1. Who we are
ZaaRENT Limited operates ZaaRENT, a cloud platform for landlords, property managers, caretakers, and tenants. Our registered office is in Nairobi, Kenya. We process data as a data controller for account and billing data relating to our customers, and as a data processor when handling tenant, payment, and building records on behalf of property owners and managers using the service.
2. Information we collect
Depending on your role and how you use the platform, we may process:
- Account data — name, email, phone number, password (stored hashed), role, and organization affiliation.
- Property & tenancy data — building addresses, unit labels, rent amounts, lease terms, onboarding drafts, ID document metadata, inspection photos, and signatures you submit through the product.
- Payment data — rent receipts, ledger entries, M-Pesa reference numbers, amounts, and payment proof files. We do not store full card PANs; M-Pesa credentials for paybill integration are configured by the customer organization.
- Communications — SMS logs (rent reminders and operational messages), support correspondence, and notification delivery status.
- Public listings — vacancy promotion text, photos, and pricing you choose to publish after platform review.
- Technical data — IP address, browser type, device information, and audit logs needed for security and troubleshooting.
3. How we use information
We use personal data to:
- Provide, secure, and improve ZaaRENT;
- Authenticate users and enforce role-based access within each organization;
- Process rent collection workflows, receipts, and defaulter reporting;
- Send SMS or email notifications you or your organization configure;
- Review and publish approved vacancy listings;
- Meet legal, tax, and regulatory obligations;
- Respond to support requests and protect against fraud or abuse.
We do not sell personal information. We do not use tenant rent ledgers for unrelated advertising purposes.
4. Legal bases (Kenya & best practice)
Where applicable under the Kenya Data Protection Act, 2019 and similar laws, we rely on: performance of a contract (providing the service), legitimate interests (security, product improvement, fraud prevention), legal obligation, and consent where required (for example, optional marketing or certain tenant communications configured by the data controller).
5. Sharing and subprocessors
We may share data with:
- Infrastructure providers — hosting, database, and backup services used to run the application;
- Payment & SMS partners — such as M-Pesa and SMS gateways, only to deliver transactions and messages you initiate;
- Professional advisers — lawyers, auditors, or insurers when necessary and under confidentiality;
- Authorities — when required by law or to protect rights and safety.
Customer organizations control which tenant and financial data enters the system. They are responsible for informing their tenants and obtaining any required consents before uploading personal data.
6. International transfers
Data may be processed in Kenya and, where we use cloud providers, in other countries with appropriate safeguards (contractual clauses, vendor security assessments, and access controls). Contact us if you need details about transfer mechanisms for your organization.
7. Retention
We retain data while your organization maintains an active account and as needed for legal, accounting, and dispute resolution purposes. Backups may persist for a limited period after deletion. You may request deletion subject to our obligations to landlords, tenants, and regulators to keep certain financial records.
8. Security
We apply technical and organizational measures including access control, encryption in transit, hashed passwords, organization-scoped data isolation, and audit logging. No method of transmission over the Internet is 100% secure; we encourage strong passwords and prompt reporting of suspected incidents.
9. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, or object to certain processing. Tenants and staff should contact their landlord or property manager (the data controller) first; account holders may contact us at privacy@zaarent.com. You may lodge a complaint with the Office of the Data Protection Commissioner (Kenya) where relevant.
10. Cookies and analytics
We use essential cookies and session tokens to keep you signed in and secure the application. Optional analytics, if enabled, will be described in-product. You can control non-essential cookies through your browser settings where applicable.
11. Children
ZaaRENT is a business service not directed at children under 18. We do not knowingly collect data from minors except as part of lawful tenancy records managed by adults.
12. Changes
We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may be communicated by email or in-app notice to account administrators.