Privacy Policy

There are two different sets of personal data in play when you use the Rentisha dashboard, and Rentisha plays a different role for each:

• Your own account data (your name, email, phone, password, MFA enrolment, device/session records) — Rentisha is the data controller for this, because we decide why and how it’s used to run your account and secure the service.
• Your tenants’ data that you and your staff enter, view or process through the dashboard (tenant identity, lease, payment and maintenance records) — your organisation is the data controller for that data, and Rentisha is the data processor, acting only on your organisation’s instructions. The terms of that processing relationship are set out in a Data Processing Agreement, which is currently in legal review and not yet published — ask your Rentisha contact for the current draft if you need it ahead of publication.

• Identity and contact details — name, email, phone number.
• Account security data — password hash, MFA enrolment status, trusted-device records (browser, OS, IP, last-seen time).
• Organisation details — business name, KRA PIN, logo, and your role within the organisation.
• Usage and audit data — actions you take in the dashboard, kept for security and accountability.

As a processor, Rentisha stores and processes the tenant, lease, payment and maintenance data your organisation puts into the dashboard, or that your tenants submit through the tenant app. Your organisation is responsible for having a lawful basis to collect that data from your tenants, and for telling your tenants how it’s used — the tenant-facing Rentisha tenant app publishes its own Privacy Policy for that purpose.

For your own account data, our lawful bases under the Data Protection Act, 2019 are performance of our contract with you (running your account), our legal obligations, and our legitimate interest in keeping the service secure. For tenant data processed on your organisation’s behalf, the lawful basis is set by your organisation as controller; Rentisha processes it only under your organisation’s instructions.

We share data only as needed to provide the service:

• Safaricom, to process M-Pesa payments.
• The Kenya Revenue Authority, where a tax invoice (eTIMS) must be issued.
• Meta (WhatsApp) and Celcom Africa, to deliver messages.
• Infrastructure and service providers who help us run the app, under confidentiality obligations — see the sub-processors table in our Data Processing Agreement for the full list.

We do not sell personal data.

Data is stored on secured infrastructure. Sensitive fields are encrypted, access is role-scoped and audit-logged, and each organisation’s data is isolated from every other organisation’s data at the database level.

Under the Data Protection Act, 2019 you have the right to access your account data, have it corrected, request erasure, object to or restrict processing, and request portability. Manage most of this yourself from Account & Security settings, or contact us using the details below. For rights requests about tenant data your organisation controls, contact your organisation directly, or use the tenant app’s DSAR flow.

We keep your account data for as long as your account is active and for any further period required by law, after which it is deleted or anonymised. Tenant data is retained per your organisation’s instructions and the retention terms in the Data Processing Agreement.

For privacy questions, contact Kigs Apex Solutions at info@kigsapexsolutions.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.