Privacy Policy

1. Who we are

KHYA Group ("we", "us", "our") is a real estate and technology company based in Nairobi, Kenya. We are a data controller registered under the Kenya Data Protection Act 2019 (KDPA) and regulated by the Office of the Data Protection Commissioner (ODPC).

To contact us about privacy matters, please use the contact form on our website and select the "Data & Privacy" card.

2. What personal data we collect

When you submit our contact form we collect:

• First and last name
• Email address
• Company or organisation name
• Partnership type selected
• The enquiry details you provide

We do not collect any sensitive personal data as defined under Section 2 of the KDPA.

3. Lawful basis for processing

We process your personal data on the basis of your consent (Section 30(1)(a) KDPA), given when you tick the consent checkbox on our contact form, and on the basis of our legitimate interest in responding to business enquiries directed to us (Section 30(1)(c) KDPA).

4. How we use your data

We use the information you submit solely to:

• Respond to your enquiry
• Conduct follow-up communication you have requested

We will never sell, rent, or share your personal data with third parties for marketing purposes.

5. Third-party data processors

Your contact form submission is processed by the following services acting as data processors on our behalf:

• Web3Forms (web3forms.com) — receives and delivers your submission to our secure inbox.
• Make.com (make.com) — automation service that routes submission data to our records system.
• Airtable (airtable.com) — stores submission records for our internal case management.

These services are operated by servers outside Kenya. By submitting the contact form you consent to this cross-border transfer of your personal data under Section 48 of the KDPA. We have satisfied ourselves that each processor applies appropriate technical and organisational measures to protect personal data.

6. Data retention

We retain enquiry data for no longer than 24 months from the date of receipt, after which it is securely deleted unless we are required by law to retain it for longer or an ongoing business relationship necessitates continued storage.

7. Your rights under the KDPA

Under the Kenya Data Protection Act 2019, you have the right to:

• Access the personal data we hold about you (Section 26)
• Rectify inaccurate or incomplete data (Section 27)
• Erasure of your data where there is no compelling reason for its continued processing (Section 28)
• Object to processing of your data (Section 36)
• Withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke

To exercise any of these rights, please use the contact form on our website and select the "Data & Privacy" card. Specify which right you wish to exercise. We will respond within 21 days as required by the KDPA.

8. Cookies and tracking

This website does not use cookies, analytics trackers, or any form of behavioural tracking. We do not use third-party advertising or profiling services.

9. Security

This website is served exclusively over HTTPS with HTTP Strict Transport Security (HSTS) enforced. We apply industry-standard technical controls including Content Security Policy headers to protect against common web vulnerabilities.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page. We encourage you to review this page periodically.