Privacy notice

1. Who we are

Hostabela is a property-management platform for short-stay rental hosts in Kenya. In this notice "Hostabela", "we" and "us" means [Hostabela Limited], a company registered in Kenya, of [address], Nairobi, registered with the Office of the Data Protection Commissioner as a data controller and data processor ([ODPC registration numbers]).

• For your own data (as someone joining the waitlist, or as a host, co-host or team member using the app), we are the data controller.
• For your guests' data that hosts manage in Hostabela (reservations, guest contact details, door codes and payments), the host is the controller and we process it on the host's behalf, only as they instruct. We do not use guests' data for our own marketing, analytics or any other purpose of our own.

Contact us, or our data protection contact, about anything in this notice at support@hostabela.com.

2. What we collect

When you join the waitlist

• Your first and last name, email address, mobile phone number and county.
• Anything else you choose to tell us: your business name, how many properties you run, where you list them today, and how you heard about us.
• Whether you would like occasional news and tips from us. If you say yes, we record when you agreed and the exact wording you agreed to, so we can show your consent.

How you found us

• The campaign details in the link you followed (for example utm_source=instagram), the website that referred you, the first page you landed on, and the date and time.
• To remember this between visits, we store it in your browser's local storage for up to 90 days. We read it only when you send us a form. It is not used to track you on other websites.

To protect the form from abuse

• Your IP address, used only to limit how many sign-ups can come from one network in an hour. The count expires after one hour and is not stored with your waitlist entry.
• A one-time code we text to your phone to check the number is yours. Until you enter it, your answers are held for up to 30 minutes and then deleted; we keep only a scrambled (hashed) copy of the code, never the code itself.

When you become a Hostabela customer

• Your account and business details, and what you add to the app to run your properties: listings, calendars, bookings, guest details you enter or receive from booking channels, payments and payouts, team members, and smart-lock access codes.
• Basic technical records, such as sign-in times, so we can keep your account secure.

We do not ask for sensitive personal data (as defined in the Act) on the waitlist.

3. Why we use it, and our legal basis

We do not sell your personal data. We do not make decisions about you based solely on automated processing.

4. Who we share it with

Only the people and services that need it to do the job above, under written terms that require them to protect it:

• Our team. The Hostabela administrators and support staff who handle onboarding.

Service providers who process data for us

Connected services, only if you are a customer and switch them on. We share only what each connection needs:

Authorities, when the law requires it.

5. Transfers outside Kenya

Some of the providers above store or process data outside Kenya: in the Netherlands and elsewhere in the EU, the United States and, for smart locks, China. Data held on servers outside Kenya counts as a transfer under Kenyan law, even when it is only hosted there.

We transfer data only as the Data Protection Act, 2019 and its regulations allow. That means relying on appropriate safeguards, such as the ODPC's standard contractual clauses or the provider's equivalent data-processing terms, or on another ground the law permits, such as a transfer needed to provide the service you asked for (a guest can't get a door code without it). Before each transfer we assess the destination's laws. We keep a record of every transfer, and we notify the Data Protection Commissioner as its guidance requires. For a door code, the smart-lock provider receives the guest's name as the code's label, plus the stay's dates. For a digital key in the TTLock app, it also receives the guest's email address, because that is the account the key is sent to.

6. How long we keep it

• Waitlist entries: until 24 months after our last contact with you, or sooner if you ask us to delete your entry. If you become a customer, your entry becomes part of your account record.
• Customer account data: for as long as your account is open. Records that tax law requires us to keep (bookings with amounts, payments, expenses and invoices) are kept for five years from the end of the year they relate to, then deleted or anonymised.
• Door codes, lock entry logs and guest ID numbers: only as long as the stay and any question about it need, measured in months, not years ([period to confirm in the retention schedule]).
• Abuse-protection counters: one hour.
• The "how you found us" record in your browser: up to 90 days, or until you clear your browser's site data.

7. How we protect it

Your data travels over encrypted connections (HTTPS). Waitlist entries can be seen only by signed-in Hostabela administrators and support staff. Access to our systems is limited to the people who need it, and every change to a waitlist entry is logged. Notification emails sent to our team do not include your email address or phone number. If a breach puts your data at risk, we will notify the Data Protection Commissioner within 72 hours and tell you in writing, as the Act requires.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your personal data is used (this notice);
• access the personal data we hold about you;
• object to our use of your data, including for marketing;
• have inaccurate or misleading data corrected;
• have data deleted that is false, misleading, or that we no longer have a reason to keep;
• withdraw your consent at any time, without affecting what we did before you withdrew it;
• receive your data in a portable format, where the Act provides for it.

To use any of these rights, email support@hostabela.com from the address you signed up with, or tell us how we can confirm it is you. Most requests are free. We will give you a copy of your data within 7 days, correct, delete or stop using it within 14 days, and send it in a portable format within 30 days, as the Data Protection (General) Regulations, 2021 require.

You can stop news and tips at any time, for free and in one step, using the unsubscribe link in any of those emails or by emailing us. We then add you to a "do not contact" list so you aren't contacted again by mistake. Messages about your account (sign-in codes, invitations, booking and payment notices) are not marketing and keep arriving while your account is open.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) through its website, https://www.odpc.go.ke.

9. Children

Hostabela is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children.

10. Changes to this notice

We will update this notice when our services or the law change, and change the "Last updated" date above. If a change significantly affects how we use your data, we will tell you by email or in the app before it takes effect.

11. Contact

[Hostabela Limited] · [address], Nairobi, Kenya · support@hostabela.com