MEVAJ HOMES is the data controller for personal data collected through this website and at our premises, registered with the Office of the Data Protection Commissioner (ODPC) under registration no. ODPC/XXXX/XXXX. This policy explains how we comply with the Data Protection Act, 2019 ("KDPA") and the Data Protection (General) Regulations, 2021.
1. Data Protection Officer
Mevaj Homes Data Protection Officer — mevajhomes@gmail.com · 3rd Floor, C22, Beacon, Old Namanga Road, Kitengela, Kajiado East, Kajiado County.
2. What we collect and why
| Data | Purpose | Lawful basis (KDPA s.30) |
|---|---|---|
| Name, email, phone, county | Account, bookings, confirmations by SMS/email | Performance of contract |
| ID type & number, date of birth, nationality, ID images, optional selfie | Identity verification, statutory guest register, security and fraud prevention | Legal obligation; legitimate interest (security); your consent for images |
| KRA PIN, company name | Tax invoices, corporate rates | Legal obligation (tax); contract |
| Booking and payment records (M-Pesa receipt, masked phone, amounts, VAT) | Payments, accounting, tax compliance | Legal obligation; contract |
| IP address, device/browser, consent records | Security, rate-limiting, proof of consent | Legitimate interest; legal obligation |
| Analytics cookies (only if you accept) | Improving the website | Consent |
| Marketing preferences | Offers by SMS/email (only if you opt in) | Consent — withdraw any time |
We do not collect sensitive personal data beyond what is necessary for identity verification, and we do not make decisions about you based solely on automated processing.
3. How we protect your data
- Identity numbers, dates of birth, phone numbers, KRA PINs and addresses are encrypted at rest with AES-256; ID images are encrypted and stored outside the public website.
- Passwords are stored only as one-way hashes. All traffic uses HTTPS.
- Access is role-based and limited to staff who need it; every view of ID documents is logged. Staff accounts can use two-factor authentication.
- We never see or store full card numbers or your M-Pesa PIN.
4. Who we share data with
Only processors acting on our instructions under written contracts: payment providers (Safaricom M-Pesa, Stripe, Flutterwave), SMS (Africa's Talking), email delivery, our hosting provider, and professional advisers. We disclose data to authorities (e.g. KRA, National Police Service) only where required by law. We never sell your data.
5. Where your data is stored
Our primary servers are located in United States. Some processors (e.g. card processing, email delivery) may process limited data outside Kenya; where they do, we rely on appropriate safeguards as required by KDPA ss.48–50.
6. How long we keep it
- Booking, payment and invoice records: 5 years (Tax Procedures Act, 2015).
- ID images: deleted 12 months after your last stay; the guest-register entry is kept as required by law.
- Account profile: until you delete your account.
- Security logs: up to 12 months.
7. Your rights (KDPA s.26)
You have the right to be informed; to access your data; to object to processing; to correct false or misleading data; to deletion of data; and to data portability. You can exercise most rights instantly in My Account → Privacy & my data:
- Download my data — a complete, machine-readable copy (JSON).
- Edit my profile — correct your details at any time.
- Delete my account — we erase your personal data, keeping only pseudonymised financial records that tax law requires.
- Withdraw marketing consent — any time.
Otherwise email our DPO; we respond within 7 days where possible and in any case within the statutory period. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8. Children
Bookings must be made by adults. Children may stay with a parent or guardian, who provides any information required for them.
9. Data breaches
If a breach occurs that is likely to result in risk to you, we will notify the ODPC within 72 hours and inform you without undue delay, as required by KDPA s.43.
10. Changes
We will notify registered users of material changes and ask for fresh consent where required.