Privacy notice

Who is responsible for your data

Rent Shopika is a product of Shopika Enterprise Ltd. Shopika Enterprise Ltd decides how the data on this platform is used, so it is the data controller.

You can reach us at support@shopika.com or on +254 712 095 031, by call or WhatsApp. Automatic email from the platform is sent from rent@shopika.com, and replies to it reach support@shopika.com.

What we collect

• Your account. Your name, phone number, email address and password. A password is stored as a hash, not as text we can read.
• Tenancy records. The house, the rent, the deposit, bills, payments, arrears, notice to move out, maintenance requests, and a national ID number when a landlord or manager records one for a tenancy.
• Payment records. M-Pesa references, amounts, dates, the account a payment was sent to, and the Paybill, Till or bank account a landlord asks us to show tenants.
• Electricity records. The meter number for a house and the tokens bought or recorded for it.
• Messages. The fact that we sent you a text or an email, the number or address we sent it to, the time and whether it was delivered. We do not store the words in a text message.
• Documents. What an owner uploads to have a property verified: a title deed or lease, a letter of authority and the owner's ID.
• Photos. Photos of a house on a listing, and photos on a maintenance request.
• Device and log data. Your IP address, your browser, the pages you open and the actions taken on an account. These are kept in an audit log.

Why we hold it, in plain words

• To do what you asked. We cannot show a tenant their bills, send a payment prompt or issue a receipt without the tenancy and payment records. This is the agreement between you and us.
• Because money needs a record. Payments, receipts and the ledger behind them are kept so that a landlord and a tenant can both prove what was paid. That is our legitimate interest, and yours.
• To keep the platform honest. Verification documents, the audit log and listing reports let us check that a property is real and stop fraud.
• Because you said yes. Vacancy alerts and texts to a number you verified are sent because you asked for them. You can stop them.
• Because the law asks. Some records must be kept, or produced, when the law requires it.

Who sees what

• A landlord or manager sees the records of their own property: their tenants, their bills, their payments and their houses. They do not see any other property.
• A tenant sees their own tenancy, bills, payments, receipts and tokens. One tenant never sees another tenant's records.
• Shopika staff look at an account only to verify a property or to help with a support question. Every look at a hidden value is written to the audit log with the person's name and the time.
• The public sees a listing only. A tenant's name, phone number, rent and arrears are never shown publicly.

What is encrypted and masked

National ID numbers, meter numbers, payment account numbers and electricity tokens are stored encrypted. On screen they are masked, so a list shows something like "meter ending 8468" instead of the full number. Somebody with the right to see the whole value must ask for it, and every reveal is written to the audit log.

What a public listing never shows

A listing shows an approximate location, about 300 metres across. It never shows the exact point, the property name, directions or the landlord's phone number. You get the meeting place once you have booked a viewing.

Listing photos are re-encoded before they go online. That removes the GPS position a phone writes into a photo.

How long we keep things

• Money records. Payments, receipts, bills and the ledger are kept for the life of the tenancy, and after it ends, because they are money records that either side may need later.
• Verification documents. Kept until the request is decided, and for a review period afterwards in case the decision is questioned.
• Message records. We keep that a message was sent, to which number and whether it was delivered. The words of a text are not stored at all.
• Account and log data. Kept while the account is in use, and the audit log is kept afterwards because it is the record of who did what.

If you ask us to delete something, we delete what we can and tell you plainly what we must keep as a money record, and why.

Who we share it with

• Safaricom. To send an M-Pesa prompt and to confirm a payment.
• Our text message provider. To deliver a text to your phone.
• Kenya Power. When you buy an electricity token, the payment goes to Kenya Power's Paybill 888880 for your own meter.

Each of them gets only what that payment or that message needs. Nobody else receives your data. We do not sell data, and there are no advertising networks anywhere in this product.

Where your data is kept

Rent Shopika runs on a server Shopika rents from Contabo GmbH, in Germany. Your records are stored there, so they leave Kenya. Kenya's Data Protection Act allows this when the transfer is needed to provide the service you asked for, which is what this is: it is where the app runs.

On that server, only Shopika's own people can reach the records, over an encrypted connection. ID numbers, meter numbers, payment account numbers and electricity tokens are stored encrypted, and every time someone reveals one it is written to a log we keep. Backups are kept on the same server. If we ever store backups elsewhere, they will be encrypted before they leave, and we will update this notice first.

Apart from that, data leaves the server only when a payment or a message needs it, and only to the companies named above.

Cookies

We use one essential cookie. It holds your session, which is what keeps you logged in and protects a form you submit. There are no advertising cookies and no tracking cookies on this site.

Your rights

Under Kenya's Data Protection Act 2019 you can ask to:

• see the personal data we hold about you;
• correct it when it is wrong;
• have it deleted;
• object to the way we are using it.

Email support@shopika.com and say what you want. Shopika Enterprise Ltd handles the request as the data controller. We may ask a question or two to be sure it is really you, because these records are private.

If you are not happy

Tell us first, so we can put it right. You can also complain to the Office of the Data Protection Commissioner, which is the authority for data protection in Kenya.

Changes to this notice

When we change this notice we change the date at the top. If a change affects how we use your data, we will tell you by email and in the app.