Privacy policy

Who we are

IPEN Property is property management software operated by Pensoft Systems Ltd ("Pensoft", "we", "us"), a company based at Northstar Building, Lenana Road, Kilimani, Nairobi, Kenya. It is made up of:

• this website;
• the management app, used by property management companies, landlords, letting agents, owners, vendors and their teams;
• the tenant portal and the Ipen Tenant mobile app, used by tenants and applicants; and
• the IPEN marketplace, where organisations list vacant homes.

Together we call these the "Services". This policy explains what personal information the Services handle, why, and the choices and rights you have under the Data Protection Act, 2019 ("the Act") and its regulations.

Our role with your information

Who is responsible for your information depends on how you use IPEN Property:

• When an organisation manages your tenancy or property. The property management company, landlord or agent that uses IPEN Property (the "Organisation") decides what information to hold about its tenants, owners and vendors. It is the data controller, and we act as its data processor: we hold and process that information on its instructions and for no other purpose. Questions about, for example, your rent account or lease are best sent to your Organisation first; we will help it respond.
• For your own account, the marketplace and this website. When you create a IPEN Property account, browse or apply through the marketplace, contact us, or when an Organisation signs up with us, Pensoft is thedata controller.

Information we collect

Account and sign-in

• Your name, mobile number and email address.
• One-time sign-in codes sent by SMS (they expire after a few minutes), and the sessions and devices you sign in from.
• Your role in each Organisation you belong to, and invitations sent to you.

Organisations

• Business name, type, contact details and registration number.
• Verification (KYC) details, including the KRA PIN.
• Payout accounts (bank or M-Pesa) and the Organisation's own M-Pesa paybill credentials.
• Owners' details, ownership shares, management agreements and tax profiles.

Tenancies and properties

• Properties, units, meters and meter readings.
• Leases, charges, invoices, receipts, credit notes, statements and balances.
• Move-in and move-out inspections, including photos, and deposit settlements.
• Maintenance requests: what you report, photos you add and how the job is handled.

Rental applications

When you apply for a home, the Organisation that listed it receives the details you give, which may include:

• your preferred move-in date, household size and a message;
• employment status, employer and monthly income (used to work out a rent-to-income ratio);
• references; and
• identity documents you upload for verification.

Applications are reviewed by people at the Organisation. IPEN Property does not make automated decisions about you and does not run credit bureau checks.

Payments

• The phone number or account a payment comes from, the amount, the M-Pesa or bank transaction reference and the time.
• Payout details for deposit refunds, if you add them.
• We never see or store your M-Pesa PIN. If card payments are offered, card details are entered with the payment provider, not with us.

Insurance

If you ask for cover, the details needed for a quote or policy (such as the property, the cover wanted and your contact details), the policy itself and any claims.

Technical information

• IP address, browser and device type, and security and error logs.
• If you use the mobile app and allow notifications, a device token so we can send push notifications.
• An audit trail recording which user did what, and when, inside an Organisation's account.

When you contact us

What you include in emails, calls and WhatsApp messages to us, including demo requests sent through this website.

How we use it

We use personal information only where the Act allows it, for these purposes:

• To provide the Services (performance of a contract): running accounts, billing and collections, matching payments, owner statements and payouts, maintenance, leasing, inspections and deposit refunds.
• To meet legal obligations: keeping financial and tax records, supporting Monthly Rental Income tax calculations, verifying Organisations, and responding to lawful requests from authorities.
• For our legitimate interests, balanced against your rights: keeping the Services secure, preventing fraud on the marketplace, fixing faults, providing support, and improving the product using aggregated information.
• With your consent: push notifications, marketing messages, and anything else we ask your permission for. You can withdraw consent at any time without affecting what was done before.

We do not sell personal information, and we do not use tenants' information to advertise to them.

Who we share it with

We share personal information only as needed to run the Services:

• Within your tenancy: the Organisation managing your property and the people it gives access to. Owners see statements for their properties, and vendors see the details of jobs assigned to them, such as the unit and a contact number.
• Payment partners: Safaricom (M-Pesa), banks and, where offered, other payment providers, to collect rent and make payouts and refunds.
• Service providers working for us: Africa's Talking (SMS), our email delivery provider, Google Firebase Cloud Messaging (push notifications) and Cloudflare (storage of documents and photos). They may use the information only to provide their service to us.
• Partner insurers, only when you ask for a quote or take out cover, so that they can quote, issue the policy and handle claims.
• Kenya Revenue Authority: when an Organisation uses IPEN Property to pay tax, the payment details it makes to KRA.
• Authorities and advisers: where the law requires it, to protect people's rights and safety, or to professional advisers bound by confidentiality.
• A buyer of our business, if Pensoft is reorganised or sold, under the same protections set out here.

Marketplace listings show the property, its photos, location and rent. They never show current tenants' details.

Transfers outside Kenya

Some providers we rely on, such as Cloudflare and Google, may process information on servers outside Kenya. When that happens we follow sections 48 to 50 of the Act. We use providers that offer appropriate safeguards, including contractual data protection commitments and security measures, and we transfer only what the service needs.

How we protect it

• Each Organisation's data is kept separate, and users see only what their role allows.
• Payment credentials, KRA PINs and payout account numbers are encrypted. Account numbers are shown masked.
• Sign-in uses one-time codes. Documents are downloaded through short-lived, signed links.
• Owner payouts need approval from two people, and every action is recorded in an audit log.
• Information travels over encrypted connections (HTTPS), and we keep regular backups.

No system is perfectly secure. If a breach puts your information at real risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires. We will also tell affected people (or, where we act for an Organisation, tell the Organisation) without undue delay.

How long we keep it

We keep personal information only as long as it is needed for the purpose it was collected for:

• Accounts: while the account is active. When an account is closed, we delete or anonymise its information, except what we must keep as described below.
• Financial and tax records (invoices, receipts, ledgers, statements, payouts and tax records): for at least five years, as required by the Tax Procedures Act, 2015, and longer if a dispute or investigation is ongoing.
• Information we hold for an Organisation: for as long as the Organisation instructs, and for the period after its subscription ends set out in our terms and conditions.
• One-time codes expire after a few minutes. Security logs are kept for a limited period, then deleted.

Your rights

Under the Act you have the right to:

• be told how your personal information is used (this policy);
• access the personal information held about you;
• have inaccurate or misleading information corrected;
• have information deleted when there is no longer a lawful reason to keep it;
• object to, or ask us to restrict, some processing, including for direct marketing;
• receive your information in a portable, machine-readable format; and
• withdraw consent you have given.

To delete your account, use our account deletion page. For other requests, contact us using the details below. If your information is held for an Organisation, you can also contact that Organisation directly; we will pass on your request and help it respond. We may need to confirm your identity first. We will respond within the time limits set by the Data Protection (General) Regulations, 2021.

If you are unhappy with how your information has been handled, you can complain to theOffice of the Data Protection Commissioner. We would appreciate the chance to put things right first.

SMS, email and push messages

Some messages are part of the Services and are sent on behalf of your Organisation, such as sign-in codes, invitations, invoices, rent reminders, receipts, statements and maintenance updates. These stop when you leave the tenancy or the Organisation removes you.

We send marketing messages only if you have agreed to receive them, and every marketing message tells you how to opt out. You can turn off push notifications in your phone's settings at any time.

This website and cookies

This website does not use advertising or analytics cookies, and it does not track you across other sites. It stores one setting in your browser, your light or dark theme choice, and does not send it to us.

The demo form does not store anything on this website. It opens your own email app or WhatsApp with your message filled in, and we receive only what you choose to send. Like any web server, ours keeps standard request logs (such as IP address and pages requested) for security.

Children

The Services are for adults. You must be 18 or older to open an account or apply for a tenancy. Applicants may tell us the size of their household, but we do not knowingly collect other information about children.

Changes to this policy

We may update this policy as the Services or the law change. We will update the date at the top of this page, and if a change is significant we will tell account holders by email, SMS or a notice in the app before it takes effect.