Privacy Policy
Draft for review. This policy must be reviewed by a Kenyan advocate, and the highlighted details completed, before Kodia collects any personal data through the app.
1. Who we are
Kodia is operated by registered company name, of registered physical and postal address. We are the data controller for the personal data described in this policy. We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor under registration number ODPC registration number.
This policy explains how we handle personal data under the Data Protection Act, 2019 and its regulations. It applies to kodia.co.ke and to the Kodia app and service. Our Terms and Conditions explain how the service itself works.
2. This website
Kodia is in development, and this website has no forms, accounts, cookies or analytics. Visiting it still involves two other services:
- Vercel, which hosts the website, receives your IP address, browser type, the pages you request and the time of each request. It uses these to deliver the site and protect it from abuse.
- Google Fonts supplies the typeface used on the site. When a page loads, your browser connects to Google, which receives your IP address and browser information.
We will update this policy before the website collects anything else, such as waitlist sign-ups.
3. What the service collects
When the Kodia app launches and you open an account, we will collect:
| Type | Examples |
|---|---|
| Identity and contact | Name, phone number, email address, date of birth, and national ID or passport details used to verify you. |
| Payment details | Your M-Pesa number, the recipient's M-Pesa number, till or paybill and account number, amounts, dates, M-Pesa transaction codes and payment status. |
| Tenancy details | The property and unit you rent, and your landlord's or agent's name and payment details. |
| Rent Cover | Your Kodia payment history, eligibility assessments, Rent Cover agreements, repayments and, where you apply, information from licensed credit reference bureaus. |
| Device and usage | Device model, operating system, app version, IP address, crash reports and how you use the app. |
| Communications | Messages you send us, complaints and support records. |
If you are a landlord or agent, we receive your name and payment details from tenants who pay you through Kodia. We use them only to deliver rent to you and to show tenants who they are paying.
We do not collect your M-Pesa PIN, and we do not read your SMS messages, contacts or photos.
4. Why we use it
The Data Protection Act requires a lawful basis for each use of personal data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Opening your account and sending your rent payments | Performing our contract with you |
| Assessing, providing and collecting Rent Cover | Performing our contract with you |
| Verifying identity, keeping records and reporting suspicious transactions | Complying with Kenyan law, including anti-money laundering and Central Bank of Kenya requirements |
| Preventing fraud and keeping the service secure | Our legitimate interest in protecting you, landlords and Kodia |
| Fixing problems and improving the service | Our legitimate interest in running a reliable service |
| Sending you news and offers | Your consent, which you can withdraw at any time |
We do not sell your personal data, and we do not use it for advertising by other companies.
5. Rent Cover decisions
We may use an automated assessment of your payment history to decide whether you are eligible for Rent Cover and how much cover to offer. If a decision is made this way, you may ask us to explain it and to have a member of our team review it. Contact us using the details in section 13.
6. Who we share it with
- Safaricom, to process M-Pesa payments and confirm recipient names.
- Service providers who host and run Kodia for us, including Google (Firebase and Google Cloud) and Vercel. They may use your data only on our instructions.
- Licensed credit reference bureaus, only in connection with Rent Cover, to check your credit history when you apply and, after the notice required by law, to report a missed repayment.
- A licensed lending partner, if one provides Rent Cover with us. Your Rent Cover agreement will name them.
- Regulators, courts and law enforcement, including the Central Bank of Kenya, the Financial Reporting Centre and the ODPC, when the law requires it.
- Professional advisers, such as auditors and lawyers, under a duty of confidentiality.
- A buyer or successor, if Kodia's business is sold or reorganised. This policy will continue to protect your data.
7. Transfers outside Kenya
Some of our service providers, including Google and Vercel, may store or process data outside Kenya. We transfer data only where the Data Protection Act and the Data Protection (General) Regulations, 2021 allow it, and with safeguards such as contractual commitments to protect it.
8. How long we keep it
- Payment and identity verification records: 7 years after the transaction or the end of our relationship with you, as Kenyan anti-money laundering and tax laws require.
- Rent Cover records: 7 years after the Rent Cover is fully repaid.
- Account profile: while your account is open, then for the periods above.
- Support messages: up to 2 years after the matter is resolved.
- Website server logs: for the short period set by our hosting provider.
When we no longer need data, we delete it or make it anonymous.
9. Security
We encrypt data in transit, limit staff access to what each role needs, and keep records of who accesses personal data. If a data breach puts your rights at risk, we will notify the ODPC within 72 hours of becoming aware of it and tell you without undue delay, as the Data Protection Act requires.
10. Your rights
Under the Data Protection Act, you have the right to:
- be told how your personal data is used, which this policy does;
- get a copy of the personal data we hold about you;
- have inaccurate data corrected, and false or misleading data deleted;
- object to our use of your data, or ask us to restrict it;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent;
- ask for a human review of an automated decision about you.
Some rights are limited where the law requires us to keep data. For example, we cannot delete payment records within the legal retention period. To use any of these rights, contact us. We will respond within the time limits set by the Data Protection (General) Regulations, 2021.
You may also complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
11. Children
Kodia is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We will update this policy when we change how we handle personal data, including before the app launches. We will tell you about material changes by SMS, email or in the app, and show the date of the latest version at the top of this page.
13. Contact us
Data protection contact: data protection officer name
Email: privacy email address
Post: registered physical and postal address