1. Who we are
2M Residence ("we", "us") is a residential property at Nyamache, Kenya, P.O. Box 131. We operate this website and the resident portal at which tenants can view their own account.
For the purposes of the Data Protection Act, 2019 ("the Act"), 2M Residence is the data controller of the personal data described in this policy. That means we decide what data is collected and what it is used for, and we are responsible to you for how it is handled.
2. What we collect
We collect only what we need to let a room and run the tenancy.
| When | What we collect |
|---|---|
| When you apply for a room | Your name, national identity card or passport number, phone number, email address, the room and move-in date you are asking for, how you prefer to be contacted, the name, relationship and phone number of an emergency contact, and anything you choose to write in the notes. |
| While you are a tenant | Your room and the dates you occupied it, your rent and deposit, payments you make, water meter readings taken at your room, garbage and any other charges, and the balance those produce. |
| If you are given a portal account | Your email address and the date you last signed in. We never see or store your password. It is held by our authentication provider in a form we cannot read, and nobody at 2M Residence can retrieve it. If you forget it, it is reset, not looked up. |
| Automatically | Standard technical information needed to serve the website securely. We do not use advertising cookies and we do not track you across other websites. |
3. Why we collect it, and our lawful basis
The Act requires us to have a lawful basis for each use. Ours are:
| What we use it for | Lawful basis under the Act |
|---|---|
| Assessing your application and deciding whether to offer you a room | Steps taken at your request before entering into a contract |
| Running your tenancy: billing rent, water and garbage, recording payments, producing your statement | Performance of a contract to which you are a party |
| Contacting you about your application, your room or your account | Performance of a contract, and our legitimate interest in managing the property |
| Confirming your identity and keeping accurate records of who occupies which room | Compliance with legal obligations, and our legitimate interest in the safety and security of the building |
| Keeping financial records | Compliance with a legal obligation |
| Contacting your emergency contact in an emergency | Protection of vital interests |
We do not sell your data, and we do not use it for marketing. We will not use your information for a new purpose that is unrelated to the above without telling you first.
4. Who we share it with
Your data is seen by as few people as the job allows:
- Our own staff, according to their role. The system gives each member of staff only the access their job requires. A meter reader, for example, can see which room they are reading and who lives there, but not your rent, your balance, your ID number or your payments.
- Our technology provider. The website, the database and the sign-in system are provided by Google (Firebase), which processes data on our instructions as our data processor.
- Where the law requires it, for example a lawful request from a court, the police or a regulator.
We do not share your data with other landlords, with credit reference agencies, or with anyone for marketing purposes.
5. Where your data is stored
Our systems are hosted by Google on servers that may be located outside Kenya. This means your personal data may be transferred to and stored in another country.
Sections 48 and 49 of the Act permit such a transfer where appropriate safeguards are in place or where the transfer is necessary for the performance of a contract with you. We rely on our provider's contractual data-protection commitments and on the necessity of the transfer for running your tenancy. Your rights under this policy and under the Act follow your data wherever it is held.
6. How long we keep it
| Record | Kept for |
|---|---|
| An application that was declined or withdrawn | Up to 12 months, then deleted, so we can answer questions about the decision |
| Tenancy and financial records (rent, payments, utilities, statements) | At least 7 years after your tenancy ends, to meet tax and accounting obligations |
| Meter readings | Kept with the bills they produced, for the same period |
| Portal sign-in account | Disabled when your tenancy ends and removed thereafter |
| Records of who did what in the system (audit log) | Retained as a security record |
7. Your rights under the Data Protection Act
Under section 26 of the Act you have the right:
- to be informed of how your data is being used, which is the purpose of this policy;
- to access the personal data we hold about you;
- to correct data that is inaccurate, out of date, incomplete or misleading;
- to request deletion of data we no longer have a lawful reason to keep;
- to object to processing of your data; and
- to have your data transferred to you or another controller, where that applies.
If you have a portal account, you can see your own tenancy and financial records at any time by signing in. That is the fastest way to exercise your right of access. For anything else, contact us using the details below. We will respond as soon as we can and in any event within the period required by the Act.
Some rights have limits. We cannot delete financial records we are legally required to keep, and we cannot delete records needed to establish or defend a legal claim. If we cannot do what you ask, we will tell you why.
8. How we protect it
- Access requires an individual sign-in. Accounts are not shared.
- Every account is limited to what its role needs, and this is enforced by the database itself rather than by hiding buttons, so an account cannot reach data it is not entitled to even if someone tries to go around the screens.
- Passwords are never stored by us in a readable form and cannot be looked up by staff.
- Data is transmitted over an encrypted connection.
- Sensitive actions are recorded, so we can tell who did what and when.
- Access can be suspended immediately if an account is misused.
No system is completely secure. If a breach occurs that is likely to result in a real risk to your rights and freedoms, we will notify the Data Commissioner and you, as the Act requires.
9. Children
Our tenancies are let to adults. We do not knowingly collect personal data from anyone under 18 other than where a tenant gives a minor's name as a household member or emergency contact. If you believe we hold a child's data without a proper basis, contact us and we will remove it.
10. Complaints
Please come to us first, because most things are quickest to fix directly. Contact us using the details below and tell us what has gone wrong.
If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner, which regulates data protection in Kenya, at www.odpc.go.ke.
11. Changes to this policy
If we change how we use personal data, we will update this page and change the date at the top. Where a change materially affects your rights, we will tell tenants directly rather than relying on you noticing.
12. Contact us
2M Residence
P.O. Box 131, Nyamache, Kenya
Phone: +254 790 541101
Email: info@2mresidence.co.ke
See also our Terms of Service and the help guide.