Privacy Policy

About this policy

This policy explains how Urban Renewed Limited handles personal information that you give us through this website, especially the Diaspora service request form. It is written to follow the Data Protection Act, 2019 of Kenya and the regulations made under it.

1. Who we are

Urban Renewed Limited is a real estate company in Nairobi, Kenya. We act as the data controller for the personal information described in this policy. For privacy matters you can reach us atlegal@urbanrenewed.co.ke, or by post at P.O. Box 100090-00101, Nairobi, Kenya.

2. What we collect

When you send an enquiry through the Diaspora service request form we collect:

• Your contact details: full name, email address, country of residence, phone or WhatsApp number and your preferred contact channel.
• Your property or project information: the service you chose, the property or project name, its location in Kenya, its type and stage, your description of the enquiry and your answers to the questions for that service.
• Documents you choose to attach (optional): for example brochures, contracts, drawings, quotations, specifications and photographs. These can contain personal information about you or about other people named in them.
• Records the form creates: the date and time of submission, the service you selected, the page you came from on our website, and a record that you accepted this policy, with the time you accepted it.

We do not ask for identity documents, bank details or passwords, and we ask you not to send them. The enquiry itself does not include your IP address. When you send the form, our server briefly reads your network address to limit repeated submissions and passes it to Cloudflare for the security check; we do not save it with your enquiry. Our hosting and security providers handle technical data as described in section 6.

If you contact us by telephone, WhatsApp, or email instead, we receive the details you give us in that way. Our four other request forms (quotation, consultation, site visit and training) are Google Forms and are handled in the way Google and the form itself describe.

3. Why we use it, and our lawful basis

We use the information only to:

• read and respond to your enquiry and, if you decide to go ahead, prepare and provide the service you asked about;
• contact you through the channel you chose;
• keep a record of the enquiry, including when it arrived and that you accepted this policy;
• protect the form from automated abuse and misuse.

Our lawful bases under the Data Protection Act are:

• Your consent, which you give by ticking the consent box before sending the form;
• Steps taken at your request before entering into an agreement with you; and
• Our legitimate interest in keeping our website and request process secure.

The website itself contains no advertising or analytics tools, and the form does not make automated decisions about you. This policy does not describe any other use of your information.

4. Consent and withdrawing it

The form cannot be sent unless you tick the consent box, which is never ticked in advance. You can withdraw your consent at any time by writing to legal@urbanrenewed.co.ke. Withdrawing consent does not affect what we did with your information before you withdrew. If we have no other lawful reason to keep your enquiry, we will deal with it as described in section 9. We may not be able to continue with your enquiry without it.

5. Data minimisation

The form asks only for what we need to understand and answer an enquiry about a property or project. The questions shown depend on the service you choose. Document uploads are optional.

6. Who receives your information

The form uses the following service providers. Each processes information for the part of the process described below:

• Resend delivers the enquiry email to our enquiries mailbox. The email contains everything you submitted, including any attached documents.
• Cloudflare Turnstile checks that a person, not a program, is using the form. Cloudflare receives technical information from your browser and connection to do this, and it provides us with the result.
• Vercel hosts this website and runs the function that receives the form. Requests pass through its network while they are processed.

The website does not store enquiries in a database: the enquiry email, delivered to Urban Renewed's enquiries mailbox, is the record. Apart from the providers above, the form sends your information to no one else. We may also have to disclose information where the law requires it. Each provider has its own privacy terms, which apply to its part of the processing. We have not described, and do not control, how long they keep their own logs (see section 9).

7. Transfers outside Kenya

Resend, Cloudflare and Vercel, the providers named in section 6, are international services and may process information outside Kenya. We have not confirmed where they process it, so we cannot list the countries or regions. We have not confirmed any transfer safeguards or contractual arrangements with them, and this policy does not describe any.

The Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021 set requirements for transferring personal data out of Kenya. Any transfer involved in handling your enquiry must meet those requirements. Ticking the consent box in section 4 is not, on its own, a statement that those requirements have been met. If you have questions about transfers, contact us at legal@urbanrenewed.co.ke.

8. How we protect it

The measures built into the form are:

• the form and its connection to our server use an encrypted (HTTPS) connection;
• everything you submit is checked on our server before it is accepted;
• attachments are limited to a short list of document and image types and are checked against the file's actual content, not only its name. Executable and unsupported files are refused;
• the Turnstile check, a hidden anti-spam field and limits on repeated submissions protect the form from abuse;
• the website does not place attachments on any public web address. They are sent inside the enquiry email.

Once an enquiry email reaches Urban Renewed's mailbox, the controls on who can open it are Urban Renewed's own internal arrangements, which this policy does not describe. No method of sending or storing information is completely secure, so we cannot guarantee security. Please do not send information that you would not want us to hold.

9. How long we keep it

The Data Protection Act requires that personal data is not kept longer than it is needed for the purpose it was collected for. Urban Renewed has not yet set fixed retention periods for enquiry records, so none is stated here. When fixed periods are set, they will be published on this page.

You can ask us to delete your enquiry at any time (see section 10). We will act on a valid request in line with the Act, subject to any record-keeping we are legally required to do.

10. Your rights

Under the Data Protection Act you have the right to:

• be told how your personal data is used (this policy does that);
• ask for access to the personal data we hold about you;
• object to the processing of your personal data;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data that we no longer need, or that we should not hold;
• withdraw your consent, and
• receive your personal data in a commonly used format where the Act provides for it.

To use any of these rights, write to legal@urbanrenewed.co.ke. We may need to confirm your identity first. We will respond without undue delay and within the periods the Act and its regulations set.

11. Complaints

Please contact us first at legal@urbanrenewed.co.ke so we can try to put things right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke), which handles complaints under the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

12. Cookies and similar technologies

The website code does not currently include advertising or analytics cookies. The site stores one short note in your browser session (to avoid showing the loading screen twice). Cloudflare Turnstile may use the storage it needs to run the security check. You can clear browser storage at any time.

13. Children

Our services and this form are for adults. We do not knowingly collect personal information from children. If you believe a child has sent us information, please tell us at the address in section 15 and we will deal with it in line with the Act.

14. Changes to this policy

We may update this policy. The date at the top of this page shows when this version took effect. If we make a material change, we will update the date and explain the change here.

15. Contact us