1. Introduction and scope#
1.1 This Privacy Notice explains how Napayian Development Limited (the “Developer”, “we”, “us”) collects, uses, shares and protects personal data when you visit www.asayakilifi.com, make an enquiry, request a brochure or viewing, communicate with us, or buy or express interest in a unit in the ASAYA development, Bofa Road, Kilifi County, Kenya.
1.2 We process personal data in accordance with Article 31 of the Constitution of Kenya, 2010 (right to privacy), the Data Protection Act, 2019 (the “DPA”) and its regulations, including the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 and the Data Protection (Compliance and Enforcement) Regulations, 2021, as amended from time to time.
1.3 This notice applies to prospective and actual purchasers, investors and their representatives, website visitors, and other people who contact us. It does not apply to third-party websites we link to.
2. Who is responsible for your data#
2.1 The Developer is the organisation responsible for deciding why and how personal data is processed for the purposes described in this Notice. Its registered office is Ruaka Drive, Building Runda, Westlands, Nairobi, Kenya; P.O. Box 21372-00100, Nairobi, Kenya. The Developer will comply with applicable registration requirements under the Data Protection Act, 2019 and the relevant regulations.
2.2 Privacy contact: fwangata@napayian.com, telephone +254 797 042 121. Send privacy questions and rights requests to these contact details.
2.3 Service providers may process personal data on our behalf. We will use written data-processing terms and appropriate safeguards where required by law.
3. Personal data we collect#
| Category | Examples | How we get it |
|---|---|---|
| Identity and contact data | Name, title, email, telephone/WhatsApp number, postal address, country and city of residence, nationality, preferred language | From you; from agents or lawyers acting for you |
| Enquiry and interest data | Units or budget of interest, purpose of purchase (home, holiday, investment), timing, viewing requests, messages, brochure downloads | From you; from forms and communications |
| Purchaser due diligence data | Passport or national ID details and copies, KRA PIN, date of birth, proof of address, occupation, source of funds and source of wealth, beneficial ownership and PEP information, sanctions screening results | From you; from your lawyers or bank; from screening providers |
| Transaction data | Reservation and payment records, bank details of the payer, Sale Agreement, title, conveyancing and mortgage information, service-charge and account records | From you; from banks, lawyers and escrow agents |
| Technical and usage data | IP address, device and browser type, pages viewed, referral source, approximate location, time spent, cookie and similar identifiers | Automatically, via cookies and similar technologies (see the Cookie Policy) |
| Communications data | Emails, call and meeting notes, WhatsApp and social media messages, survey responses, marketing preferences and consent records | From you; from our systems |
| Visit and site data | Visitor logs, and CCTV or access-control images if you visit the site or sales gallery if applicable | When you visit |
3.1 We do not ask for sensitive personal data through ordinary Website enquiry forms. Please do not submit sensitive information unless we request it for a specific lawful purpose. Identity and financial information may be required later for a transaction and will be handled with appropriate safeguards.
3.2 You are not obliged to give us your personal data, but if you do not, we may be unable to respond to your enquiry or to sell you a unit (in particular where due diligence is legally required).
4. Why we use your data and our lawful basis#
Under the DPA we may process personal data only where a lawful basis applies (including sections 25, 30 and 32) and in line with the data protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; security; and accountability.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Respond to enquiries, send brochures and price information, arrange viewings | Identity, contact, enquiry, communications | Consent; steps at your request before a contract; our legitimate interest in responding to enquiries |
| Reserve and sell units; conclude and perform Sale Agreements; manage payments, title and handover | Identity, contact, transaction, due diligence | Performance of, or steps to enter into, a contract |
| Customer due diligence, anti-money-laundering, counter-terrorist financing and sanctions checks; reporting to authorities | Identity, due diligence, transaction | Compliance with a legal obligation (including the Proceeds of Crime and Anti-Money Laundering Act, 2009) |
| Direct marketing about ASAYA and related developments by email, SMS, phone or messaging apps | Identity, contact, preferences | Consent, which you can withdraw at any time, and where the law permits, an opt-out mechanism |
| Operate, secure and improve the Website and our services; analytics and measurement | Technical and usage data | Consent for non-essential cookies; legitimate interest for security and essential operation |
| Fraud prevention, security of premises, protecting our legal rights, handling disputes and complaints | All relevant categories | Legitimate interest; legal obligation; establishing, exercising or defending legal claims |
| Financing, insurance, audit, professional advice, corporate transactions and reporting to lenders and investors | Identity, transaction (as necessary) | Legitimate interest; contract; legal obligation |
| Tax, accounting and regulatory compliance and responding to lawful requests from courts, police, KRA, the Financial Reporting Centre or other authorities | Identity, transaction, due diligence | Legal obligation |
4.1 Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and freedoms, and we do not rely on them where they would be.
4.2 We do not use your data for a purpose incompatible with those above without telling you and, where required, obtaining your consent.
5. Consent, marketing and commercial use#
5.1 Where we rely on consent, it will be freely given, specific, informed and unambiguous, and separate from other terms. We do not use pre-ticked boxes. You may withdraw consent at any time (see section 12), and withdrawal does not affect processing done before it.
5.2 We use personal data for direct marketing only where permitted by the Data Protection Act, 2019 and applicable electronic communications law. Marketing messages will identify the sender and provide a simple opt-out. We maintain a suppression record to honour opt-outs.
5.3 We do not sell your personal data.
6. Due diligence and anti-money laundering#
6.1 Where required by applicable law or reasonably necessary to complete a transaction, we may verify purchasers’ identity and beneficial ownership, understand source of funds, conduct applicable screening and maintain records. The information requested will depend on the transaction and legal requirements.
6.2 Where required, we may report suspicious transactions and provide information to the Financial Reporting Centre or other competent authorities, and we may be prohibited from telling you that we have done so. We may decline or end a transaction where due diligence cannot be completed.
7. Who we share your data with#
We share personal data only where necessary and subject to appropriate safeguards and, for processors, written contracts.
| Recipients | Why |
|---|---|
| Group and project entities, directors, and authorised staff | To manage the Development and sales |
| Sales, marketing and channel agents, if any are appointed | To handle enquiries and viewings |
| Lawyers, conveyancers, surveyors, architects, quantity surveyors, project managers, accountants, auditors | To deliver and document the sale, title, construction and compliance |
| Banks, escrow agents, lenders, guarantors, insurers, investors and their advisers | Payments, escrow, project financing, insurance, and due diligence by financiers |
| IT, hosting, CRM, email, messaging, analytics, and advertising service providers | To run the Website and our systems (processors) |
| Regulators and public authorities, including the Kenya Revenue Authority, the Financial Reporting Centre, land registries, county governments, courts and law enforcement | To comply with law or lawful requests |
| A buyer or successor to the Development or business, and their advisers | In a corporate transaction, under confidentiality |
8. Transfers outside Kenya#
8.1 Some service providers may process personal data outside Kenya. We will transfer personal data outside Kenya only where permitted by the Data Protection Act, 2019 and applicable regulations, using the safeguards required for the relevant transfer.
8.2 Certain categories of processing may be required by law to occur in Kenya. We will comply with any such requirement.
8.3 You can ask us for information about the safeguards we use by contacting fwangata@napayian.com.
9. How long we keep your data#
| Data | Retention period |
|---|---|
| Unconverted enquiries and website contact data | 24 months after last meaningful contact, then deleted or anonymised |
| Marketing preferences and suppression records | Until you withdraw consent, plus a minimal suppression record so we honour opt-outs |
| Purchaser due diligence, identity and transaction records | At least seven years after the end of the relationship or completion where required by applicable law, or longer where the law requires (for example anti-money-laundering, tax and land records) |
| Contract, title and handover records | For the life of the property interest and the applicable limitation periods under the Limitation of Actions Act (Cap. 22) |
| Website analytics and server logs | For as long as necessary for security and analytics purposes, in line with our retention schedule |
| Cookie consent records | For as long as reasonably necessary to demonstrate and manage your consent |
| CCTV and visitor logs (where used) | For the period set in our site security retention schedule, unless needed for an incident |
9.1 We keep data only as long as necessary for the purposes above and to meet legal, accounting and reporting requirements, after which we securely delete or anonymise it.
10. Security and data breaches#
10.1 We take appropriate steps to protect personal data against unauthorised access, loss, misuse or disclosure. The safeguards applied are proportionate to the nature of the data and the risks of processing. No system is completely secure.
10.2 Where a personal data breach meets the statutory reporting threshold, the Developer will notify the Data Commissioner within the period required by the Data Protection Act, 2019 and will notify affected individuals where required by law. Processors must notify the controller within the applicable statutory period.
11. Automated decisions and profiling#
11.1 We do not knowingly make decisions based solely on automated processing that produce legal or similarly significant effects on you. Analytics and advertising tools, if used, will be disclosed through the Cookie Policy and enabled only in accordance with the applicable consent requirements.
12. Your rights#
Under the DPA you have the right to:
- be informed of the use to which your personal data is being put;
- access your personal data in our custody;
- object to the processing of all or part of your personal data, including for direct marketing;
- correct false or misleading data about you;
- delete (erase) false or misleading data about you or data we are no longer entitled to hold;
- withdraw consent at any time; and
- receive your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (data portability).
12.1 To exercise a right, contact fwangata@napayian.com or write to us at Ruaka Drive, Building Runda, Westlands, Nairobi, Kenya; P.O. Box 21372-00100, Nairobi, Kenya. We may ask for reasonable proof of identity and information needed to locate the data. We will respond within the period required by the Data Protection Act, 2019 and applicable regulations. We will not charge a fee unless the law permits it.
12.2 Rights are not absolute. We may refuse or limit a request where the law allows, for example where data is needed to comply with a legal obligation, to establish or defend legal claims, or where it would reveal another person’s data. We will explain our reasons.
12.3 To opt out of marketing at any time, use the unsubscribe facility in the message where available or email fwangata@napayian.com. We will action the request as required by applicable law and retain only the minimum suppression information needed to honour it.
13. Children#
13.1 The Website is not directed at children, and we do not knowingly collect their data. Where we process the data of a child (for example a named occupant or beneficiary of a purchase), we do so only with the consent of a parent or guardian and in the child’s best interests, as required by the DPA.
14. Cookies and similar technologies#
14.1 We use cookies, pixels and similar technologies. Non-essential ones are set only with your consent. Please see our Cookie Policy for details and how to manage your choices.
15. Third-party websites and social media#
15.1 The Website may link to or embed third-party content, maps, video and social media plug-ins. Those third parties have their own privacy policies and we are not responsible for them. If you contact us through a social media or messaging platform, that platform’s terms and privacy practices also apply.
16. Visitors from outside Kenya#
16.1 The Website may be accessed from outside Kenya. Where the Developer targets individuals in another jurisdiction or is otherwise subject to that jurisdiction’s data protection law, it will assess and comply with any additional applicable requirements. Please contact fwangata@napayian.com with questions about your rights.
17. Complaints#
17.1 Please contact us first at fwangata@napayian.com so we can try to resolve your concern.
17.2 You may lodge a complaint with the Office of the Data Protection Commissioner in Kenya. Current guidance and contact details are available at www.odpc.go.ke.
18. Changes to this notice#
18.1 We may update this notice from time to time. The current version, with its “Last updated” date, is on the Website. If we make significant changes we will take reasonable steps to tell you.
19. Contact#
19.1 Napayian Development Limited, Ruaka Drive, Building Runda, Westlands, Nairobi, Kenya; P.O. Box 21372-00100, Nairobi, Kenya. Privacy contact: fwangata@napayian.com, telephone +254 797 042 121.