Legal
Privacy policy
Last updated August 2026
This is a working draft with the right structure and roughly the right content. An advocate familiar with the Data Protection Act 2019 must review it before the site is published. Delete this box when that has happened.
This policy explains what personal data [COMPANY NAME] collects when you use this website and the Ravuni service, why, and what you can do about it. It is written to be understood rather than to be unfalsifiable.
Two different relationships
It matters which one you are in, because our obligations differ.
If you visit this website or contact us
We are the data controller. We hold what you give us — your name, phone number, email, and whatever you tell us about your portfolio — for the purpose of responding to you and, if you become a customer, providing the service.
If you are a tenant or landlord whose details are in the system
Your managing agent or landlord is the data controller. They decide what is held and why. We are a data processor acting on their instructions, and we do not use your data for our own purposes. If you want your details corrected or removed, ask them — and if they ask us, we will act on it.
What we collect
- Contact details you give us directly, by WhatsApp, email or a form.
- Portfolio data you send us for a migration dry run — property, unit, tenancy and balance records, which may include tenants' personal data.
- Service data generated when you use the product: records you create, and access logs kept for security.
- Basic website analytics. [State your tooling, or delete this line if you use none.]
Migration files
When you send a spreadsheet for a dry run, it usually contains other people's personal data. We treat those files as confidential, use them only to produce your dry-run report, and delete them on request or [STATE PERIOD] after the dry run, whichever comes first. We do not use them to train anything and we do not contact anyone named in them.
How long we keep things
Contact records for as long as we have a relationship, plus [PERIOD]. Service data for as long as the account exists. On termination, you export what you want and we delete the remainder on request, subject to anything we are legally required to retain.
Where it lives
On servers we operate, [STATE LOCATION], with encrypted off-site backups [STATE LOCATION]. If any processing happens outside Kenya, say so here and explain the basis for the transfer — this is the part most policies get wrong.
Who else sees it
Our infrastructure and communications providers, as processors, under contract. [LIST THEM.] Nobody else, and we do not sell data to anyone for any purpose.
Your rights
Under the Data Protection Act 2019 you may ask what we hold, ask for it to be corrected, ask for it to be deleted, object to certain processing, and complain to the Office of the Data Protection Commissioner. To exercise any of these, contact us at hello@ravuni.com.
Contact
[COMPANY NAME], [ADDRESS], Nairobi. hello@ravuni.com. Data protection contact: [NAME OR ROLE].