Privacy notice
Hama Realtors Group Ltd ("Hama", "we") runs the Hama marketplace: the public website, the client, landlord and agent portals, the Hama messaging inbox, protected payments and our marketing channels. This notice explains what personal data we handle, why, on what legal basis under the Kenya Data Protection Act, 2019, who we share it with, how long we keep it and the rights you have. We are the data controller for this processing.
1. What we collect
| When | Data |
|---|---|
| You create an account or sign in | E-mail address, name, role (client, landlord or agent), sign-in method, and if you use Google sign-in, the identifiers Google returns. |
| You post or manage a listing | Property location and details, photos and walkthrough video, your phone number for enquiries, verification documents you choose to upload. |
| You search or use "near me" | Search terms, filters, saved searches; your device location only after you tap the button and only for that search. |
| You message through Hama | The messages, the listing they concern, timestamps, and automated safety flags (for example off-platform payment pressure). |
| You pay or get paid through protected payments | M-Pesa phone number, amount, M-Pesa receipt number and transaction status returned by Safaricom. We never see your M-Pesa PIN. |
| You apply as, or work as, a Hama agent | Name, phone, national ID number, areas covered, experience, agreement acceptance, placements and earnings. |
| You contact us or reply to our outreach | What you send us (name, phone, e-mail, area, budget) and the channel it came through, including a marketing campaign reference if you followed one of our links. |
| You visit the website | Technical logs (IP address, browser, pages) needed to run and secure the service. Google Analytics measures public website visits only with your opt-in. Meta and TikTok marketing analytics have separate choices in Analytics settings. |
2. Why we use it, and the legal basis
- Providing the service you asked for (performance of a contract): accounts, listings, searches, messaging, viewings, agent matching, protected payments and payouts.
- Keeping the marketplace safe (legitimate interests): verifying listings and owners, detecting fraud and off-platform payment pressure, protecting deposits until keys change hands.
- Talking to you about Hama (consent, or legitimate interests for business contacts): campaign updates, follow-ups on an enquiry you made, and partnership outreach to estate agencies and registered agents using published business contact details. Every marketing message carries an opt-out and STOP is honoured immediately.
- Legal obligations: tax, anti-fraud and record-keeping duties, and responding to lawful requests.
3. Who we share it with
We share data only as needed to run Hama, with processors bound by contract, or where the law requires:
- Supabase hosts our database, authentication and storage.
- Safaricom (M-Pesa Daraja) processes protected payments and payouts; they see the phone number and amount.
- Resend delivers our e-mail; Meta (Facebook, Instagram, WhatsApp), X and TikTok carry our public posts. With your separate opt-in, Meta or TikTok may also receive website activity for ad measurement. When you open WhatsApp from a Hama link, WhatsApp's own terms apply to that conversation.
- The other party to your transaction: a landlord sees a tenant's name and enquiry; a tenant sees the listing contact; an assigned Hama agent sees the request they were assigned. Clients and agents never see each other's private numbers through the platform unless one of them shares it.
- Netlify serves the public website.
We do not sell personal data. We do not buy or scrape consumer contact lists.
4. How long we keep it
Account and listing data for as long as your account is active and up to 24 months after, unless you ask us to delete it sooner. Payment records for seven years to meet tax and audit duties. Messages for 24 months after the last message. Marketing leads and business prospects until you opt out or 24 months after the last contact. Technical logs for 90 days.
5. Your rights
Under the Data Protection Act, 2019 you may ask us to: tell you what data we hold about you; correct it; delete it; restrict or object to processing, including all marketing; receive a copy in a portable form; and withdraw consent at any time without affecting earlier processing. We respond within 30 days. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).
To exercise any right, or to stop all marketing: WhatsApp 0710 186 027, e-mail stevemasha123@gmail.com, or use the "Talk to Hama" form on the website. Replying STOP to any message removes you from outreach immediately.
6. Security
Data is encrypted in transit, access is limited to the Hama owner account and named staff, payment credentials are held server-side only, and every administrative action is logged with who did it and when. If a breach affects you we will tell you and the Commissioner as the law requires.
7. Children
Hama is for adults. We do not knowingly collect data from anyone under 18.
8. Changes
We will post any change here with a new effective date. Material changes are announced on the website and, for account holders, by e-mail.