The Haven Group · Legal

Privacy notice

Last updated 14 October 2026

Draft for legal review. Parts marked “To confirm” are decisions for The Haven Group before launch.

This notice explains what personal information The Haven Group collects through this website, why, who we share it with, how long we keep it and the rights you have. It is written with Kenya’s Data Protection Act, 2019 in mind.

Who we are

The Haven Group · Real Estate is the data controller for this website. To confirm: the registered company name, registration number, registered address, and our registration number with the Office of the Data Protection Commissioner. You can reach us about your information at To confirm: a privacy email address, for example privacy@ our domain or through our Contact page.

What we collect

• Your account: your name, email address or mobile number, the kind of account (buyer, landlord, owner, agent, developer or team member), your password (stored only as a one-way hash) and, if you sign in with Google, your Google name and email.
• Enquiries and viewing requests: the details you type into a form (name, email, phone, your message, the listing and the time you would like to view) and our replies.
• Favourites and saved searches: the listings you heart and the searches you ask us to watch, so we can show them on any device and tell you about new matches.
• Listings you post: the property details, photographs and documents you upload, the owner’s details where you give them, and the review notes our team adds.
• Payments: for listing plans paid with M-Pesa, the phone number used, the amount, the plan and the M-Pesa receipt. We never see or store your M-Pesa PIN.
• Visits: to count visitors without cookies we record the page, the listing viewed, where the visit came from (for example Google or WhatsApp), the kind of device and the language. Your IP address is not stored: it is mixed with a daily changing secret into a short code that cannot be turned back into the address.
• Things kept only in your browser: your language and currency, the listings you viewed recently and unsent drafts. These stay on your device; see Cookies and browser storage.

Why we use it

• to run your account and keep it secure (our contract with you);
• to answer your enquiries, arrange viewings and connect you with the right adviser (steps you ask us to take);
• to publish, review and manage the listings you post, and to take payment for listing plans (our contract with you);
• to send the alerts you ask for: saved-search matches, changes to your favourites and the magazine, each of which you can stop at any time (your consent);
• to understand how the website is used and improve it, using counts rather than profiles (our legitimate interest);
• to keep records the law requires, for example for payments and tax (a legal obligation).

We do not sell your personal information and we do not use it for advertising profiles.

Who we share it with

• Our team: the adviser and office handling your enquiry or listing, and staff who need to see it to do their work.
• Service providers who work for us: Cloudflare (hosting and the database), Resend (email), Africa’s Talking (text messages), Meta (WhatsApp messages, when you choose WhatsApp), Safaricom (M-Pesa payments) and Google (sign-in with Google, when you choose it). To confirm: the final list of providers, and any error-reporting or analytics service if turned on.
• Property owners and other parties to a transaction, only as needed to arrange a viewing, an offer or a tenancy you have asked about.
• Authorities, where the law requires it.

Some of these providers store information outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires for transfers abroad. To confirm: the safeguards in place for each provider.

How long we keep it

• Your account and favourites: while your account is open, and deleted To confirm: period after you close it.
• Enquiries and viewing requests: To confirm: period, for example two years after the last message.
• Payment records: as long as tax law requires To confirm: period, for example seven years.
• Visit counts: 13 months.
• Sign-in sessions: 12 hours, or 30 days if you choose “Keep me signed in”.

Your rights

Under the Data Protection Act you can ask to be told what we hold about you and receive a copy, to have it corrected or deleted, to object to or restrict how we use it, and to take it elsewhere. You can withdraw consent at any time, for example by stopping an alert from the link in any message. To use any of these rights, write to us at the address above; we will reply within To confirm: period. If you are unhappy with our answer you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Children

This website is for adults. We do not knowingly collect information from anyone under 18.

Security

Passwords are stored only as one-way hashes, sign-in uses a secure, HttpOnly cookie, the site is served over an encrypted connection, and team accounts have their own sign-in with access limited to what each role needs.

Changes

We will post any change to this notice here and update the date at the top. If a change is significant we will tell account holders by email.