Privacy & Data Protection Notice
This notice explains how Gatepath Realtors processes your personal data in compliance with the Kenya Data Protection Act No. 24 of 2019 and the regulations of the Office of the Data Protection Commissioner (ODPC).
Table of Contents
1. Data Controller Identity
Gatepath Realtors Limited (hereinafter "Gatepath Realtors", "we", "us", or "our") is the registered Data Controller for all personal data processed through this website and associated services. Our registration details are:
- Website: www.gatepathrealtors.com
- Data Protection Email: info@gatepathrealtors.com
- Phone: +254 799 488 488
We are committed to compliance with the Kenya Data Protection Act No. 24 of 2019 and the regulations published by the Office of the Data Protection Commissioner (ODPC) of Kenya. This Privacy Notice is issued pursuant to Section 25 of that Act.
2. Personal Data We Collect
We collect personal data only to the extent necessary to deliver our real estate services and comply with applicable law. The categories of personal data we process include:
Identity & Contact Data
- Full legal name
- National Identification Card (ID) number or Passport number
- Email address and phone number
- Physical and postal address
Financial & Tax Data
- Kenya Revenue Authority (KRA) Personal Identification Number (PIN)
- Payment method details (processed securely via Paystack — we do not store raw card data)
- Transaction references and receipts
- Installment payment schedules
Succession & Next-of-Kin Data
- Full name and contact details of nominated next of kin
- Relationship to data subject
- This is collected solely to protect your land interest in the event of death or incapacity
Usage & Technical Data
- IP address and browser type (for security and fraud prevention)
- Pages visited and interaction patterns (via anonymised analytics)
- Property inquiries and site visit bookings submitted through web forms
We do not collect biometric data, health data, ethnic origin, or any other special category of personal data as defined under Section 45 of the Kenya Data Protection Act, unless you explicitly provide it and give written consent.
3. Purpose & Lawful Basis for Processing
Under Section 30 of the Kenya Data Protection Act, we process your personal data only where a lawful basis exists. The table below maps each purpose to its corresponding legal ground:
| Purpose | Lawful Basis (KDPA S.30) |
|---|---|
| Processing property inquiries and booking site visits | Consent (S.30(a)) |
| Drafting and executing Sale Agreements (Purchase Agreements) | Performance of contract (S.30(b)) |
| Processing payments through our Paystack integration | Performance of contract (S.30(b)) |
| Conducting KRA PIN verification and stamp duty compliance | Legal obligation (S.30(c)) |
| Filing title transfer documents at the Ministry of Lands | Legal obligation (S.30(c)) |
| Performing anti-fraud screening and land registry searches | Legitimate interests (S.30(f)) |
| Sending property alerts and marketing communications (opt-in only) | Consent (S.30(a)) |
| Succession planning for next-of-kin registration | Consent + Legal obligation (S.30(a)/(c)) |
We will never sell, rent, or lease your personal information to third parties for their commercial use.
5. Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law (Section 39 of the Kenya Data Protection Act):
| Data Category | Retention Period | Basis |
|---|---|---|
| Inquiry / lead data (no purchase completed) | 12 months from last interaction | Marketing consent withdrawal period |
| Purchase Agreement & title deed records | Minimum 30 years | Land Registration Act requirements |
| Payment receipts & transaction data | 7 years | KRA / Finance Act audit requirements |
| KRA PIN and ID copies | Duration of title holding + 7 years post-transfer | Tax compliance |
| Next-of-kin data | Duration of title holding | Succession Act obligations |
| Website usage / analytics data | 24 months (anonymised after 12 months) | Legitimate interest |
6. Your Rights Under the Kenya Data Protection Act
Pursuant to Part IV of the Kenya Data Protection Act No. 24 of 2019, you have the following enforceable rights as a data subject:
Right of Access (S.26)
Request a copy of all personal data we hold about you, free of charge within 21 days of your request.
Right to Rectification (S.27)
Request correction of inaccurate or incomplete personal data (e.g., wrong KRA PIN, misspelled name).
Right to Erasure (S.28)
Request deletion of your personal data where processing is no longer necessary, subject to our legal retention obligations.
Right to Object (S.29)
Object to processing of your data for direct marketing purposes at any time, with immediate effect.
Right to Data Portability (S.31)
Receive your personal data in a structured, machine-readable format to transfer to another service provider.
Right to Withdraw Consent (S.30)
Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact our Data Protection Officer at info@gatepathrealtors.com with subject line "Data Rights Request". We will respond within 21 calendar days as required by the Act.
If you believe your rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke or call +254 20 222 2222.
7. Security Measures
We implement appropriate technical and organisational measures under Section 41 of the Kenya Data Protection Act to protect your personal data against loss, unauthorised access, disclosure, or destruction:
- All data transmitted between your browser and our servers is protected using TLS 1.3 encryption (HTTPS).
- Sensitive documents (ID copies, KRA PIN certificates) are stored in role-restricted, AES-256 encrypted Supabase Storage buckets — inaccessible to general staff.
- Admin access is restricted to registered staff accounts, gated by role (CEO / Manager / Agent), with account actions recorded in an internal audit log.
- Payment processing is handled exclusively via Paystack — a PCI DSS Level 1 certified payment gateway. Card numbers are never stored on Gatepath servers.
- We conduct periodic security reviews of our data processing systems and promptly remedy identified vulnerabilities.
- In the event of a personal data breach likely to result in risk to your rights, we will notify the ODPC within 72 hours and affected data subjects without undue delay, as required by Section 43 of the Act.
9. International Data Transfers
Gatepath Realtors uses cloud infrastructure (Supabase, Paystack) that may process data in data centres outside Kenya, including within the EU and United States. Any such transfer is conducted in strict compliance with Section 48 of the Kenya Data Protection Act, specifically:
- Transfers to Supabase are protected by Standard Contractual Clauses (SCCs) and their ISO 27001 certification, providing adequate safeguards.
- Paystack holds PCI DSS Level 1 certification and is regulated under Central Bank of Nigeria and operates in compliance with applicable data protection laws across Africa.
- No personal data is transferred to any country that does not afford an adequate level of protection without appropriate contractual safeguards in place.
10. Children's Privacy
Our real estate services are directed exclusively to adults aged 18 years and above. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted data through our platform, please contact us immediately at info@gatepathrealtors.com and we will delete that data promptly. Property ownership by minors may only be facilitated through their legal guardians in compliance with the Law of Succession Act (Kenya).
11. Changes to This Privacy Notice
We reserve the right to update this Privacy Notice from time to time to reflect changes in our data practices, legal requirements, or business operations. When we make material changes, we will:
- Update the Effective Date at the top of this notice
- Display a prominent notice on our homepage for at least 30 days
- Email registered clients who have opted into communications with a summary of what has changed
Continued use of our website or services after a material change constitutes acceptance of the revised Privacy Notice.
12. Contact & Complaints
For all data protection inquiries, rights requests, or complaints about how we handle your personal data, please contact our designated Data Protection Officer:
If you are not satisfied with our response, you may file a complaint with the Office of the Data Protection Commissioner (ODPC):
Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Email: info@odpc.go.ke
Telephone: +254 20 222 2222
Physical: Nairobi, Kenya
Official Anti-Fraud & Payment Security Notice
Gatepath Realtors will NEVER request direct bank transfers to personal accounts from clients. All legitimate property payments must be processed exclusively through:
- Our official Paystack-powered online checkout (accessible from our verified website only)
- Our officially published M-Pesa Paybill numbers as communicated in writing by staff
If you receive any request to transfer money to a personal phone number or bank account claiming to be from Gatepath Realtors, please report it immediately to +254 799 488 488 and the Kenya DCI Cybercrime Unit.