On this page
- 01Who we are This Privacy Policy explains how [COMPANY LEGAL NAME] ("Jengo", "we", "us") handles personal data in the Jengo property-management platform. It is written to meet the Kenya Data Protection Act, 2019 (DPA) and its Regulations. Registered office: [REGISTERED ADDRESS]. Data Protection Officer: [DPO NAME], [DPO EMAIL].
- 02Our two roles Jengo acts in two capacities under the DPA: - As a **data controller** for the personal data of the account holders who sign up to use Jengo (landlords, property managers, our own staff) — for example the name, email and login details you give us. - As a **data processor** for the personal data a landlord or company enters about their own tenants and staff (tenant names, phone numbers, national ID copies, payment records). For that data the landlord/company is the **data controller**, and we process it on their instructions to provide the service.
- 03What we collect - **Account data:** name, email, phone, password (stored only as a secure hash), role and workspace. - **Tenant & lease data your landlord enters:** tenant contact details, national ID (encrypted at rest), leases, invoices, payments, maintenance records. - **Payment metadata:** M-Pesa transaction references and amounts routed through Safaricom's Daraja API. We do not store M-Pesa PINs — those are entered on the payer's own handset. - **Technical data:** IP address, device/browser information, and audit logs of actions taken, kept for security and troubleshooting.
- 04Lawful basis We rely on the following bases under the DPA: - **Performance of a contract** — to provide the platform you signed up for. - **Legal obligation** — to keep tax, accounting and other records the law requires. - **Legitimate interests** — to secure the platform, prevent fraud and improve the service, balanced against your rights. - **Consent** — where we ask for it (for example, optional marketing), which you may withdraw at any time.
- 05How we use data We use personal data to run the service: issuing invoices, reconciling M-Pesa payments, sending transactional messages, providing the tenant portal, keeping audit trails, and supporting and securing your account. We do not sell personal data.
- 06Sharing and sub-processors We share data only with service providers who help us run Jengo, under contracts that require them to protect it: - **Safaricom (M-Pesa / Daraja)** — to initiate and reconcile mobile-money payments. - **[HOSTING PROVIDER / REGION]** — cloud hosting and storage. - **[EMAIL PROVIDER]** and **[SMS PROVIDER]** — to deliver transactional email and SMS when a workspace enables them. - **Kenya Revenue Authority (eTIMS)** — only where a workspace connects a KRA device to issue tax invoices. We may also disclose data where required by law or to protect our rights and safety.
- 07Cross-border transfers Where a sub-processor stores or processes data outside Kenya, we do so only where the DPA permits — for example on the basis of adequate protection, appropriate safeguards, or your consent. Current hosting region: [HOSTING REGION].
- 08Retention We keep personal data only as long as needed for the purpose it was collected, then delete or irreversibly anonymise it. Security logs (login attempts, communication logs, payment-push requests) are automatically purged on a rolling schedule. When a workspace is closed, its data is deleted or returned per our agreement with that customer.
- 09Your rights Under the DPA you have the right to: - be informed about how your data is used; - **access** the personal data we hold about you; - have inaccurate data **rectified**; - have your data **erased** where the law allows; - **object to** or **restrict** certain processing; - **data portability** — receive your data in a structured, commonly used format. If your data was entered by a landlord or company using Jengo, they are the controller — contact them first; we will support them in meeting your request. To exercise a right directly, contact [DPO EMAIL].
- 10Security We protect data with encryption in transit and at rest for sensitive fields, per-workspace data isolation, role-based access control, hashed passwords, and optional two-factor authentication. If a personal-data breach occurs that is likely to cause harm, we will notify the Office of the Data Protection Commissioner and affected data subjects without undue delay, and in any case within **72 hours** of becoming aware, as the DPA requires.
- 11Complaints If you are concerned about how your data is handled, contact our DPO at [DPO EMAIL]. You also have the right to lodge a complaint with the **Office of the Data Protection Commissioner (ODPC)** of Kenya. Our data-controller registration number is [ODPC REGISTRATION NUMBER].
- 12Changes We may update this policy; the effective date above shows the latest version. Material changes will be notified in the app or by email.
- 13Contact [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy enquiries: [DPO EMAIL]. General support: [SUPPORT EMAIL].
Who we are This Privacy Policy explains how [COMPANY LEGAL NAME] ("Jengo", "we", "us") handles personal data in the Jengo property-management platform. It is written to meet the Kenya Data Protection Act, 2019 (DPA) and its Regulations. Registered office: [REGISTERED ADDRESS]. Data Protection Officer: [DPO NAME], [DPO EMAIL].
Our two roles Jengo acts in two capacities under the DPA: - As a **data controller** for the personal data of the account holders who sign up to use Jengo (landlords, property managers, our own staff) — for example the name, email and login details you give us. - As a **data processor** for the personal data a landlord or company enters about their own tenants and staff (tenant names, phone numbers, national ID copies, payment records). For that data the landlord/company is the **data controller**, and we process it on their instructions to provide the service.
What we collect - **Account data:** name, email, phone, password (stored only as a secure hash), role and workspace. - **Tenant & lease data your landlord enters:** tenant contact details, national ID (encrypted at rest), leases, invoices, payments, maintenance records. - **Payment metadata:** M-Pesa transaction references and amounts routed through Safaricom's Daraja API. We do not store M-Pesa PINs — those are entered on the payer's own handset. - **Technical data:** IP address, device/browser information, and audit logs of actions taken, kept for security and troubleshooting.
Lawful basis We rely on the following bases under the DPA: - **Performance of a contract** — to provide the platform you signed up for. - **Legal obligation** — to keep tax, accounting and other records the law requires. - **Legitimate interests** — to secure the platform, prevent fraud and improve the service, balanced against your rights. - **Consent** — where we ask for it (for example, optional marketing), which you may withdraw at any time.
How we use data We use personal data to run the service: issuing invoices, reconciling M-Pesa payments, sending transactional messages, providing the tenant portal, keeping audit trails, and supporting and securing your account. We do not sell personal data.
Cross-border transfers Where a sub-processor stores or processes data outside Kenya, we do so only where the DPA permits — for example on the basis of adequate protection, appropriate safeguards, or your consent. Current hosting region: [HOSTING REGION].
Retention We keep personal data only as long as needed for the purpose it was collected, then delete or irreversibly anonymise it. Security logs (login attempts, communication logs, payment-push requests) are automatically purged on a rolling schedule. When a workspace is closed, its data is deleted or returned per our agreement with that customer.
Your rights Under the DPA you have the right to: - be informed about how your data is used; - **access** the personal data we hold about you; - have inaccurate data **rectified**; - have your data **erased** where the law allows; - **object to** or **restrict** certain processing; - **data portability** — receive your data in a structured, commonly used format. If your data was entered by a landlord or company using Jengo, they are the controller — contact them first; we will support them in meeting your request. To exercise a right directly, contact [DPO EMAIL].
Security We protect data with encryption in transit and at rest for sensitive fields, per-workspace data isolation, role-based access control, hashed passwords, and optional two-factor authentication. If a personal-data breach occurs that is likely to cause harm, we will notify the Office of the Data Protection Commissioner and affected data subjects without undue delay, and in any case within **72 hours** of becoming aware, as the DPA requires.
Complaints If you are concerned about how your data is handled, contact our DPO at [DPO EMAIL]. You also have the right to lodge a complaint with the **Office of the Data Protection Commissioner (ODPC)** of Kenya. Our data-controller registration number is [ODPC REGISTRATION NUMBER].
Changes We may update this policy; the effective date above shows the latest version. Material changes will be notified in the app or by email.
Contact [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy enquiries: [DPO EMAIL]. General support: [SUPPORT EMAIL].
Your data rights & the ODPC
This policy is written to meet the Kenya Data Protection Act, 2019. You can exercise your data rights or raise a concern using the contacts in the sections above — and you always have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya. Questions? Email hello@jengo.co.ke and we'll respond within one business day.