Privacy notice

Selling Nairobi (“we”) processes personal data in line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021. This notice explains what we collect, why, and your rights.

What we collect and why

• Account details (name, phone number, email, password hash) — to create and secure your account. Lawful basis: contract.
• Phone verification codes — sent by SMS to confirm you control the number. Codes are stored only as one-way hashes and expire after 10 minutes.
• Listings and photos you publish — to show them to house hunters. We remove location (GPS) and camera data from every photo you upload.
• Exact property locations — kept private unless you choose to show them. Public maps and distances use a point up to 300 m away.
• Your device location — only when you press “Search near me”, used once for that search, and not stored. We never track you in the background.
• Reports you submit — to investigate fraud and abuse. Lawful basis: legitimate interest in keeping the marketplace safe.
• Reviews you write — shown publicly with your first name and last initial and how you dealt with the listing or agent (for example “Viewed this property”). The lister or agent can reply publicly. Lawful basis: consent; you can edit or delete a review any time.
• Browser notifications — if you turn them on, we keep an address issued by your browser’s push service (Google, Mozilla, Apple or Microsoft) for that device. Notification content is encrypted so the push service can’t read it. Signing out or turning them off removes the address.
• Tax invoice details — for paid plans, the invoice (amount, VAT and, if you add it, your KRA PIN and business name) is sent to the Kenya Revenue Authority’s eTIMS system, as tax law requires.
• Security logs (sign-ins, IP address, browser, actions on listings) — to detect and investigate misuse. Lawful basis: legitimate interest and legal obligation.

Who we share it with

Your public phone number and name appear on your listings only if you chose to publish them. Reviews are public. Tax invoices for payments go to the Kenya Revenue Authority. We use service providers for SMS and WhatsApp delivery, email, payments, browser notifications and secure file storage under contracts that require them to protect your data. We do not sell personal data.

How long we keep it

Account data is kept while your account is open. Audit and security logs are kept for up to 24 months. Expired sessions and verification codes are deleted automatically.

Your rights

You may ask to access, correct or delete your personal data, object to processing, or withdraw consent at any time. You can also complain to the Office of the Data Protection Commissioner (ODPC).

You can do some of this yourself under Account → Your data: download a copy of your data, or delete your account. Deletion takes effect 14 days after you ask, so you can change your mind. We then erase your contact details, profile, saved items and verification documents, archive listings only you managed, and replace your messages with a note. We keep the security log, and messages that are part of an open scam report until it is resolved, because the law allows us to keep them for security and fraud prevention. Records of payments you made are kept for 5 years because tax law requires it.

Contact

Data protection requests: privacy contact to be confirmed before launch.