Privacy Policy

Introduction

Realix Property Limited ("Realix", "we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Tenant Privacy Policy ("Policy") explains how we collect, use, share, and protect your personal data when you use our Realix Tenant App (the "App" or "Platform") as a tenant managing leases, rent payments, and related rental services through our property management system.

Realix is a technology-driven property management platform designed to streamline rental operations, automate financial processes, and enhance transparency between landlords and tenants. Our system provides a structured digital solution that simplifies property administration, improves rent collection efficiency, and delivers real-time financial visibility. We combine operational management with secure payment automation to ensure property owners maintain full control over their investments while improving tenant experience.

We are a limited liability company registered in Kenya. This Policy applies to tenants in Kenya and across Africa and complies with the Data Protection Act, 2019 (Cap. 411C) ("DPA") and its regulations. By using the App, you consent to the practices described in this Policy.

If you have any questions about this Policy, please contact us at the details provided in the "Contact Us" section.

Definitions

In this Policy, the following terms have the meanings assigned under the DPA, unless otherwise defined:

·   "Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to names, contact details, location data, lease details, and other identifiers.

·   "Data Subject" means you, the tenant whose personal data is processed.

·   "Processing" means any operation or set of operations performed on personal data, including but not limited to collection, storage, use, disclosure, or deletion.

·   "Data Controller" means Realix, which determines the purposes and means of processing your personal data.

·   "Data Processor" means any third party that processes personal data on our behalf.

·   "Sensitive Personal Data" means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person's sex life or sexual orientation (note: Realix does not collect sensitive personal data from tenants).

Other terms used in this Policy shall have the meanings given in the DPA.

Information We Collect

We collect the following categories of personal data from tenants:

·   Personal identifiers: Full name, email address, phone number, and account credentials, including but not limited to username and password.

·   Profile and lease information: Any details you provide in your tenant profile, including rental property address, unit details, lease terms, duration, and supporting documents.

·   Transaction data: Details of rent payments, payment history, invoices, lease agreements, and communications related to your tenancy.

·   Location data: Rental property address and approximate location data, collected with your permission for lease management, notifications, and occupancy tracking.

·   Device and usage data: Device type, operating system, app version, IP address, timestamps, log data, pages viewed, features used, and error or crash reports.

·   Documents and communications: Lease documents, receipts, photos or images you upload, and in-app messages or support queries.

We do not collect sensitive personal data from tenants.

How We Collect Your Information

We collect your personal data in the following ways:

·   Directly from you: When you register an account, complete digital tenant onboarding, create or accept a lease, make rent payments, upload documents, or communicate via the App.

·   Automatically: Through device and app usage data, cookies, SDKs, and similar technologies when you interact with the App.

·   From third parties: From secure payment processors for transaction details, from landlords or property managers for lease and occupancy information, or analytics tools for aggregated usage insights.

How We Use Your Personal Data

We use your personal data for the following purposes:

·   Account management: To create and maintain your account, verify your identity, and provide access to the App.

·   Lease and rent management: To facilitate digital tenant onboarding, manage leases and rent locking, process rent payments, send payment reminders and notifications, monitor occupancy, and provide access to your payment history and financial records.

·   Payments: To process rent payments and related transactions via secure payment processors.

·   Security and fraud prevention: To detect and prevent abuse, fraud, or unauthorised access.

·   Analytics and improvement: To analyse usage patterns, provide financial visibility, troubleshoot issues, and enhance the App's performance and tenant experience.

·   Customer support: To respond to your inquiries, resolve disputes, and provide assistance.

·   Marketing: To send promotional communications about offers, discounts, new features, or rental-related updates, subject to your opt-out preferences.

We do not use your data for automated decision-making that produces legal effects or similarly significantly affects you.

Lawful Basis for Processing Personal Data

We process your personal data based on the following lawful bases under the DPA:

·   Consent: For location data collection (where you enable it) and marketing communications (which you can withdraw at any time).

·   Performance of a contract: For account management, lease facilitation, rent payments, and tenancy services, as necessary to provide the App's core functions.

·   Legitimate interests: For security, fraud prevention, analytics, and App improvements, where our interests are not overridden by your rights.

·   Legal obligations: To comply with tax reporting, accounting, dispute resolution, or requests from authorities.

Sharing of Personal Data

We share your personal data only as necessary and in the following circumstances:

·   With landlords or property managers: Your name, contact details, rental address, lease details, payment history, occupancy status, and uploaded documents (if applicable) are shared with the relevant landlord or property manager to facilitate lease management, rent collection, notifications, and tenancy communications.

·   With third-party vendors: Secure payment processors for transaction processing.

o   Analytics and monitoring tools, including but not limited to Google Analytics for usage insights.

o   Cloud hosting providers for data storage.

·   For legal compliance: With authorities, courts, or regulators if required by law, or to protect our rights in disputes.

·   In business transfers: If Realix is involved in a merger, acquisition, or asset sale, your data may be transferred as part of the transaction, subject to confidentiality obligations.

We do not sell your personal data. All sharing is limited to what is necessary, and third parties are contractually obligated to protect your data and use it only for the specified purposes.

International Data Transfers

Your personal data may be stored or processed outside Kenya by our third-party cloud providers or vendors. In such cases, we ensure appropriate safeguards are in place, such as standard contractual clauses, binding corporate rules, or adequacy decisions, as required under Sections 48 and 49 of the DPA, to protect your data to a standard equivalent to Kenyan law.

Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Policy, or as required by law, including but not limited to tax, accounting, auditing, legal claims, dispute resolution, fraud prevention, and regulatory requirements. For example:

·   Account and lease data is retained while your tenancy or account is active and for a reasonable period after closure or lease expiry, including but not limited to fraud prevention, dispute resolution, and legal compliance.

·   Transaction and payment data is kept for legal compliance, including but not limited to tax and accounting purposes.

Upon request or account deletion, we will delete or anonymise your data, subject to any legal retention obligations. Inactive accounts may be deleted after a period of prolonged inactivity.

Your Rights Under the Data Protection Act, 2019

As a data subject, you have the following rights under the DPA:

·   Right to be informed: About how your data is collected and used (as detailed in this Policy).

·   Right of access: To request a copy of your personal data.

·   Right to rectification: To correct inaccurate or incomplete data.

·   Right to erasure ("right to be forgotten"): To request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.

·   Right to restriction of processing: To limit processing in certain circumstances.

·   Right to data portability: To receive your data in a structured, commonly used format and transfer it to another controller.

·   Right to object: To processing based on legitimate interests or for direct marketing.

·   Right not to be subject to automated decision-making: Including profiling that produces legal effects.

These rights are subject to exemptions under the DPA.

How to Exercise Your Rights

To exercise any of your rights, contact us at privacy@realix.co.ke[GO1]  or through the in-app support feature. Include details of your request and proof of identity if necessary.

We will respond to valid requests within 30 days (extendable by 14 days for complex cases), free of charge unless the request is manifestly unfounded or excessive. If we deny your request, we will explain why and inform you of your right to complain to the Office of the Data Protection Commissioner (ODPC).

For marketing opt-outs, use the unsubscribe link in emails or adjust settings in your account.

Data Security

We implement reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These include, but are not limited to:

·   Encryption of data in transit and at rest (where appropriate).

·   Access controls and authentication protocols.

·   Regular security audits and staff training.

·   Incident response plans.

In the event of a data breach that poses a high risk to your rights, we will notify you and the ODPC within 72 hours, as required under Section 43 of the DPA.

However, no system is completely secure, and we cannot guarantee absolute security.

Cookies and Similar Technologies

We use cookies, SDKs, and similar technologies to enhance your experience, analyse usage, and detect fraud. These include, but are not limited to:

·   Essential cookies: For core functions like authentication and security.

·   Analytics cookies: From third parties, including but not limited to Google Analytics, to collect aggregated data on interactions.

You can manage cookies through your browser or device settings, but disabling them may limit App functionality.

Children's Privacy

The App is not intended for children under 18 years old. We do not knowingly collect personal data from children. If we become aware of such data, we will delete it promptly. Parents or guardians who believe we have collected a child's data should contact us immediately.

Third-Party Links and Services

The App may contain links to third-party websites or services, including but not limited to landlord portals or external payment pages. We are not responsible for their privacy practices. We encourage you to review their policies before providing data.

Changes to This Privacy Policy

We may update this Policy to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email, in-app notice, or on the App, at least 14 days before they take effect. Continued use of the App after changes constitutes acceptance. Check this Policy regularly for updates.

Contact Us

For questions, requests, or concerns about this Policy or your personal data:

·   Email: privacy@realix.co.ke

·   Address: Realix Property Limited, Room 706, 7th Floor, The Avelon, Ngong Road, Nairobi, Kenya.

·   Phone: +254 140 893884

Complaints to the Office of the Data Protection Commissioner

If you believe your rights have been violated, you may lodge a complaint with the ODPC:

·   Website: www.odpc.go.ke

·   Email: info@odpc.go.ke

·   Address: Office of the Data Protection Commissioner, Britam Tower, 12th & 13th Floor, Hospital Road, Upper Hill – Nairobi

·   Phone: 0796954269

We encourage you to contact us first to resolve any issues.

Effective Date: 30/03/2026

This Privacy Policy is issued by Realix Property Limited.