Privacy Policy

StayEZ (“we”, “us”, or “our”) is committed to protecting the privacy and personal data of every user who interacts with our platform. This Privacy Policy explains how we collect, use, store, share, and protect your information when you:

• Visit or browse stayez.co.ke or any StayEZ mobile application.
• Create an account, list a property, or book accommodations.
• Schedule property viewings, pay viewing facilitation fees, or reserve rental units.
• Communicate with hosts, vendors, or our concierge team via the platform, email, or WhatsApp.

This policy is governed by the Kenya Data Protection Act, 2019 (DPA) and is aligned with international best practices including the EU General Data Protection Regulation (GDPR) where applicable to our international users.

The data controller responsible for your personal data is:

a) Information You Provide Directly:

• Account Registration: Full name, email address, phone number, password, and profile photo.
• Identity Verification (KYC): National ID number, Alien Card, Passport details, or EAC residency documents — collected for resident rate verification and fraud prevention.
• Booking & Reservation Details: Check-in/check-out dates, guest count, special requests, and accommodation preferences.
• Property Listings (Hosts/Vendors): Property descriptions, photos, amenities, pricing, location details, caretaker contacts, and calendar availability.
• Payment Information: M-Pesa phone number, mobile money details, or card information (processed securely via IntaSend/Paystack — we do not store full card numbers).
• Communications: Messages exchanged between guests, hosts, and our support team.

b) Information Collected Automatically:

• Device & Browser Data: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, search queries, listings viewed, click patterns, session duration, and referral source.
• Location Data: Approximate geographic location derived from your IP address or, with your consent, precise GPS location for nearby property searches.
• Cookies & Similar Technologies: See Section 8 below for full details.

We process your personal data for the following purposes:

• Service Delivery: To facilitate bookings, process payments, dispatch viewing passes, and connect guests with hosts/vendors.
• Account Management: To create, maintain, and authenticate your StayEZ account.
• Resident Rate Verification: To verify Kenyan/EAC residency status for properties offering tiered pricing.
• Communication: To send booking confirmations, check-in instructions, viewing details, and respond to support inquiries via email, SMS, or WhatsApp.
• Platform Improvement: To analyze usage patterns, optimize search results, improve user experience, and develop new features.
• Trust & Safety: To detect and prevent fraud, unauthorized access, chargebacks, and platform abuse.
• Legal Compliance: To comply with Kenyan tax obligations (KRA), anti-money laundering (AML) regulations, and law enforcement requests.
• Marketing (with consent): To send promotional offers, new listing alerts, and travel recommendations. You may opt out at any time.

Under the Kenya Data Protection Act 2019 and GDPR (where applicable), we process your data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing communications, GPS location access).
• Contractual Necessity: Processing is necessary to perform the contract between you and StayEZ (e.g., processing bookings, facilitating payments).
• Legal Obligation: Processing is required to comply with Kenyan law (e.g., KRA tax reporting, AML regulations, Data Protection Act compliance).
• Legitimate Interest: Processing is necessary for our legitimate business interests (e.g., fraud prevention, platform security, service improvement), provided these interests do not override your fundamental rights.

We do not sell your personal data. We may share your information with the following categories of recipients:

• Hosts & Vendors: Your name, contact details, booking dates, and guest count are shared with property hosts to fulfill reservations. For real estate viewings, your name and phone number are shared with caretakers once a viewing pass is purchased.
• Payment Processors: IntaSend, Paystack, and Safaricom M-Pesa receive necessary transaction data to process payments securely.
• Service Providers: Trusted third-party services that support our operations (cloud hosting, email delivery, analytics, customer support tools) under strict data processing agreements.
• Legal & Regulatory Bodies: When required by law, court order, or to protect StayEZ’s legal rights, we may disclose data to Kenyan authorities including the Office of the Data Protection Commissioner (ODPC), KRA, or law enforcement.

StayEZ integrates with Safaricom M-Pesa, IntaSend, and Paystack for payment processing. When you make a payment:

• Your M-Pesa phone number and transaction reference are recorded for reconciliation and receipt generation.
• Credit/debit card details are processed directly by our PCI-DSS compliant payment partners — StayEZ never stores full card numbers on our servers.
• Payment records (amount, date, transaction ID, payer name) are retained for tax compliance and dispute resolution as required by Kenyan law.

StayEZ uses cookies and similar technologies to enhance your browsing experience:

• Essential Cookies: Required for site functionality — login sessions, shopping cart, security tokens. Cannot be disabled.
• Analytics Cookies: Google Analytics and similar tools to understand how users interact with our platform, which listings are popular, and where users drop off.
• Preference Cookies: Remember your language, currency display (KES/USD), residency selection, and search filters.
• Marketing Cookies: Used with your consent to deliver relevant property recommendations and retargeting ads on social media platforms.

You can manage cookie preferences through your browser settings. Disabling essential cookies may impair site functionality.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Active Accounts: Data is retained for the duration of your account plus 2 years after account deletion to handle potential disputes or legal claims.
• Booking Records: Transaction and booking history is retained for 7 years to comply with Kenya Revenue Authority (KRA) tax record-keeping requirements.
• KYC/Identity Documents: Retained for the duration of account activity plus 5 years, in line with AML regulations.
• Marketing Data: Retained until you withdraw consent or unsubscribe.
• Server Logs & Analytics: Automatically purged after 24 months.

Upon expiration of retention periods, data is securely deleted or anonymized so it can no longer be linked to you.

As a data subject under the Kenya Data Protection Act 2019, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We implement industry-standard technical and organizational measures to protect your personal data:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
• Access Controls: Staff access to personal data is restricted on a need-to-know basis with role-based permissions and multi-factor authentication.
• Secure Infrastructure: Our servers are hosted in facilities with physical security, fire suppression, and redundant power systems.
• Payment Security: All payment processing is handled by PCI-DSS Level 1 compliant partners.
• Incident Response: We maintain a data breach response plan. In the event of a breach affecting your data, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours as required by law.

StayEZ primarily stores and processes data within Kenya. However, some of our service providers (cloud hosting, analytics, email delivery) may process data in jurisdictions outside Kenya.

Where international transfers occur, we ensure adequate safeguards are in place through:

• Data processing agreements with Standard Contractual Clauses (SCCs).
• Verification that the receiving country provides adequate data protection as determined by the ODPC.
• Technical measures such as encryption and pseudonymization.

StayEZ services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe that a child under 18 has provided us with personal information, please contact us immediately at [email protected] and we will promptly delete such data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance from the ODPC.

When material changes are made, we will:

• Post the updated policy on this page with a revised “Effective Date”.
• Notify registered users via email or in-app notification.
• Where required by law, obtain your renewed consent before applying changes to existing data.

We encourage you to review this page periodically to stay informed about how we protect your data.

If you have questions, concerns, or complaints about this Privacy Policy or our data handling practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):