NFC Rental Management System — Privacy Notice
Version 1.0 · Working draft
This notice explains in plain language how personal information may be handled when using NFC Rental. NFC must confirm the legal entity responsible for the service, its contact details, actual vendors, retention periods and cross-border hosting arrangements before commercial launch.
1. Information handled
Depending on features used, information may include user names, usernames, contact details, account roles, property and unit details, tenant contact details, lease records, rent charges, payments, expenses, maintenance records, audit events and basic technical information needed to secure the service.
2. Why information is used
Information is used to provide rental-management features, manage accounts and permissions, maintain records, support users, secure the system, troubleshoot errors, comply with applicable obligations and respond to authorised requests. Optional communications or product-improvement sharing should only occur where a valid basis exists and, where required, the person has separately consented.
3. Landlords and agents entering tenant information
The landlord or agent using NFC Rental may determine why tenant information is collected and how it is used. They are responsible for having an appropriate legal basis, giving required privacy information and responding to tenant requests. NFC may provide the software and process information to host and operate it. The parties' exact controller/processor roles must be set out in the customer agreement.
4. Third-party service providers
Information may be processed by providers needed for the service, such as website hosting, data storage and backup, security, technical support, communications, or payment processing if such features are enabled. NFC should identify the actual providers, their purposes, relevant data categories and any transfers outside Kenya before deployment. Information should not be sold to third parties. Optional sharing for service updates or product improvement is covered by a separate choice on the consent page.
5. Security and retention
NFC should use reasonable technical and organisational safeguards, access controls and backups. No internet system can guarantee absolute security. Information should be retained only as long as needed for stated purposes, contractual needs, dispute handling or legal requirements, and then securely deleted or anonymised where appropriate.
6. Your data rights
Subject to applicable law, individuals may have rights to be informed, access personal data, request correction, object to certain processing, request deletion or restriction where applicable, and withdraw consent for processing based on consent. Requests should be directed to the organisation responsible for the data. Withdrawal does not undo processing lawfully completed before withdrawal.
7. Cross-border processing
If data is stored or accessed outside Kenya, NFC and its customers must ensure applicable legal requirements and safeguards are met. The actual hosting locations and transfer arrangements must be confirmed before launch.
8. Children and sensitive information
Users should not enter children's or sensitive personal data unless they have verified that it is necessary and all required safeguards and legal permissions are in place.
9. Updates and contact
This notice may be updated when features or processing change. Material changes should be communicated and, where required, users should be asked for a new choice. NFC should publish a verified privacy contact and business contact details here before commercial launch.