Sera ya Faragha

Chabrin Agencies Limited ("Chabrin", "we", "us", or "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit https://chabrinagencies.com or use our services, in compliance with the Kenya Data Protection Act, 2019 (KDPA) and the Data Protection (General) Regulations, 2021.

1. Data Controller

The data controller responsible for your personal data is:

2. Information We Collect

We collect information you provide directly to us, including:

• Contact enquiries: name, email address, phone number, subject, and message content submitted through our contact form.
• Tenancy and lease data: national ID/passport number, KRA PIN, employment details, next-of-kin, and guarantor information collected during the lease application process.
• Identity documents: copies of national ID or passport for identity verification purposes.
• Usage data: IP address, browser type, pages visited, and time spent on pages, collected automatically via server logs.

We do not use cookies for advertising or tracking purposes.

3. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide the services you request.
• Process and manage lease agreements and tenancy documentation.
• Verify your identity as required by law and our due-diligence obligations.
• Send service-related communications (e.g. lease reminders, payment notices).
• Comply with legal and regulatory obligations under Kenyan law.
• Improve and maintain our website and services.

We will never sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal Basis for Processing

We process your personal data on the following lawful bases under the KDPA:

• Consent — where you have given explicit consent (e.g. contact form submission).
• Contract performance — where processing is necessary to fulfil a lease agreement or service contract.
• Legal obligation — where processing is required by Kenyan law (e.g. identity verification, stamp duty records).
• Legitimate interests — where processing is necessary for our legitimate business interests, provided these are not overridden by your rights.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Contact enquiries: up to 12 months, then securely deleted.
• Lease and tenancy records: 7 years after lease expiry, in line with statutory requirements.
• Identity documents: retained for the duration of the tenancy plus 3 years.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• AES-256 encryption of sensitive identity data (national ID, passport number, KRA PIN) at rest.
• TLS encryption for all data in transit (HTTPS).
• Role-based access controls ensuring staff can only access data necessary for their duties.
• Regular security audits and access logging.

7. Sharing of Personal Data

We may share your personal data with:

• Landlords and property owners — where necessary to process a lease application or manage a tenancy on their behalf.
• Legal professionals — lawyers engaged in the preparation of lease agreements.
• Regulatory authorities — where required by law (e.g. Kenya Revenue Authority, court orders).
• Service providers — trusted third-party vendors who assist us in operating our services (e.g. cloud hosting), bound by confidentiality obligations.

All third parties are required to handle your data in accordance with the KDPA.

8. Your Rights Under the KDPA

Under the Kenya Data Protection Act 2019, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your data where there is no longer a lawful basis for retention.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint — with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

To exercise any of these rights, contact us at info@chabrinagencies.com. We will respond within 21 days as required by the KDPA.

9. Children's Privacy

Our services are not directed to children under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. Links to Third-Party Websites

Our website may contain links to third-party websites (e.g. Google Maps). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions, requests, or complaints, please contact our Data Protection Officer: