Privacy Policy

Last updated: 24 September 2026

In short: we collect only what we need to connect tenants and buyers with property owners, keep people safe from scams, and run the site. We don't sell your data. You can ask us to see, correct or delete it at any time: [email protected].

1. Who we are

PataHome (“we”, “us”) runs patahome.co.ke, an online marketplace for homes to rent, buy and short-stay in Kenya. For the personal data described here we are the data controller under Kenya's Data Protection Act, 2019 (“the Act”). Contact: [email protected] · 0748 181 876.

2. What we collect

Who	Data	Why
Account holders (owners, agents, caretakers)	Name, phone, email, password (stored only as a secure hash), profile details you choose to add (photo, county/town, business details, date of birth), login sessions	To create and secure your account and show tenants who they're dealing with
Owners seeking verification	Legal name, ID/passport number, photos of your ID document, KRA PIN (optional)	To confirm identity and ownership and reduce fraud. Documents are visible only to our review team
Listings	Property details, price, photos, video, approximate location	To publish your listing. Listings are public by design
Tenants & buyers	Name, phone and (optionally) email you give when you message an owner, book a viewing, follow an owner or set an alert; the messages themselves	To pass your request to the owner and send you their reply, confirmations and reminders
People who report a listing	Reason, details and optional contact	To investigate scams and misleading listings
All visitors	Pages viewed, searches made, the site that referred you, approximate town (from your internet connection), device type. We count visits using a daily-changing, one-way code made from your connection and browser — we do not store your IP address for this, and we use no advertising or tracking cookies	To understand what people look for and improve the site

If you use “Use my location”, your device's location is used in your browser to sort nearby homes; we don't store it on our servers.

3. Our legal bases

We process data because it's necessary to provide the service you asked for (a contract), because you consented (for example to alerts, which you can stop with one tap), to comply with the law, and for our legitimate interests in keeping the marketplace safe and working well — always balanced against your rights.

4. Who we share it with

Property owners/agents receive the contact details and messages you send them. Owners' phone numbers are shown to people who tap “Contact”.
Service providers that process data for us under contract: Railway (hosting), Cloudflare (security and delivery), Cloudinary (photos, videos, ID documents, backups), Resend (email), Infobip (SMS), Google (optional sign-in) and OpenStreetMap (we look up places near a listing's approximate location — no personal data is sent).
Authorities, where the law requires it or to prevent fraud and protect people.

We never sell personal data or share it for advertising.

5. Transfers outside Kenya

Some of our providers store data outside Kenya (for example in the EU or USA). Where this happens we rely on providers with appropriate safeguards and security, as the Act requires.

6. How long we keep it

Account data: while your account is open. Deleting your account removes your profile and listings.
Messages and viewing requests: up to 24 months, then deleted.
ID documents: until verification is decided plus up to 12 months for fraud prevention, unless the law requires longer.
Reports: up to 24 months.
Visit statistics: kept as daily totals; the daily visitor codes can't be traced back to you.
Backups: up to 30 days.

7. Your rights

Under the Act you can ask to be informed about how we use your data, access it, correct it, delete it, object to or restrict certain uses, and receive it in a portable format. Email [email protected] and we'll respond within the time the Act allows. You can also delete your account yourself from your dashboard. If you're unhappy with our response you may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

Passwords are hashed, connections are encrypted (HTTPS), sessions expire after inactivity, and sensitive account changes need a security code. No system is perfect: if a breach affecting you happens we'll notify you and the Data Commissioner as the Act requires.

9. Children

PataHome is for adults. You must be 18 or over to create an account.

10. Cookies & device storage

We don't use advertising or tracking cookies. Your browser stores a few items locally so the site works — your login, saved favourites, language, and the list of conversations and viewings you started on that device. Clearing your browser data removes them.

11. Changes

We'll update this page when our practices change and show the date at the top. Significant changes will be announced on the site or by email.