time and will notify you by email before material changes take effect. Continued use after changes take effect constitutes acceptance.
11. Complaints
If you are not satisfied with our data handling, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.