Privacy Policy

1. Introduction

VistaPhantor Homes and Construction Limited ("we", "us", "our") is committed to protecting your privacy and handling your personal data in an open and transparent manner. We are a company registered in Kenya under PVT-9XUKG7P7, KRA PIN P052375974T, with headquarters at 28-80110 Brazil, Likoni, Mombasa, Kenya.

This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you use our website (vistaphantor.homes), mobile applications, and related property, rental, banking, and construction services (collectively, the "Services"). It also describes your rights regarding your personal data and how you can exercise them.

By using the Services, you consent to the practices described in this policy. If you do not agree, please do not use the Services.

2. Data Controller

VistaPhantor Homes and Construction Limited is the data controller responsible for your personal data. For questions about this policy or our data practices, contact us at contact@vistaphantor.homes or 28-80110 Brazil, Likoni, Mombasa, Kenya.

3. Information We Collect

We collect the following categories of personal data:

3.1 Account and Identity Information

• Name, email address, phone number, username
• Password (stored in encrypted form)
• Profile photo and preferences
• Role (tenant, landlord, agent, admin) and account status

3.2 Identity Verification (KYC) Data

• National ID number, passport number, or other government-issued ID
• Copies of identity documents (as required for verification)
• Proof of address (utility bills, bank statements)
• Date of birth and place of residence
• Verification status and audit trail

3.3 Property and Rental Data

• Property addresses, descriptions, and listing details
• Rental agreement terms (duration, rent amount, payment schedule)
• Lease start and end dates, renewal status
• Unit codes, tenant codes, and occupancy information
• Maintenance requests, descriptions, and status

3.4 Financial and Payment Information

• M-Pesa phone number and transaction references
• Card details (processed by payment providers; we do not store full card numbers)
• Bank account details for withdrawals
• Transaction history, amounts, dates, and status
• Escrow balances, rent payments, security deposits
• Delayed payment records and arrears

3.5 Communications Data

• In-platform messages and conversations
• Support tickets, feedback, and correspondence
• Email and SMS content we send or receive in relation to your account

3.6 Technical and Usage Data

• IP address, browser type, device type and identifiers
• Login times, session duration, pages visited
• Referral source, search queries
• Crash reports, error logs (where applicable)

3.7 Construction and Business Data

• Project details, roles (engineer, foreman, mason, etc.)
• Material requests, invoices, and approvals
• Management agreements and commission terms

4. How We Collect Information

We collect information through:

• Direct provision: When you register, complete forms, sign agreements, or contact us
• Automated means: Cookies, log files, and similar technologies when you use the Services
• Third parties: Payment providers (e.g. M-Pesa callback data), landlords/agents (when they add you as a tenant), and identity verification services
• Public sources: Where relevant and lawful, we may supplement data from publicly available sources

5. Legal Bases for Processing

We process your personal data on the following legal bases:

• Contract performance: To provide the Services, process payments, and fulfil rental agreements
• Legal obligation: To comply with Kenyan law (e.g. KYC, anti-money laundering, tax reporting)
• Legitimate interests: To improve the Services, prevent fraud, ensure security, and communicate with you about your account
• Consent: Where we have asked for and you have given explicit consent (e.g. marketing, optional features)

6. How We Use Your Information

We use your information to:

• Create and manage your account
• Verify your identity (KYC) as required by law
• Process payments, rent collection, and escrow
• Facilitate rental agreements and property management
• Send transactional notifications (payment confirmations, rent reminders, agreement updates)
• Respond to support requests and communicate with you
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and respond to lawful requests from authorities
• Improve and develop the Services (including anonymised analytics)
• Enforce our Terms and Conditions and other policies
• Send marketing communications (only where you have consented)

7. Sharing and Disclosure

We may share your personal data with:

7.1 Landlords, Tenants, and Agents

As necessary to fulfil rental agreements and property management. For example, landlords see tenant contact and payment information; tenants see landlord and property details.

7.2 Payment and Banking Partners

M-Pesa providers, card processors, and banking partners to process transactions. They have their own privacy policies governing their use of your data.

7.3 Regulators and Authorities

When required by Kenyan law, including the Kenya Revenue Authority (KRA), Central Bank of Kenya, Financial Reporting Centre (FRC), and law enforcement agencies.

7.4 Service Providers

Hosting, analytics, email delivery, SMS, and support services. We require them to protect your data and use it only for the purposes we specify.

7.5 Legal and Safety

Where necessary to protect our rights, your safety, or the safety of others; to enforce our terms; or to comply with legal process.

We do not sell your personal information to third parties.

8. International Transfers

Your data is primarily stored and processed in Kenya. If you access the Services from outside Kenya, your data may be transferred to and processed in Kenya. By using the Services, you consent to such transfer. For EU/EEA users, we implement appropriate safeguards (e.g. standard contractual clauses) where required.

9. Data Storage and Security

We store your data on servers located in Kenya. We implement technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest where appropriate
• Access controls and authentication (including multi-factor authentication)
• Regular security assessments and monitoring
• Employee training on data protection
• Secure disposal of data when no longer needed

Despite our efforts, no system is completely secure. You use the Services at your own risk. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities as required by law.

10. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Account data: For the duration of your account plus a reasonable period after closure
• Transaction and financial data: As required by Kenyan tax and financial regulations (typically 7 years or longer)
• KYC data: As required by anti-money laundering and regulatory requirements (typically 5–7 years after the end of the business relationship)
• Communications: As needed for support and dispute resolution
• Technical logs: For a limited period for security and troubleshooting

After the retention period, we securely delete or anonymise your data unless we are required to retain it by law.

11. Your Rights

Depending on your location and applicable law, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data, subject to legal retention requirements
• Restriction: Request that we restrict processing in certain circumstances
• Portability: Request an export of your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests or for direct marketing
• Withdraw consent: Where processing is based on consent, withdraw it at any time
• Complaint: Lodge a complaint with a supervisory authority (e.g. Office of the Data Protection Commissioner in Kenya)

12. Exercising Your Rights

To exercise your rights, use the Privacy section in Security Settings within your account, or contact us at contact@vistaphantor.homes. We will respond within the timeframe required by applicable law (e.g. 30 days under the Kenya Data Protection Act, 2019). We may need to verify your identity before processing your request.

You may also request a data export or deletion through the in-app Privacy tools. Note that deletion may be limited where we must retain data for legal obligations.

13. Cookies and Tracking Technologies

We use cookies and similar technologies (e.g. local storage, session storage) for:

• Essential: Authentication, security, and basic functionality
• Preference: Remembering your settings (e.g. language, theme)
• Analytics: Understanding how the Services are used (in anonymised or aggregated form where possible)

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Services. We do not use third-party advertising cookies that track you across other websites.

14. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party services (e.g. payment gateways, social login). We are not responsible for the privacy practices of third parties. We encourage you to read their privacy policies before providing any personal data.

15. Children's Privacy

The Services are not intended for users under 18. We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us immediately and we will delete it promptly.

16. GDPR Compliance (EU/EEA Users)

If you are in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) may apply. We process your data on the legal bases described in Section 5. You have the rights set out in Section 11. We implement appropriate safeguards for international transfers. Our EU representative (if appointed) will be listed on our website. You may lodge a complaint with your local data protection authority.

17. Kenyan Data Protection

We comply with the Kenya Data Protection Act, 2019 and the associated regulations. As a data subject in Kenya, you have the right to be informed, to access, to rectification, to erasure, to restrict processing, to data portability, to object, and to withdraw consent. You may lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Services and updating the "Last updated" date. For significant changes, we may also notify you by email or in-app message. Continued use of the Services after the effective date constitutes acceptance of the updated policy. If you disagree, you may close your account.

19. Contact Us

For privacy-related questions, to exercise your rights, or to report a concern:

VistaPhantor Homes and Construction Limited
28-80110 Brazil, Likoni, Mombasa, Kenya
Phone: 0743938639
Email: contact@vistaphantor.homes