Privacy Notice

Avenra is a trust-first property marketplace operating in Kenya. For the purposes of the DPA, Avenra is the data controller for the personal data described in this notice.

Registered operator: [Registered legal entity name]. Registered office: [Registered office address]. Office of the Data Protection Commissioner (ODPC) registration: [ODPC data controller registration number].

We collect only what we need to run a safe marketplace:

• Account details — your name, email address, phone number, and password (stored only as a secure one-way hash).
• National ID images (front and back) — collected from professionals during identity verification.
• Selfie — a photo taken in your browser during verification. A selfie processed to confirm a person's identity is biometric data under DPA s.2 and attracts the heightened protections in Part IV of the DPA.
• Optional location verification — where you choose to confirm a property's location, we process the pin you provide.
• Device and technical data — a device fingerprint, IP address, browser type, and similar signals used to detect fraud and abuse.
• Conversation content — messages you exchange with other users through the platform (stored encrypted).
• Usage analytics — only if you opt in. See our Cookie Notice.

We rely on a specific lawful basis for each category of data:

• Explicit consent (DPA s.30 and Part IV) for the sensitive and biometric data — your National ID images and selfie. You give this consent knowingly during verification and may withdraw it (see your rights below).
• Performance of a contract for operating your account, publishing your listings, and delivering messages you send and receive.
• Legitimate interests / legal obligation for fraud prevention, safety, security, and responding to lawful requests — always balanced against your rights.
• Consent for optional analytics, which is off until you enable it.

Your National ID images and selfie are used solely to verify professional identity so that renters and buyers can trust who they are dealing with. We do not use this data for marketing, advertising, profiling, or any purpose unrelated to verification, and we never sell personal data.

• Account details — for as long as your account is active, then deleted or anonymised within [retention period] of closure.
• Verification evidence (ID images and selfie) — retained for the active verification period plus 12–24 months to resolve disputes and meet legal obligations, after which it is securely deleted.
• Conversation content — retained while your account is active and for a limited dispute-resolution window afterwards.
• Analytics — retained only in aggregate and only while you keep analytics enabled.

Where possible we minimise sensitive data — for example by using a KYC provider that returns a verified result rather than storing a full-resolution ID image.

We share personal data only with processors who act on our instructions under a written data-processing agreement — for example our cloud hosting provider and, where used, an identity-verification (KYC) partner. We disclose data to authorities only where legally required. We do not sell your data or share it for third-party advertising.

Avenra's data is processed on Microsoft Azure. The nearest Azure region is South Africa North; there is no Azure region inside Kenya, so some processing takes place outside Kenya. The ODPC has not published an adequacy list, so these transfers rely on appropriate safeguards — specifically Standard Contractual Clauses and the Microsoft Data Protection Addendum (DPA), which impose contractual data-protection obligations on the processor. You may request a summary of these safeguards using the contact details below.

Under DPA s.26 you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• have inaccurate data rectified;
• request erasure (deletion) of your data;
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time, including consent for biometric processing.

You can exercise most of these rights yourself from your account controls, including data export and account deletion. Where you contact us directly, we will respond without undue delay and in any case within [response deadline, e.g. 7 days] of verifying your identity.

We protect data with encryption in transit and at rest, encrypted message storage, strict role-based access to verification evidence, short-lived and audited access links for reviewers, and strong password hashing. Access to sensitive evidence is limited to the assigned reviewer and logged.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware of it, and will inform affected data subjects without undue delay where the DPA requires it.

Avenra is intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this notice. When we do, we will change the version string and last-updated date at the top of this page, and, for material changes, seek fresh consent where the DPA requires it.

Data Protection Officer: [DPO name], reachable at [dpo@avenra.co.ke].

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, via complaints.odpc.go.ke.