Legal

Privacy Policy

Last updated 1 July 2026. We collect what verification and accountability require, and nothing that only serves to profile you.

1. Who we are

Seruya Limited ("Seruya", "we") operates a property discovery, verification and transaction platform for the Kenyan market. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it.

We are the data controller for the personal data described here. Our processing is governed by the Kenya Data Protection Act, 2019.

2. What we collect

We collect only what a verified, accountable marketplace requires:

Account data — name, phone number, email address, password credentials and role (owner, agent or hunter).
Verification data — National ID, KRA PIN, selfie and liveness capture, and for agents, business registration, estate agency licence and office details.
Ownership documents — title, lease or utility records submitted by owners to prove a right to list a property.
Property data — listing details, photos, inspection reports and viewing rules.
Transaction data — package purchases, viewing bookings, offers, agreements, wallet entries and payout records.
Usage data — device and browser information, IP address, and interaction logs used for security, fraud detection and service reliability.
Location data — where you grant permission, for property search, area hunting and viewing route optimisation.

3. Why we process it

To verify identity, ownership and agent licensing — the core of the service, and the basis on which a listing is published.
To operate the platform: search, matching, bookings, itineraries, offers, agreements and commission distribution.
To take and reconcile payments through our licensed payment service provider.
To prevent fraud, detect duplicate or fabricated listings, and investigate disputes.
To meet legal, tax and regulatory obligations.
To send service communications about your bookings, listings and payouts. Marketing messages require your consent and can be withdrawn at any time.

4. Who can see your data

Verification documents are never shown to other users. An agent, owner or hunter sees that a counterparty is verified — they do not see the ID, PIN or documents behind that status.

Only what a transaction requires is shared: an owner sees the identity of an agent approved to market their property and the fact that a booked hunter holds a valid package; an agent sees the contact details needed to conduct a scheduled viewing; a hunter sees the agent’s verified profile and public track record.

5. Third parties we rely on

Each processor is bound by contract to process personal data only on our instructions and to protect it to the standard required by the Act.

A licensed payment service provider and mobile money operator, which process payments. Seruya does not hold customer funds directly.
Cloud hosting and object storage providers for the platform and its media and documents.
SMS and email providers for one-time passcodes and service notifications.
Mapping and routing providers for search, area hunting and itinerary optimisation.
Government and registry data sources for ownership verification, where lawfully available.

6. How we protect it

Identity and ownership documents are stored encrypted, with access limited to the operations staff who perform verification and dispute review. Access is logged and audited. Access tokens are held in memory in your browser and are never written to local storage. All traffic to the platform is encrypted in transit.

7. How long we keep it

Account and verification data is retained while your account is active and for the period afterwards required by law, tax rules and fraud-prevention needs. Transaction records — bookings, offers, agreements and payouts — are retained for the statutory retention period applicable to financial records. Where data is no longer needed for any of these purposes, it is deleted or irreversibly anonymised.

8. Your rights

To exercise any of these, email privacy@seruya.example from the address on your account. We respond within the statutory timeframe.

To be informed of how your data is used — this policy.
To access a copy of the personal data we hold about you.
To have inaccurate or incomplete data corrected.
To request deletion, where we are not required to keep the data by law or for an ongoing transaction or dispute.
To object to processing, and to withdraw consent for marketing at any time.
To lodge a complaint with the Office of the Data Protection Commissioner.

9. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to protect sessions, and limited analytics to understand which parts of the service are used and where they fail. We do not sell personal data, and we do not use third-party advertising trackers.

10. Children

The platform is not intended for anyone under 18. We do not knowingly create accounts for minors, and we delete such accounts on becoming aware of them.

11. Changes to this policy

If we make a material change we will notify account holders by email or in-product notice before it takes effect. The date below records the current version.

12. Contact

Data protection queries: privacy@seruya.example. General support: hello@seruya.example. Postal: Seruya Limited, Westlands, Nairobi, Kenya.