Privacy Policy

1. Data We Collect

1.1 Landlords & Property Owners

• Identity Data: Full legal name, National ID card number or Passport copy, corporate registration documents.
• Contact Data: Physical address, phone number, and email address.
• Property Verification Data: Title Deeds, Share Certificates, Sectional Properties documentation, or recent utility bills.
• Financial Data: Bank account details and Paystack subaccount credentials.

1.2 Tenants

• Identity Data: Full legal name, National ID number, Passport number, and photographs.
• Contact Data: Active mobile number, physical address, and email address.
• Screening Data: Employment status, place of work, monthly income statements, and previous landlord references.
• Transaction Data: Rent payments, service charges, utilities, and transaction references.
• Operational Data: Maintenance requests, structural defect images, in-app messaging logs.

2. Lawful Basis for Processing Data

We process your personal data only when a legal basis under Section 30 of the Kenya Data Protection Act applies:

• Consent: You give us explicit, unambiguous consent during registration or tenant vetting.
• Performance of a Contract: The processing is necessary to execute platform services, route payments, or manage tenancy workflows.
• Legal Obligation: To comply with statutory declarations required by KRA via eTIMS.
• Legitimate Interests: To prevent fraud, verify property listing authenticity, and maintain platform security.

3. Tenant Vetting & Screening Workflow

By submitting an application for a listed property, Tenants explicitly acknowledge and consent to:

4. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade your personal data. Your data is shared exclusively with:

• Landlords: Authorized landlords gain access to tenant screening metrics strictly to evaluate tenancy applications.
• Paystack: Financial data and split-payment configurations are securely transferred to Paystack.
• Kenya Revenue Authority (KRA): Transaction metadata is transmitted via eTIMS integration.
• Law Enforcement: Data may be disclosed if required by a court order or official mandate.

5. Revenue Management and Data Separation

• Subaccount Data Safety: Cardholder data and raw banking access keys are never processed or retained within our infrastructure.
• Cross-Border Transfers: Paystack may process data via secure cloud regional hubs, in compliance with Section 41 of the Data Protection Act.
• Billing Configuration: We process owner package selections, portfolio eligibility information, fee mode, promotional-month status, payment references, and platform-fee calculations to administer owner billing.
• Split-Payment Metadata: Paystack may receive transaction-charge, subaccount, settlement, and fee metadata required to apply the selected package.

6. Owner Packages and Outstanding Fees

Property owners may select an available billing package during registration. Packages may use a percentage platform fee, an approved flat monthly fee based on configured portfolio criteria such as units or tenants, or a per-building monthly fee charged on rent payments after the configured property threshold is met.

Where a flat monthly fee is not fully covered by the first successful payment of a billing month, Winda records the unpaid balance and applies it to subsequent successful transactions until the monthly fee is fully collected. Each successful transaction and remaining balance are recorded for reconciliation.

Superadmins may configure discounted months or free months. Package and promotion changes are subject to the applicable Terms of Service and are reflected in the owner's billing records.

7. Data Security and Retention

6.1 Security Standards

• End-to-end transport layer security (HTTPS/TLS) across all application endpoints.
• Role-Based Access Controls (RBAC) preventing unauthorized data access.
• Encrypted database arrays for user passwords and verification files.

6.2 Data Retention

• Active Tenancy: Data is maintained for the complete duration of an active tenancy.
• Post-Tenancy: Data is archived after 3 years, except where required for accounting or tax audits.
• Rejected Applications: Vetting documents are automatically deleted within 90 days of refusal.

8. Your Data Privacy Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access: Request a copy of all personal data held about you.
• Rectification: Demand correction of inaccurate, outdated, or incomplete profiles.
• Objection: Object to the processing of your data (may result in termination of access).
• Erasure: Request the complete deletion of your data files (subject to KRA transaction logging).
• Lodge a Complaint: File a dispute with the Office of the Data Protection Commissioner (ODPC).

9. Contact and Data Protection Compliance