Who We Are
Meneja is a property management and rental marketplace platform operated by Meneja Billing (Business Registration No. BN-L3SMEDA9), a sole proprietorship registered in Kenya under the Business Registration Service Act, 2015.
In this policy, “Meneja”, “we”, “us”, and “our” refer to Meneja Billing. “Platform” refers to the Meneja web application, mobile application, associated APIs, and the Meneja Marketplace (accessible at marketplace.meneja.cloud).
We are registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller under Section 18 of the Data Protection Act, 2019. Our processing activities fall within the category of property management, which is a mandatory registration sector under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
Scope of This Policy
This policy applies to all individuals who interact with the Meneja Platform, including:
- Property owners and investors who list and manage estates
- Property managers assigned to oversee estates on behalf of owners
- Maintenance staff assigned to service and resolve work orders
- Tenants who occupy units managed through the Platform
- Marketplace Listers — individuals or entities who create a Meneja Marketplace account to advertise rental units to the public
- Prospective Tenants — members of the public who browse Marketplace listings or submit a viewing request without creating an account
- Visitors to our website who have not yet registered
This policy governs how we collect, use, store, share, and protect personal data across all Meneja services, and explains your rights as a data subject under Kenyan law.
What Personal Data We Collect
We collect only data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy.
3.1 All Platform Users (Registration)
| Data | Purpose |
|---|---|
| Full name | Identity verification and display |
| Email address | Authentication, notifications, correspondence |
| Password (hashed) | Account security — never stored in plain text |
| Phone number | Payment processing, SMS notifications, billing contact |
| Role | Access control and dashboard routing |
3.2 Tenants (Additional Data)
| Data | Purpose |
|---|---|
| National ID number | Identity verification for lease agreements |
| Emergency contact name & phone | Safety and welfare purposes |
| Assigned unit and estate | Service delivery |
| Monthly rent amount | Payment processing and records |
| Lease agreement details | Contractual obligation (Growth plan and above) |
3.3 Marketplace Listers (Additional Data)
| Data | Purpose |
|---|---|
| First and last name | Account identity and listing attribution |
| Phone number | Booking notifications and listing fee billing |
| Listing content (property details, photos, address, rent amount, unit type, availability) | Publishing the listing on the Marketplace |
| County and location data | Search and filter functionality for prospective tenants |
3.4 Prospective Tenants (Viewing Requests)
Prospective tenants may submit a viewing request on a Marketplace listing without creating an account. We collect:
| Data | Purpose |
|---|---|
| Full name | Identifying the requestor to the Lister |
| Phone number | Contact for booking confirmation |
| Preferred viewing date and time | Scheduling the viewing appointment |
| Message (optional) | Any additional context provided by the requestor |
3.5 Transaction Data
| Data | Purpose |
|---|---|
| Payment transaction reference | Payment verification and reconciliation |
| Payment amount & timestamp | Financial records and audit trail |
| Payer phone number | Initiating and confirming mobile money transactions |
| Payer name (as returned by payment processor) | Reconciliation and dispute resolution |
| Account reference used at payment | Identifying the purpose of payment (rent, listing fee, or subscription) |
Legal Basis for Processing
Under Section 30 of the Data Protection Act, 2019, we must identify a lawful basis before processing personal data. We rely on the following:
| Legal Basis | Processing Activity |
|---|---|
| Performance of a Contract (S.30(b)) | Creating and managing tenancy records; executing lease agreements; processing rent payments; publishing and managing Marketplace listings; processing listing fees |
| Legal Obligation (S.30(c)) | Retaining financial and transaction records for tax and regulatory purposes |
| Legitimate Interests (S.30(e)) | Platform security; fraud prevention; maintenance and complaint routing; sharing viewing request data with the relevant Lister; notifications |
| Consent (S.30(a)) | Optional marketing communications and service improvement surveys |
How We Use Your Personal Data
We use your data strictly for the purposes for which it was collected:
- Registering and maintaining your account on the Platform
- Matching tenants to units and estates
- Processing rent payments and subscription fees via mobile money
- Processing Marketplace listing fees and activating paid listings
- Generating and storing digital lease agreements
- Routing maintenance complaints to the appropriate staff or manager
- Forwarding viewing requests to the relevant Marketplace Lister
- Sending in-platform and email notifications relevant to your role
- Producing financial records, payment histories, and reconciliation reports
- Monitoring platform security and investigating potential breaches
- Complying with legal and regulatory obligations under Kenyan law
Data Retention
We retain personal data for no longer than is necessary for the purpose for which it was collected, subject to applicable legal obligations.
| Data Category | Retention Period |
|---|---|
| Active user account data | Duration of account + 12 months after closure |
| Tenant records (profile, lease, unit) | Duration of tenancy + 7 years (Kenyan tax law) |
| Payment transaction records (rent, listing fees, subscriptions) | 7 years from transaction date |
| Marketplace listing data | Duration of active listing; archived listings retained for 12 months after expiry or removal |
| Viewing request data | 6 months from submission date |
| Maintenance & complaint records | 3 years from resolution |
| Security and audit logs | 12 months |
| Consent records | Duration of relationship + 3 years |
| Deleted account data | Anonymised within 30 days, except where legal hold applies |
Your Rights as a Data Subject
Under Part IV of the Data Protection Act, 2019, you have the following rights in respect of your personal data held by Meneja:
| Right | What It Means |
|---|---|
| Right to be Informed | Know what data we hold, why, and how it is used. This policy fulfils that obligation. |
| Right to Access | Request a copy of your personal data. We respond within 7 days, free of charge. |
| Right to Rectification | Request correction of inaccurate or incomplete data. |
| Right to Erasure | Request deletion where we no longer have a lawful basis. We respond within 14 days. Financial and lease records may be retained to comply with legal obligations. |
| Right to Object | Object to processing based on legitimate interests or for direct marketing. |
| Right to Data Portability | Request your data in a machine-readable format within 30 days. |
| Right to Withdraw Consent | Withdraw consent at any time without affecting prior processing. |
| Right re: Automated Decisions | We do not make automated decisions with legal effect. Any such processing would require explicit consent. |
This policy applies equally to Prospective Tenants who submitted a viewing request without creating an account. To exercise any right over that data, contact us with your name and the approximate date of submission.
How to Exercise Your Rights
Submit a written request to privacy@meneja.co.ke. Include your full name and the email address associated with your account. We may verify your identity before processing the request.
If you are dissatisfied with our response, you have the right to lodge a complaint with the ODPC at www.odpc.go.ke or call 0207801800.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or destruction:
- All data in transit is encrypted using TLS 1.2 or higher
- All data at rest is encrypted within our cloud infrastructure
- Authentication uses industry-standard hashed password storage
- Row-Level Security policies ensure each user only accesses data relevant to their role
- No direct client-side database access is permitted — all queries go through server-side privileged clients
Data Breach Notification
In the event of a personal data breach, we will:
- Notify the ODPC within 72 hours of becoming aware, under Section 43 of the Data Protection Act, 2019
- Notify affected data subjects in writing within a reasonable period, describing the nature of the breach and steps taken
- Document all breaches in an internal breach register
Changes to This Policy
We may update this policy from time to time. Where changes are material, we will notify you by email or via a prominent notice on the Platform at least 14 days before the changes take effect. The version number and effective date will always reflect the current version.
Continued use of the Platform after the effective date of an updated policy constitutes acceptance of the revised terms.