Privacy Policy

1. Who We Are (Joint Data Controllers)

Afriqahome is operated jointly by two affiliated companies:

Kcommando AB (the "Swedish Entity")

• Registration: 559297-3563
• Address: Gamla Enköpingsvägen 144A, 174 61 Sundbyberg, Sweden
• Role: Mobile application publisher and EU/EEA data operations

Afriqaly Limited (the "Kenyan Entity")

• Registration: PVT-KW19A2W3
• KRA PIN: P052455126B
• Address: Minhaj Towers, Waudo Street, Westlands, P.O. Box 567-00601 Gigiri, Nairobi, Kenya
• Role: Marketplace operations, payments, and Kenya-based agent relationships

Under Article 26 of the EU General Data Protection Regulation (GDPR) and the Kenya Data Protection Act 2019, Kcommando AB and Afriqaly Limited act as joint data controllers for the personal data processed through the Service.

You may exercise your rights under this policy by contacting either entity. The primary contact for all privacy matters is:

• Email: info@afriqahome.com
• Phone: +254 710 429 429

2. Information We Collect

2.1 Information You Provide

Account Information

• Name, email address, and phone number
• Password (stored in encrypted form via Supabase Auth)
• Profile photo (optional)
• Preferred areas, property types, and price ranges
• Role (buyer or agent)

Agent Profile Information (agents only)

• Company name, license details, and EARB registration where applicable
• Professional contact information
• Subscription tier and payment status
• Verification documents submitted during agent verification

Communications

• Messages, inquiries, and contact requests sent through the Service
• Customer support communications
• Lead forms submitted to agents

Listings Content (agents only)

• Property descriptions, photos, and pricing
• Location data of listed properties

2.2 Information Collected Automatically

Device and Technical Data

• IP address (collected by hosting and security providers)
• Device type, operating system, and browser
• Mobile app version, device model, and language settings
• Approximate location derived from IP (for content relevance)
• Screen size and accessibility settings

Usage Data

• Pages visited, listings viewed, and search queries
• Saved listings and saved searches
• Click-through events and time spent on features
• Push notification engagement (delivered, opened)

Cookies and Similar Technologies

• Essential cookies for authentication and session management
• Preference cookies for language and display settings
• Analytics cookies for Google Analytics 4 (subject to consent in EEA)

2.3 Information from Payment Processing

When agents subscribe to paid plans (Elevate, Dominate) or purchase Spotlight boosts, M-Pesa transaction references and amounts are recorded. We do not receive or store full M-Pesa customer phone numbers from Safaricom callbacks, as Safaricom masks these.

2.4 Information from Push Notifications

When you enable push notifications in our mobile app, we collect:

• Push notification token (delivered by OneSignal)
• Device identifiers required for push delivery (FCM token on Android; APNs token on iOS when iOS support launches)
• Notification engagement events

2.5 Search Query Logging

When you use Afriqahome's search, we may log your search queries linked to your account to improve search relevance and identify areas where listings are needed in Kenya. This includes:

• The text you enter in the search bar
• The filters you apply (locations, price, beds, property type)
• The number of results returned
• Your user ID if you are signed in

We do not share this data with third parties for advertising. You can request deletion of this data at any time by emailing info@afriqahome.com.

3. Categories of Sensitive Data

Under the Kenya Data Protection Act 2019, the following data we may process is classified as sensitive:

• Property details — your buyer search history and saved listings can reveal financial preferences and personal circumstances. We treat this data with elevated protection and do not share it with agents unless you submit an inquiry.
• Verification documents for agents (national ID, KRA PIN documents) — retained only as long as necessary for verification, then deleted.

We do not knowingly collect: race, ethnic origin, health data, biometric data, sexual orientation, or political opinions.

4. How We Use Your Information

We process your personal data on the following legal bases under GDPR Article 6 and corresponding Kenya DPA provisions:

4.1 Performance of Contract (Art. 6(1)(b))

• Providing the Service: account management, listings, search, messaging, payments
• Connecting buyers with agents through inquiries and lead forms
• Processing subscription payments and Spotlight boosts via M-Pesa
• Sending transactional communications (account updates, payment confirmations, lead notifications)

4.2 Consent (Art. 6(1)(a))

• Marketing emails and promotional push notifications
• Optional analytics cookies (in EEA)
• Sharing your contact details with a specific agent when you submit an inquiry

You may withdraw consent at any time without affecting processing already carried out.

4.3 Legitimate Interests (Art. 6(1)(f))

• Fraud prevention and platform security
• Service improvement and aggregated analytics
• Customer support communications
• Verification of agent credentials to protect users from scams

4.4 Legal Obligations (Art. 6(1)(c))

• Tax record-keeping under Swedish Bookkeeping Act and Kenyan tax law (7 years)
• Anti-money laundering checks where applicable
• Compliance with court orders or regulatory requests

5. How We Share Your Information

We do not sell your personal data to third parties. We share information in the following circumstances:

5.1 With Agents (when you initiate contact)

When you submit an inquiry, lead form, or contact request through the Service, your name, phone number, email, and the property of interest are shared with the relevant agent. Once shared, the agent becomes an independent data controller for their own use of your information. We require agents to comply with applicable data protection laws.

5.2 With Service Providers (Data Processors)

We use the following service providers to operate the Service. Each is bound by a data processing agreement and processes data only on our instructions:

5.3 With Legal Authorities

We may disclose information when required by Swedish law, Kenyan law, court order, or lawful regulatory request.

5.4 In Connection with Business Transfers

If Kcommando AB or Afriqaly Limited is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before any change in data controller takes effect.

6. International Data Transfers

The Service operates across multiple jurisdictions. Your data may be transferred to and processed in:

• European Economic Area (EEA): Supabase database hosting in Frankfurt, Germany
• United States: Vercel, Google services, OneSignal, Airtable
• Kenya: Afriqaly Limited operations and Safaricom M-Pesa processing

For transfers outside the EEA, we rely on:

• EU-US Data Privacy Framework for transfers to certified U.S. providers
• Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914 for other third-country transfers, including transfers to Kenya
• Explicit consent where applicable

The European Union and Kenya formally launched an Adequacy Dialogue on 7 May 2024. Until an adequacy decision is issued, we maintain SCCs for EU-Kenya transfers.

You may request a copy of the safeguards in place by contacting info@afriqahome.com.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

When the retention period expires, data is deleted or fully anonymized.

8. Your Rights

8.1 Rights under GDPR (EU/EEA users)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): Request deletion of your data
• Restriction: Limit how we process your data
• Data Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests, including direct marketing
• Withdraw Consent: Withdraw any consent you previously gave
• Not be Subject to Automated Decision-Making: We do not use automated decision-making with legal effects

8.2 Rights under Kenya Data Protection Act 2019

You have the right to:

• Be informed of the use of your personal data
• Access your personal data in custody of either controller
• Object to processing of your personal data
• Correction or deletion of false or misleading data

8.3 Rights for U.S. Users (California, Virginia, Colorado, Connecticut, Utah)

If you are a resident of these states and applicable thresholds are met, you may have additional rights including the right to know what categories of data we collect, to request deletion, and to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.

8.4 Rights for UK Users

UK GDPR rights mirror EU GDPR rights described above.

8.5 Rights for Canadian Users

Under PIPEDA, you may access and correct your personal information held by us and file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

8.6 How to Exercise Your Rights

Contact info@afriqahome.com with your request. We will respond within 30 days (GDPR), 7 days (Kenya DPA), or 45 days (CCPA), as applicable.

You may also lodge a complaint with the relevant supervisory authority:

• Sweden: Integritetsskyddsmyndigheten (IMY) — imy.se
• Kenya: Office of the Data Protection Commissioner — odpc.go.ke
• United Kingdom: Information Commissioner's Office — ico.org.uk
• Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca

9. Account Deletion

You can delete your Afriqahome account at any time:

• In the Mobile App: Profile → Settings → Delete Account
• On the Website: Visit afriqahome.com/delete-account or sign in and go to Account Settings → Delete Account
• By Email: Send a deletion request to info@afriqahome.com from your registered email address

When you delete your account:

• Your profile and account data are removed from active systems within 30 days
• Backups containing your data are purged within 90 days
• Listings, inquiries, and messages tied to your account are removed or anonymized
• Some data is retained where required by law (transaction records: 7 years)

10. Push Notifications

If you enable push notifications, we use OneSignal Inc. to deliver them. You can:

• Disable push notifications in your device settings at any time
• Disable promotional push notifications separately while keeping transactional notifications enabled, in your in-app notification preferences

OneSignal collects: push token, device type, OS version, app version, time zone, language, and engagement events. OneSignal acts as our data processor under a signed data processing agreement. See OneSignal's privacy policy at onesignal.com/privacy_policy.

11. Cookies and Tracking

We use cookies and similar technologies on afriqahome.com:

• Essential cookies: Required for sign-in, security, and core features. Cannot be disabled.
• Preference cookies: Remember your language and display settings.
• Analytics cookies: Google Analytics 4 — only with your consent in EEA/UK.

You can control cookies through your browser settings or our cookie banner. Withdrawing consent does not affect lawful processing carried out before withdrawal.

We do not use advertising cookies or cross-site tracking technologies. We do not engage in "tracking" as defined by Apple's App Tracking Transparency framework, and our iOS app does not display the App Tracking Transparency prompt.

12. Security

We protect your data using:

• TLS encryption for data in transit (HTTPS)
• AES-256 encryption for data at rest (Supabase database)
• Row-level security policies restricting access to your own data
• Regular security reviews and updates
• Strict access controls limiting employee access to data on a need-to-know basis

While we implement industry-standard safeguards, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

If we become aware of a personal data breach affecting you, we will notify the relevant supervisory authority within 72 hours, and we will notify you directly if the breach is likely to result in high risk to your rights.

13. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact info@afriqahome.com and we will delete it promptly.

14. Mobile Application Specifics

Our mobile applications collect data in addition to what is described above:

Permissions we may request:

• Notifications: To deliver lead alerts and account updates
• Camera and Photo Library (agent listing uploads only): To upload property photos
• Approximate location (optional): To show nearby listings

We do not request precise GPS location, contacts, calendar, microphone, or biometric data.

Apple App Privacy Details: When the iOS app launches, the data collection summary in the App Store will reflect this Privacy Policy.

Google Play Data Safety: Our Data Safety form on Google Play matches this Privacy Policy. Any discrepancy is unintentional, and this Privacy Policy governs.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by:

• Updating the "Last Updated" date at the top of this policy
• Posting a prominent notice on the Service
• Sending an email to your registered email address for significant changes

Continued use of the Service after the updated date constitutes acceptance of the changes.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights:

• Email: info@afriqahome.com
• Phone: +254 710 429 429

By Mail (Sweden):

Kcommando AB
Gamla Enköpingsvägen 144A
174 61 Sundbyberg
Sweden

By Mail (Kenya):

Afriqaly Limited
Minhaj Towers, Waudo Street, Westlands
P.O. Box 567-00601 Gigiri
Nairobi, Kenya

For complaints to a supervisory authority, see Section 8.6 above.