Data Protection Policy (DPA)

Effective Date: 1 January 2024

Last Updated: 1 January 2024

1. Overview

This Data Protection Policy ("DPA") describes how DANWILL Investment Ltd collects, processes, stores, and protects personal data in compliance with the Kenya Data Protection Act, 2019 (DPA 2019) and any applicable regulations issued by the Office of the Data Protection Commissioner (ODPC).

2. Data Controller

DANWILL Investment Ltd acts as the Data Controller for personal data collected through our platform.

Contact: info@danwill.co.ke

Address: Tilil House, 2nd Floor, Kenyatta Street, Eldoret, Kenya

3. Legal Basis for Processing

We process personal data on the following legal bases:

Contractual necessity: to provide property management services, process leases, and collect rent

Legal obligation: to comply with KRA eTIMS and other Kenyan regulatory requirements

Legitimate interests: to improve our platform, prevent fraud, and ensure platform security

Consent: for marketing communications and optional cookies

4. Categories of Personal Data

We process the following categories of data:

Identifying data: Name, national ID number, passport number

Contact data: Email address, phone number, physical address

Financial data: Payment records, M-Pesa transaction history

Property data: Lease agreements, property details, maintenance records

5. Data Retention

We retain personal data only for as long as necessary:

Active account data: Duration of your account + 7 years (for tax/legal compliance)

Lease and payment records: 7 years (Kenya tax requirements)

Enquiry/contact data: 2 years

Website analytics: 24 months

6. Data Subject Rights

Under the DPA 2019, you have the following rights:

Right of Access: Request a copy of your personal data

Right to Rectification: Request correction of inaccurate data

Right to Erasure: Request deletion, subject to legal retention obligations

Right to Restriction: Request that we limit processing of your data

Right to Data Portability: Receive your data in a structured, machine-readable format

Right to Object: Object to processing for direct marketing

To exercise any of these rights, email us at info@danwill.co.ke.

7. International Transfers

We do not transfer personal data outside Kenya unless appropriate safeguards are in place, such as standard contractual clauses approved by the ODPC.

8. Security Measures

We implement appropriate technical and organisational measures including:

HTTPS encryption for all data in transit

Encrypted database storage for sensitive fields

Role-based access controls limiting data access to authorised staff

Regular security audits and vulnerability assessments

9. Data Breach Response

In the event of a personal data breach, we will:

Investigate and contain the breach within 24 hours

Notify the ODPC within 72 hours if required

Inform affected individuals without undue delay

10. Complaints

If you believe we have violated your data rights, you may lodge a complaint with:

Office of the Data Protection Commissioner (ODPC)

Website: https://www.odpc.go.ke