Legal
Privacy Policy
Effective date: 1 June 2026
1. Who We Are
RealtyFlow Ltd. (“we”, “us”, “our”), incorporated in Kenya, operates the RealtyFlow CRM platform, the RealtyFlow Marketplace, and this marketing website. We are a data controller under the Kenya Data Protection Act 2019 (Cap. 411C) and its subsidiary Data Protection (General) Regulations 2021.
Questions or requests about this policy may be sent to privacy@realtyflow.co.ke.
2. Personal Data We Collect
- Account data: name, email address, and password (stored as a one-way hash) for CRM subscribers.
- Organisation data: agency or organisation name provided at registration.
- Contact form data: name, email, phone, company, and message content submitted through this website's Contact page.
- Usage data: pages viewed and interaction logs collected automatically.
- CRM data you enter: contact records, leads, properties, and notes you create within the platform belong to you and your organisation.
- Technical data: IP address, browser type, and session identifiers.
3. This Marketing Website
In addition to CRM subscriber data, this website (realtyflow's public marketing site) collects the information you submit through its Contact form so we can respond to your enquiry, and a small amount of local storage to remember your cookie preference. See our Cookie Policy for full detail on cookies and local storage used here. We do not require an account to browse this website, and we do not currently run third-party analytics or advertising trackers on it.
4. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Provide, maintain, and improve the platform | Performance of a contract |
| Respond to a Contact form enquiry | Legitimate interests / Consent |
| Send transactional emails (account, notifications) | Performance of a contract |
| Enforce security and prevent fraud | Legitimate interests |
| Comply with legal and regulatory obligations | Legal obligation |
| AI-assisted description generation (processes listing content) | Legitimate interests |
5. Sharing Your Data
- Within your organisation: CRM data is shared with other users in your organisation as configured by your administrator.
- Service providers (data processors): we use third-party providers for cloud hosting, email delivery, error tracking, and AI features.
- SuperAdmin access: RealtyFlow platform administrators may access account-level data for support, security, and compliance purposes. All such access is logged.
- Legal requirements: we may disclose data where required by law, court order, or regulatory authority.
We do not sell your personal data to third parties.
6. Data Retention
- Active accounts: retained while your subscription is active.
- Contact form messages: retained for as long as needed to resolve the enquiry, then archived for a reasonable support-history period.
- Deleted accounts: personal account data is deleted within 30 days of account closure.
- Audit logs: retained for up to 24 months for security and compliance purposes.
7. International Data Transfers
We use service providers whose infrastructure is located outside Kenya, including in the United States and the European Union. These transfers are carried out under contractual safeguards consistent with Section 48 of the Kenya Data Protection Act 2019.
8. Your Rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erasure of your account and personal data.
- Data portability — request a copy of your data in a portable format.
- Object to processing for legitimate interest purposes.
- Withdraw consent where processing is consent-based.
Email privacy@realtyflow.co.ke to exercise any right. We will respond within 21 days.
9. EU Visitors & GDPR
If you are located in the European Economic Area, we also process your personal data in accordance with the EU General Data Protection Regulation (GDPR). Our lawful bases are consent (Art. 6(1)(a), for non-essential cookies) and legitimate interests (Art. 6(1)(f), for handling Contact form enquiries and securing the Platform). The rights listed in Section 8 correspond to GDPR Articles 15–21 (access, rectification, erasure, restriction, portability, and objection). You may lodge a complaint with your local EU supervisory authority, in addition to Kenya's Office of the Data Protection Commissioner (Section 11).
10. Security
We implement TLS encryption in transit, hashed password storage, role-based access controls, and regular security reviews. In the event of a data breach likely to affect your rights, we will notify the ODPC and affected individuals within 72 hours as required by law.
11. Complaints
If you are not satisfied with our data handling, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected here with an updated effective date, and, where the change is significant, surfaced again via the cookie consent banner on this website.