1. Introduction
HilKem Luxe Homes ("HilKem," "we," "us," or "our") is committed to protecting your personal data in compliance with the Data Protection Act, 2019 (No. 24 of 2019) of Kenya and any subsidiary regulations issued by the Office of the Data Protection Commissioner (ODPC).
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit www.hilkemproperties.com, enquire about our homes, become a tenant, or use the tenant portal (together, the "Platform").
Data Controller: HilKem Luxe Homes
Matasia, Kajiado County, Kenya
Email: info@hilkemproperties.com
Phone: +254 742 981 316
2. Legal Basis for Processing
Under the Data Protection Act, 2019, we process your personal data on these bases:
| Legal Basis | Description |
|---|---|
| Consent | Where you have given explicit consent (e.g., property enquiries, viewing requests, update subscriptions) |
| Contractual Necessity | Where processing is necessary to enter into or perform your tenancy agreement (e.g., tenant records, rent accounting, maintenance requests) |
| Legal Obligation | Where processing is required by Kenyan law (e.g., tax and accounting records, landlord–tenant regulations) |
| Legitimate Interest | Where processing is necessary for our legitimate interests (e.g., securing the Platform, preventing fraud, maintaining accurate records) |
3. Personal Data We Collect
3.1 — INFORMATION YOU PROVIDE DIRECTLY
- Enquiries and viewing requests — full name, phone number, email address, and your message.
- Tenant records — full name, national ID number, phone number, email address, emergency contact, unit and lease details (rent, deposit, term). Collected when you become a tenant, as required to prepare and administer your tenancy agreement.
- Payment records — amounts, dates, and payment references (e.g., M-Pesa transaction codes) for rent and deposits. Payments are made through M-Pesa or bank transfer; we record references but never hold your PIN, wallet, or card details.
- Maintenance requests — the issue you report, its location, and follow-up correspondence.
- Portal account data — email address, password (stored only as a secure hash by our authentication provider), and an optional profile photo.
3.2 — INFORMATION COLLECTED AUTOMATICALLY
- Authentication session data (secure cookies / local storage that keep you signed in to the tenant portal or staff console)
- Basic device and browser information sent with every web request (IP address, browser type), used for security and troubleshooting
We do not run third-party advertising or cross-site tracking cookies.
3.3 — SENSITIVE PERSONAL DATA
We collect national identification numbers only to verify identity for tenancy agreements, as permitted by the Act, and process them solely for that purpose.
4. How We Use Your Personal Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Respond to enquiries and arrange viewings | Name, phone, email, message | Consent |
| Prepare and administer tenancy agreements | Tenant records, ID number | Contractual Necessity |
| Rent accounting and receipts | Payment records | Contractual Necessity / Legal Obligation |
| Handle maintenance requests | Request details, contact info | Contractual Necessity |
| Send service emails (notices, welcome, password reset) | Email address | Contractual Necessity / Legitimate Interest |
| Secure the Platform and prevent fraud | Session data, device info | Legitimate Interest |
We send service communications only — notices about your tenancy, account, and building. We do not send marketing email unless you have subscribed, and you can unsubscribe at any time.
5. Data Sharing and Disclosure
5.1 — THIRD-PARTY SERVICE PROVIDERS
| Service Provider | Purpose | Data Shared |
|---|---|---|
| Supabase (backend infrastructure) | Database hosting, authentication, file storage | Account and tenancy data, uploaded files |
| Resend (email delivery) | Sending service emails from our domain | Email address, message content |
| Cloudflare (hosting & network) | Serving the website securely | Standard web request data (IP address, browser info) |
| Zoho Mail (mailbox) | Receiving and replying to your emails | Emails you send us |
Each provider processes data on our instructions under its own security and privacy commitments. We do not sell your personal data to anyone.
5.2 — LAW ENFORCEMENT AND REGULATORS
We may disclose personal data to Kenyan law enforcement, the ODPC, courts, or other authorities where required by law or a valid legal process.
6. International Data Transfers
Some of our service providers store data on servers located outside Kenya. Where personal data is transferred internationally, we ensure appropriate safeguards consistent with the Data Protection Act, 2019 — including contractual data-protection commitments from each provider and transfer only to providers with recognised security certifications.
7. Data Retention
- Tenancy and payment records — retained for the duration of your tenancy and thereafter as long as Kenyan tax, accounting, and landlord–tenant law requires.
- Enquiries — retained while we handle your enquiry and for a reasonable follow-up period.
- Portal accounts — retained while the account is active; deactivated accounts are removed in line with the schedule above.
8. Your Rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed about how your personal data is used
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of data we no longer have a lawful basis to keep
- Object to or restrict certain processing
- Data portability, where technically feasible
To exercise any of these rights, email info@hilkemproperties.com. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner at www.odpc.go.ke.
9. Cookies
The Platform uses essential cookies and local storage only: they keep you signed in to the tenant portal or staff console and remember your sign-in preference ("Remember me"). They are not used for advertising or cross-site tracking, and the public website can be browsed without signing in at all.
10. Security
All traffic to the Platform is encrypted in transit (HTTPS). Tenant and staff data is protected by row-level access controls — each account can only reach the records that belong to it — and passwords are stored only as secure hashes. Access to administrative systems is restricted to authorised staff.
11. Children
The Platform is intended for adults entering or managing tenancies. We do not knowingly collect personal data from children. Where a household includes minors, we hold only the information the tenant provides for the tenancy agreement.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date above shows the current version, and material changes will be notified to tenants through the Platform or by email.
13. Contact Us
Questions about this policy or your personal data? Reach us at info@hilkemproperties.com or +254 742 981 316, Matasia, Kajiado County, Kenya.