Legal
Privacy and Data Protection Policy
How Tausi Realty collects, uses, shares, protects and retains personal data, and the rights you have under the Data Protection Act, 2019.
Template: have this reviewed by a Kenyan advocate before launch.
Last updated: 28 September 2026
At a glance
- Tausi Realty is the data controller of the personal data described in this policy. We process it in accordance with Article 31 of the Constitution of Kenya and the Data Protection Act, 2019.
- We collect only what we need to answer your enquiries, arrange viewings and act for you in a property transaction, and we use it only for those purposes.
- Analytics and advertising tools run only if you accept them, and we never send marketing messages without your express consent.
- We do not sell personal data, and we do not make decisions about you by automated means alone.
- You may access, correct or delete your personal data, object to or restrict its use, and complain to the Office of the Data Protection Commissioner. We respond to access requests within seven days.
1. Introduction and scope
Tausi Realty (“Tausi Realty”, “we”, “us” or “our”) respects the privacy of every person whose personal data it handles and is committed to protecting that data in accordance with Article 31 of the Constitution of Kenya, the Data Protection Act, 2019 (the “Act”) and the regulations made under it, in particular the Data Protection (General) Regulations, 2021 (the “Regulations”).
This policy is the notice required by section 29 of the Act and the policy required by regulation 23 of the Regulations. It explains what personal data we collect, why and on what lawful basis we process it, with whom we share it, how long we keep it, how we protect it, and the rights you have.
This policy applies to personal data we process:
- through our website, tausirealty.co.ke, including its enquiry and viewing forms;
- when you contact us by telephone, WhatsApp, email, text message or social media;
- in the course of our real estate agency services, including the sale, letting and short-stay rental of property, land and off-plan property, and our services to clients in Kenya and in the diaspora; and
- about property owners, landlords, sellers and developers who instruct us or whose property we market.
It does not apply to websites and services operated by others, such as social media platforms, even where our website links to them. Those operators are responsible for their own processing.
2. Who we are
For the purposes of the Act, the data controller is Tausi Realty, a real estate agency based in Nairobi and managed by its principal, Violet Muthui. We determine the purposes for which, and the means by which, your personal data is processed.
Tausi Realty is registered with the Office of the Data Protection Commissioner (the “ODPC”) as a data controller under section 18 of the Act. Certificate of registration number: [●].
We have not appointed a data protection officer under section 24 of the Act. Our principal, Violet Muthui, is responsible for data protection matters and for handling the requests and complaints described in this policy. You can reach her by email to tausirealty@gmail.com, or by telephone or WhatsApp on 0723 901 616.
3. Key terms
In this policy, the following terms have the meanings given to them in section 2 of the Act:
- Personal data means any information relating to an identified or identifiable natural person.
- Sensitive personal data means data revealing a person’s race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details (including the names of the person’s children, parents and spouse or spouses), sex or sexual orientation.
- Processing means any operation performed on personal data, whether or not by automated means, including collection, recording, storage, use, disclosure, restriction, erasure and destruction.
- Data controller means the person who, alone or jointly with others, determines the purpose and means of processing; a data processor processes personal data on the data controller’s behalf.
- Data subject means the identified or identifiable natural person to whom personal data relates. In this policy, that is “you”.
- Consent means any manifestation of express, unequivocal, free, specific and informed indication of your wishes, by a statement or a clear affirmative action, signifying agreement to the processing of your personal data.
4. Our data protection principles
In line with section 25 of the Act, we ensure that personal data is:
- processed in accordance with your right to privacy;
- processed lawfully, fairly and in a transparent manner;
- collected for explicit, specified and legitimate purposes, and not further processed in a manner incompatible with those purposes;
- adequate, relevant and limited to what is necessary for those purposes;
- collected only where a valid explanation is given whenever information about family or private affairs is required;
- accurate and, where necessary, kept up to date, with inaccurate data erased or rectified without delay;
- kept in a form that identifies you for no longer than is necessary; and
- not transferred outside Kenya unless there is proof of adequate data protection safeguards or your consent.
5. Personal data we collect
Depending on how you deal with us, we may process the following categories of personal data:
- Identity and contact data: your name, telephone number and, if you choose to provide it, your email address.
- Enquiry data: the content of your enquiry, such as the type of property, location, budget and timing you are interested in, and any other information you choose to include.
- Viewing data: the property you wish to view, the date and time you select, and any notes you add.
- Client and transaction data, if you instruct us: details of the property concerned, the terms of the proposed sale or letting, correspondence, and the identification and due diligence information the law requires us to obtain, such as a copy of your national identity card or passport and your KRA PIN.
- Referral data: the page of our website from which you contacted us and, if you arrived through an advertisement, the campaign details contained in the link (for example, “utm_source=instagram”).
- Technical data: your IP address and browser information, which our hosting providers receive when you visit the website and which we use to keep the website secure and to prevent spam.
- Analytics and advertising data, only if you accept analytics and advertising cookies: how you use the website and an online identifier used to measure the performance of our advertisements.
Properties you save using the heart icon are stored only in your own browser and are never sent to us. The website also counts how often each listing is viewed and how often its call and WhatsApp buttons are used. Those counts are anonymous: they use a random number held in your browser for the duration of your visit and cannot be linked to you.
6. Sensitive personal data
The Act classifies certain information as sensitive personal data. Two of those categories are directly relevant to real estate: property details and family details. Where a property owner, landlord or seller instructs us, or where a transaction requires us to record who owns or will own a property, we process property details. We may also learn about your family circumstances where you choose to tell us, for example the size of your household.
We process sensitive personal data only where section 25 of the Act is complied with and one of the grounds in section 45 applies, in particular where the processing is necessary to carry out obligations and exercise specific rights of ours or of yours in relation to the transaction, or for the establishment, exercise or defence of a legal claim. We apply stricter access controls to it and do not use it for marketing.
We do not ask for, and ask that you do not send us, information about your health, ethnicity, religion or other beliefs, biometric or genetic data, or sexual orientation, as we do not need it to provide our services.
7. How we collect personal data
As section 28 of the Act requires, we collect personal data directly from you: when you complete a form on our website, contact us or meet us. We receive technical data automatically when you use the website.
We may occasionally receive personal data about you from another person, for example a property owner giving us the contact details of a tenant so that we can arrange a viewing, or a person who refers you to us with your agreement. We do so only where section 28(2) of the Act permits, and we will inform you of the collection within fourteen days, as regulation 6(3) of the Regulations requires.
8. Why we process personal data, and on what lawful basis
We process personal data only for the purposes below. For each purpose we rely on one lawful basis under section 30 of the Act, as regulation 5 of the Regulations requires.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry, scheduling and confirming viewings, and contacting you about your request by telephone, WhatsApp or email | Your consent, given when you tick the consent box on our forms (section 30(1)(a)) |
| Acting for you in a sale, purchase or letting, once you instruct us | Performance of a contract with you, or taking steps at your request before entering into one (section 30(1)(b)(i)) |
| Customer due diligence, record keeping and reporting required of estate agents, including under the Proceeds of Crime and Anti-Money Laundering Act and tax legislation | Compliance with a legal obligation (section 30(1)(b)(ii)) |
| Keeping the website secure and preventing spam, fraud and abuse of our forms | Our legitimate interests (section 30(1)(b)(vii)) |
| Measuring use of the website and the performance of our advertisements | Your consent, given through the cookie banner (section 30(1)(a)) |
| Sending you new listings or other marketing communications | Your express consent (sections 30(1)(a) and 37(1)(a)) |
| Establishing, exercising or defending legal claims | Our legitimate interests (section 30(1)(b)(vii)) |
We will not use your personal data for a new purpose unless it is compatible with the purpose for which it was collected. Where it is not, we will seek your fresh consent, as regulation 6(4) and (5) of the Regulations requires.
9. Whether you must provide personal data
No law requires you to provide personal data in order to use our website, and providing it through our forms is voluntary. However, we need your name and telephone number to respond to an enquiry or to schedule a viewing. If you do not provide them, we will not be able to respond to your request. Your email address is optional.
If you instruct us in a transaction, the law requires us to verify your identity and to keep certain records. In that case, providing the requested identification and due diligence information is mandatory, and if it is not provided we will be unable to act for you.
10. Cookies and similar technologies
The website works without non-essential cookies. It uses your browser’s storage only for the following strictly necessary purposes:
- remembering your cookie choice, for twelve months, after which we ask again;
- keeping the list of properties you have saved, until you remove them or clear your browser data;
- remembering, for the duration of your visit, the advertising campaign that brought you to the website, so that it can be attached to an enquiry you send; and
- holding the anonymous random number described in section 5, for the duration of your visit.
Analytics and advertising tools (Google Analytics, the Meta Pixel and, where used, the TikTok Pixel) are loaded only after you select “Accept” on the cookie banner, and set their own cookies only then. Declining is as easy as accepting and does not affect your use of the website. You may change your choice at any time using the “Cookie settings” link at the bottom of every page. When you withdraw consent, the tools stop loading and we remove the cookies they set on our website.
Maps on listing pages are provided by OpenStreetMap. To display a map, your browser requests map images directly from the OpenStreetMap Foundation’s servers, which therefore receive your IP address.
11. Direct marketing
We will use your personal data for direct marketing, such as sending you new listings, only if you have given us your express consent to do so, as section 37 of the Act and regulation 15 of the Regulations require. Consenting to be contacted about a particular enquiry is not consent to marketing.
Every marketing message we send will identify us and tell you how to opt out, and opting out will be free and simple, for example by replying “STOP”. Your right to object to direct marketing is absolute: once you object, we will stop, as regulation 8(4) and (5) of the Regulations requires. We do not sell, rent or trade personal data, and we do not share it with third parties for their own marketing.
12. Who we share personal data with
We disclose personal data only where necessary for the purposes described in this policy. We use the service providers listed below to operate our website and business. Where a provider processes personal data on our behalf as our data processor, we engage it on written terms that require it to act only on our instructions and to keep the data secure, as section 42(2) of the Act and regulation 24 of the Regulations require. Google, Meta and TikTok also process some data as independent data controllers under their own privacy policies, in particular when you use their services directly or accept advertising cookies.
- Netlify, which hosts and delivers the website (United States, with a global delivery network);
- Supabase, which provides our database and file storage (servers in London, United Kingdom);
- Resend, which delivers the emails our website sends (United States);
- Google, which provides the email account in which we receive and answer enquiries and, only with your consent, Google Analytics;
- Meta, which provides WhatsApp, on which we may correspond with you and receive notice of new enquiries, and, only with your consent, the Meta Pixel;
- TikTok, only with your consent and only if we use the TikTok Pixel; and
- Cloudflare, where enabled, which checks that form submissions are made by a person and not an automated program.
We may also disclose personal data to the following third parties:
- the owner, landlord or developer of a property you are interested in, and their advocates or agents, to the extent necessary to arrange a viewing or progress an offer, and after telling you;
- advocates, valuers, surveyors, banks and other professionals involved in your transaction, on your instructions;
- public authorities, courts and law enforcement agencies, including the Financial Reporting Centre and the Kenya Revenue Authority, where the law requires or permits disclosure;
- our professional advisers, such as advocates and accountants, who owe us duties of confidentiality; and
- a successor to our business, if it is sold or reorganised, who will be bound by this policy in respect of your personal data.
13. Transfers of personal data outside Kenya
Several of our service providers store or process personal data outside Kenya, as described in section 12. We transfer personal data outside Kenya only in accordance with sections 48 and 49 of the Act and Part VII of the Regulations, namely where:
- appropriate safeguards are in place, including contractual commitments from the recipient that provide protection essentially equivalent to that under the Act, and the transfer is documented as regulation 41 requires; or
- the transfer is necessary for the performance of a contract with you, or for steps taken at your request before entering into one, such as responding to your enquiry (section 48(c)(i)); or
- you have given your explicit consent after being informed of the possible risks (regulation 46).
Sensitive personal data is transferred outside Kenya only with your consent and after we have confirmed that appropriate safeguards are in place, as section 49(1) of the Act requires. Please note that some destination countries may not provide the same level of protection as Kenya; where this is the case, we rely on the contractual safeguards described above.
14. How long we keep personal data
We keep personal data only as long as is reasonably necessary for the purpose for which it was collected, unless a longer period is required or authorised by law (section 39 of the Act). Our retention schedule is as follows:
| Personal data | Retention period |
|---|---|
| Enquiries and viewing requests that do not lead to a transaction | 24 months after our last contact with you |
| Client, transaction and due diligence records | 7 years after the transaction is completed or our relationship ends, as anti-money laundering law requires |
| Correspondence by WhatsApp, email and telephone | As for the enquiry or transaction to which it relates |
| Scrambled (hashed) IP addresses used to limit repeated form submissions | Deleted routinely after 24 hours; your actual IP address is not stored |
| Security logs kept by our hosting providers | Generally not more than 30 days |
| Analytics data, only with your consent | Not more than 14 months in Google Analytics |
We review the personal data we hold at least once a year. At the end of the applicable period we delete, erase, anonymise or pseudonymise it, as section 39(2) of the Act and regulation 19 of the Regulations require. Where personal data is needed as evidence, we restrict its processing instead of deleting it and inform you (section 40(3) of the Act).
15. How we protect personal data
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration and unauthorised disclosure or access, having regard to sections 41 and 42 of the Act. Those measures include:
- encryption of all data in transit between your device and our website (HTTPS);
- encryption of stored data by our database provider;
- access to enquiries, viewings and client records restricted to authorised persons through individual, password-protected accounts, with database access rules that prevent anyone else from reading them;
- a separate, non-public administration system for managing enquiries and listings;
- data minimisation by design, for example storing IP addresses only in scrambled form for a day and keeping saved properties on your own device;
- selection of data processors that give sufficient guarantees of security, bound by written terms;
- back-ups maintained by our providers, so that data can be restored promptly after an incident; and
- regular review of these safeguards, and updates in response to new risks.
No method of transmission or storage is completely secure, but we take every reasonable step to protect your personal data.
16. Personal data breaches
Where personal data is accessed or acquired by an unauthorised person and there is a real risk of harm to you, we will notify the Data Commissioner without delay and within seventy-two hours of becoming aware of the breach, and will inform you in writing within a reasonably practicable period, as section 43 of the Act requires. We will tell you what happened, what we have done and will do about it, and what you can do to protect yourself. We keep a record of every breach, its effects and the remedial action taken.
17. Your rights
Under the Act and the Regulations, you have the following rights:
| Your right | Provision | Our response |
|---|---|---|
| To be informed of the use to which your personal data is put | ss. 26(a), 29 | This policy, before we collect your data |
| To access your personal data and receive a copy | s. 26(b); reg. 9 | Within 7 days, free of charge |
| To have inaccurate, outdated, incomplete or misleading data corrected | ss. 26(d), 40; reg. 10 | Within 14 days, free of charge |
| To have your personal data deleted | ss. 26(e), 40; reg. 12 | Within 14 days, free of charge |
| To restrict the processing of your personal data | s. 34; reg. 7 | Within 14 days, free of charge |
| To object to processing, absolutely so in the case of direct marketing | ss. 26(c), 36; reg. 8 | Within 14 days, free of charge |
| To receive your data in a structured, machine-readable format and have it transmitted to another controller | s. 38; reg. 11 | Within 30 days |
| To withdraw your consent at any time | s. 32(2) | Immediately, for future processing |
| Not to be subject to a decision based solely on automated processing | s. 35 | We make no such decisions (section 20) |
| To complain to the Data Commissioner, and to compensation for damage caused by a contravention of the Act | ss. 56, 65 | See section 21 |
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (section 32(3) of the Act). Some rights are subject to exceptions set out in the Act; for example, we may be unable to erase data that the law requires us to keep, or that is needed for the establishment, exercise or defence of a legal claim. We do not normally charge for data portability; the law allows a reasonable fee not exceeding our cost where a request is complex.
18. How to exercise your rights
You may exercise any of your rights by contacting us by email to tausirealty@gmail.com, or by telephone or WhatsApp on 0723 901 616. You do not need to use a particular form, but you may use the forms in the First Schedule to the Regulations (Forms DPG 1 to DPG 5) if you prefer.
To protect your personal data, we may ask you to confirm your identity before we act on a request. A person duly authorised by you, or the parent or guardian of a minor, may make a request on your behalf, as section 27 of the Act provides, and we may ask for evidence of that authority.
If we decline a request, we will tell you in writing, give our reasons and remind you of your right to complain to the Data Commissioner, within the time the Regulations require. Where we have shared the relevant data with a third party, we will take reasonable steps to inform them of any correction, erasure or restriction (section 40(2) of the Act; regulation 7(3)).
19. Children
Our website and services are intended for adults. We do not knowingly collect personal data from anyone under the age of eighteen. Section 33 of the Act permits the processing of a child’s personal data only with the consent of a parent or guardian; if we learn that we have collected a child’s personal data without it, we will delete that data promptly. A parent or guardian who believes this has happened should contact us.
20. Automated decision-making and profiling
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or significantly affect you (section 35 of the Act). Where you consent to advertising cookies, our advertising partners may use the data they collect to show you relevant advertisements; you may object to that at any time by changing your cookie settings.
21. Complaints
If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, orally or in writing, under section 56 of the Act. The Act requires the Data Commissioner to investigate and conclude a complaint within ninety days.
Office of the Data Protection Commissioner
Britam Tower, 12th and 13th Floor, Hospital Road, Upper Hill, Nairobi
P.O. Box 30920-00100, Nairobi
Telephone: 020 780 1800
Email: info@odpc.go.ke
Online complaints: www.odpc.go.ke/file-a-complaint
22. Changes to this policy
We review this policy regularly and will update it to reflect changes in the law or in our practices. The current version will always be available on this page, with the date of the latest update shown at the top. Where a change materially affects how we use personal data you have already given us, we will take reasonable steps to bring it to your attention. This policy is governed by the laws of Kenya.
23. Contact us
For any question about this policy or your personal data, please contact Violet Muthui, Tausi Realty, by email to tausirealty@gmail.com, or by telephone or WhatsApp on 0723 901 616.