Last updated
This notice explains what personal data Equitable Homes Real Estate Limited collects through this website, why, who else handles it, how long we keep it and the rights you have under the Data Protection Act, 2019 ("the Act"). We give you this notice before you send us anything, as section 29 of the Act requires.
Who we are
Equitable Homes Real Estate Limited is the data controller for the personal data described here. Email info@equitablehomes.co.ke, call +254 724 331 332, or write to Equitable Homes Real Estate Limited, Lanphil Arcade, 2nd Floor, Kiambu Road, Ridgeways, Nairobi [Confirm office address].
- ODPC registration: [Confirm whether Equitable Homes is registered with the ODPC as a data controller, and the certificate number]. Businesses that sell land or manage property must register with the Office of the Data Protection Commissioner whatever their turnover, under the Third Schedule of the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
- Person responsible for data protection: [Confirm name and contact of the data protection officer or the person handling data protection requests].
What we collect and why
We only collect what you type into one of our five forms. Name and phone number are required. Everything else is optional, and leaving it out only means we may need to ask you when we call back.
- Site visit and viewing requests: name, phone, email if given, preferred date and time, number of visitors, the plot, project or listing you asked about, and your message. We use them to arrange the visit.
- Reservation requests: name, phone, email if given, the plot and payment plan you chose, and your message. We use them to contact you about reserving the plot. A request is not a reservation until we confirm it in writing.
- Owner listing requests: name, phone, email if given, and the details of your property (type, sale or rent, area, county, asking price or rent, bedrooms, bathrooms, your notes). We use them to assess and discuss listing your property.
- Consultancy enquiries: name, phone, email if given, the topic and your message. We use them to answer your question.
- Security data: when you send a form, Cloudflare Turnstile checks that a person, not an automated script, sent it. To do that it processes technical details of your browser and your IP address.
- EH Advisor questions: if you use our chat assistant, the questions you type and its answers in that conversation are sent to Anthropic, which provides the AI model behind it, to produce each answer. We do not keep them: they are not stored in our content system or written to our server logs. Your IP address is used briefly to limit how many questions can be asked each minute, and Cloudflare Turnstile checks the chat the same way it checks the forms. Please do not type personal details into the chat. To book a visit or share your details, use a form or WhatsApp.
We record the date and time of each request and the fact that you ticked the consent box. The consent box is never ticked for you and is never tied to marketing.
Our lawful basis
Section 30 of the Act lets us process personal data only on a lawful basis. We rely on:
- Your consent to use the details in your form to respond to your request. You can withdraw it at any time by contacting us. Withdrawing does not undo anything lawfully done before.
- Steps you ask us to take before a contract, when you request a reservation, a viewing or a listing.
- Legal obligations, for records the law requires us to keep, including identity checks under the Proceeds of Crime and Anti-Money Laundering Act when a sale or letting goes ahead.
- Our legitimate interest in answering the questions you choose to ask EH Advisor, and in keeping the forms and the chat free of spam and abuse, which is the Turnstile check and the question limit.
When a sale or letting goes ahead
If you go on to buy, sell, let or rent through us, we will ask for more, such as a copy of your national ID or passport and your KRA PIN, because the law requires it. We ask for these in person or through our office, never through this website. [Confirm which documents are collected at transaction stage and where they are kept.]
Who receives your data
Only our staff who handle your request see it. We also use these service providers, who process it on our instructions only:
- Sanity stores each request in our content system.
- Cloudflare hosts this website and runs the Turnstile check.
- Resend delivers the email that alerts our office to a new request.
- Anthropic runs the AI model behind EH Advisor and receives what you type into the chat. Under Anthropic's commercial terms it does not use those questions to train its models, and deletes them within 30 days, unless it needs to keep them longer to enforce its usage policy, or the law requires it.
We do not sell your personal data, and we do not share it with anyone else for their own marketing.
Transfers outside Kenya
Sanity, Cloudflare, Resend and Anthropic run their services from data centres outside Kenya, so your data is transferred out of Kenya when you send a form or use EH Advisor. Section 48 of the Act allows this where we have given the Data Commissioner proof of appropriate safeguards. We rely on each provider's data processing terms, which commit them to security measures and to processing only on our instructions. [Confirm the transfer safeguards recorded with the ODPC.]
Storage on your own device
Saved estates and the homes compare list are kept in your browser's local storage on your own device. They never reach us, and clearing your browser data removes them.
[Confirm whether any analytics or advertising tool, such as Google Analytics or the Meta Pixel, runs on this site today through Cloudflare Zaraz.] Analytics and advertising measurement tools load only after you agree to them through a choice shown on this site, and this notice names each one before it is switched on.
How long we keep it
Section 39 of the Act lets us keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. [Confirm retention periods: enquiries that do not lead to a transaction, and transaction records.] When a period ends we delete or anonymise the record.
How we protect it
The site runs over HTTPS only. Requests are held in a private dataset that needs an access key to read, and only named staff accounts can open them. The forms reject automated submissions. If a breach puts your data at real risk, we will tell the Data Commissioner within 72 hours of becoming aware of it, and tell you in writing, as section 43 of the Act requires.
Your rights
Under sections 26, 35, 36, 37, 38 and 40 of the Act you have the right to:
- be told how your personal data is used, which is this notice;
- get a copy of the personal data we hold about you;
- object to our processing of all or part of it;
- have false or misleading data corrected, and have data deleted where we no longer have a lawful reason to keep it;
- not be subject to a decision based only on automated processing. We make no such decisions: a person reads every request;
- refuse the use of your data for marketing;
- receive the data you gave us in a common machine-readable format.
To use any of these rights, contact us as set out above. We may ask you to prove your identity first. We will reply within the time set by the Data Protection (General) Regulations, 2021.
Complaints
If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner under section 56 of the Act.
Children
Our services are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, contact us and we will delete them.
Artificial intelligence
EH Advisor, our chat assistant, is an AI. It answers only from the pages published on this website and tells you so in the chat window. It makes no decisions about you and cannot reserve, price or approve anything. We do not put the details you send through our forms into AI tools. Our AI governance policy explains where AI is and is not used on this site.
Changes to this notice
We will update this page when our practice changes and change the date at the top. The version on this page is the one that applies.