Last updated: 5 August 2026
This Policy is provided for operational use by PulseProperties and should be reviewed by your Kenyan advocate before you rely on it as final legal advice. It should be read together with our Terms of Service.
1.1. PulseProperties (“Provider”, “we”, “us”) operates PropertyOS (the “Service”), a rental housing management platform used by landlords, agencies, estate managers, staff, and tenants in Kenya.
1.2. This Privacy & Data Protection Policy (“Policy”) explains how we collect, use, disclose, retain, and protect personal data in connection with the Service, in line with the Data Protection Act, 2019 (Kenya) (“DPA”) and its subsidiary regulations.
1.3. This Policy applies to Account holders (Agencies, Landlords, Staff, Managed Landlord Clients, and Tenant Portal users), visitors to our marketing website and RentHub marketplace, and, indirectly, to the individuals whose personal data our Customers upload to the Service.
2.1. Data protection responsibility under this Policy is split according to the type of data, in line with the DPA's distinction between a “data controller” and a “data processor”:
(a) Provider is the Data Controller for account, billing, and platform-usage data relating to our Customers and their registered users — for example, the name, email, phone number, and role of a person who registers an Account, and subscription/payment records between Customer and Provider.
(b) Provider is a Data Processor (and our Customer is the Data Controller) for “portfolio data” that our Customers input about tenants, landlords, occupants, guarantors, and prospective tenants — for example, tenant contact details, lease terms, invoices, payment history, uploaded identification documents, and messages sent through the Service.
2.2. If you are a tenant, occupant, prospective tenant, guarantor, or landlord client whose data has been uploaded to the Service by an Agency or Landlord Customer, your primary relationship for data protection purposes is with that Customer (as Data Controller), and you should direct data subject requests to them in the first instance, copying us at hello@propertyos.test if you are unable to reach them.
This Policy is relevant to the following categories of individuals (“data subjects”):
(a) Account users — Agency principals, Landlords, Staff, and administrators who register and use the Service;
(b) Tenants and occupants — individuals residing in or leasing units managed through the Service;
(c) Landlords managed by an Agency — individuals whose property portfolios are managed by an Agency Customer;
(d) Prospective tenants / leads — individuals who enquire about a property through RentHub or otherwise;
(e) Guarantors and emergency contacts — individuals named in connection with a tenant's lease; and
(f) Website visitors — individuals browsing our marketing pages or RentHub listings without an Account.
Depending on your relationship with us, we (directly, or on behalf of a Customer) may collect:
(a) Identity and contact data — full name, email address, phone number, physical or postal address, and county;
(b) Identification documents — where a Customer chooses to upload them, copies of national ID, passport, or KRA PIN certificates for tenants, landlords, or guarantors;
(c) Financial data — rent amounts, invoices, payment records, mobile money transaction references, bank details used for payouts, deposit records, and payroll figures for Customer's staff;
(d) Property data — property and unit details, lease terms, meter readings, and maintenance records, which may indirectly relate to identifiable individuals (for example, a unit occupant);
(e) Communications data — content and metadata of SMS, WhatsApp, email, and in-app messages sent or received through the Service, and support/contact form enquiries;
(f) Account and usage data — login timestamps, IP address, device and browser information, feature usage, and audit logs of actions taken on the Platform; and
(g) Marketing and enquiry data — information submitted through our contact forms, demo requests, or RentHub lead forms.
4.2. We do not intentionally collect special/sensitive categories of personal data (such as health, biometric, or genetic data) except where a Customer chooses to record limited health-related information relevant to a tenancy (for example, an accessibility requirement), which remains that Customer's responsibility as Data Controller to justify and protect.
We collect personal data (a) directly from you, when you register, fill in a form, or communicate with us; (b) from our Customers, who input data about their tenants, landlords, and other contacts; and (c) automatically, through cookies, server logs, and similar technologies as described in Section 15.
We process personal data to: provide, operate, and maintain the Service; authenticate Account users and secure Accounts; process and reconcile payments made through Third-Party Services; send transactional communications (such as invoices, receipts, rent reminders, verification codes, and billing notices); provide customer support; investigate and prevent fraud, abuse, and security incidents; comply with legal, regulatory, and tax obligations; produce aggregated and anonymised analytics to improve the Service; and, where you have consented, send marketing communications about the Service.
We rely on one or more of the following lawful bases recognised under the DPA and general data protection principles:
(a) Performance of a contract — to provide the Service to our Customers and their users under our Terms of Service, or to facilitate a Customer's tenancy contract with its tenants;
(b) Legitimate interests — for example, to secure the Platform, prevent fraud, and improve our products, balanced against your rights and interests;
(c) Consent — for example, for marketing communications, optional cookies, or where a Customer relies on tenant consent to process certain data or send certain messages; and
(d) Compliance with a legal obligation — for example, retaining certain records for tax, accounting, or regulatory purposes, or responding to lawful requests from Kenyan authorities.
Where we act as Data Processor for portfolio data (see Section 2), we process that data strictly in accordance with the Customer's instructions as configured through the Service, and only for the purpose of providing the Service to that Customer. We do not use portfolio data for our own independent marketing purposes, and we do not sell portfolio data to third parties.
9.1. Personal data processed through the Service may be stored and processed on servers located in Kenya and/or in other countries, including where our cloud hosting, email, SMS, or other sub-processors maintain infrastructure. Where personal data is transferred outside Kenya, we take steps intended to ensure that such transfers are made with appropriate safeguards, consistent with the cross-border transfer requirements of the DPA and its regulations (for example, transferring only to jurisdictions or providers with adequate data protection commitments, or under contractual clauses obliging the recipient to protect the data to a standard consistent with the DPA).
9.2. If you would like more specific information about where a particular category of data is hosted, you may contact us at hello@propertyos.test.
10.1. We do not sell personal data. We may share personal data with:
(a) Sub-processors that help us operate the Service (see Section 11);
(b) Other users within the same Customer Account, according to the roles and permissions that Customer configures (for example, an Agency's staff seeing tenant data for properties they are assigned to);
(c) Professional advisers such as our auditors, lawyers, and insurers, where reasonably necessary;
(d) Successors, in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality commitments; and
(e) Regulators, courts, and law enforcement, where required by applicable law, a valid court order, or to protect the rights, property, or safety of Provider, our Customers, or the public.
We engage third-party service providers (“sub-processors”) in categories including: cloud hosting and infrastructure providers; SMS and messaging aggregators (such as Africa's Talking); WhatsApp Business/Meta messaging infrastructure; email delivery providers; mobile money and banking integration providers (for payment notification and reconciliation, not for holding funds); and analytics or error-monitoring tools. Each sub-processor is engaged under contractual terms requiring appropriate confidentiality and security commitments.
12.1. Our marketing website and application use session cookies necessary to keep you signed in and to remember your preferences. We may also use limited analytics cookies on marketing pages to understand aggregate usage and improve our content.
12.2. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service, such as sign-in, from working correctly.
13.1. We retain Account and portfolio data for as long as the relevant Customer's Subscription remains active, and for a reasonable period afterward (see Section 36 of our Terms of Service on data export following termination), unless a shorter period is requested by Customer and we have no legal obligation to retain the data for longer.
13.2. We may retain certain data for longer where required for legal, tax, accounting, dispute-resolution, or fraud-prevention purposes, or where anonymised/aggregated so that it no longer identifies an individual.
14.1. We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction, including: encryption of data in transit (HTTPS/TLS); role-based access controls limiting staff and user access to what is necessary for their function; logical isolation of each Customer's data from other Customers; password hashing; and monitoring for suspicious activity.
14.2. No system can be guaranteed 100% secure. We encourage Account holders to use strong, unique passwords, enable any available additional authentication options, restrict Staff Account permissions appropriately, and report suspected security incidents promptly to hello@propertyos.test.
We do not use personal data to make decisions that produce legal or similarly significant effects on individuals through fully automated means without human involvement. Features such as automated payment matching and arrears flagging are decision-support tools for Customer's own staff, who remain responsible for any resulting action (such as issuing a notice to a tenant).
Subject to applicable exceptions, and to the extent we are the relevant Data Controller (see Section 2), you have the right to:
(a) be informed of the use to which your personal data is to be put (right to be informed);
(b) access your personal data in our custody;
(c) request correction or rectification of inaccurate, out-of-date, incomplete, or misleading personal data;
(d) request deletion of false or unlawfully obtained personal data, or personal data we are no longer authorised to retain;
(e) object to the processing of all or part of your personal data, including for direct marketing purposes;
(f) withdraw consent, where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal; and
(g) request data portability, where applicable, in a structured, commonly used, and machine-readable format.
17.1. If you are a Customer Account user, or a tenant/landlord whose data is held by a Customer as Data Controller, you should first direct requests regarding your personal data to that Customer (for example, your Agency or Landlord), as they control that data and can act on it directly within the Service.
17.2. You may also contact us directly at hello@propertyos.test, or via our contact page, and we will either action the request (where we are the Data Controller) or reasonably assist by directing it to, or supporting, the relevant Customer (where we act as Data Processor). We may need to verify your identity before actioning a request, and may decline or limit requests where permitted by the DPA.
If you believe your personal data has been processed unlawfully or that your rights under the DPA have not been respected, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya, without prejudice to any other administrative or judicial remedy. We encourage you to first raise your concern with us so that we can try to resolve it directly.
We comply with applicable registration, notification, and other obligations under the Data Protection Act, 2019, as required for our operations, and we keep our compliance posture under periodic review as our processing activities evolve.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, we will, in our capacity as Data Controller or Data Processor as applicable, take reasonable steps to contain and investigate the breach, and will notify the ODPC and/or affected data subjects (directly, or through the relevant Customer where we act as Data Processor) as required under the DPA and its regulations, without undue delay.
The Service is not directed at children, and Account registration is restricted to individuals aged 18 and above (see Section 38 of our Terms of Service). Where a Customer records limited information about a minor occupant in connection with a tenancy (for example, a household member's name), that information is controlled by the Customer as Data Controller, who is responsible for ensuring an appropriate lawful basis exists for such processing.
We may send you marketing communications about the Service where you have consented or where permitted by law (for example, if you are an existing Customer and the communication relates to similar services). You may opt out of marketing communications at any time using the unsubscribe link in the relevant message, or by contacting hello@propertyos.test. Opting out of marketing does not affect transactional communications necessary for the Service (such as invoices, verification codes, or security notices).
Our website and RentHub listings may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing personal data to them.
For any questions, requests, or concerns about this Policy or our data protection practices, you may contact our privacy team at hello@propertyos.test, or via our contact page.
To exercise any of the rights described in Section 16, email hello@propertyos.test with your name, the Account or Customer you are associated with (if known), a description of your request, and any information that helps us verify your identity.
We may update this Policy from time to time to reflect changes in our practices, the Service, or applicable law. Material changes will be communicated by email, in-app notice, or by updating the “Last updated” date at the top of this page, with reasonable advance notice where practicable. Continued use of the Service after an update takes effect constitutes acceptance of the revised Policy.
Questions about this Policy, or requests relating to your personal data, can be sent to hello@propertyos.test or via our contact page. Please also see our Terms of Service for the broader terms governing use of the Service.