Organisation	Sheria Housing Limited
App Name	Sheria Housing Member App
Platform	Android & iOS
Data Controller	Sheria Housing Limited
DPO Email	privacy@sheriahousing.co.ke
Jurisdiction	Republic of Kenya

1. Introduction

Sheria Housing Limited (“Sheria Housing”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of all members who use the Sheria Housing Member App (the “App”). This Privacy Policy explains how we collect, use, store, share, and safeguard your personal information when you access our services through the App.

By registering for or using the App, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein. If you do not agree, please discontinue use of the App and contact us to close your account.

This Policy is governed by the Kenya Data Protection Act, 2019 (DPA), the Data Protection (General) Regulations, 2021, and any other applicable laws of Kenya.

2. Who We Are

Sheria Housing Limited is a registered housing and property management company incorporated under the laws of Kenya. We operate as the Data Controller for all personal data processed through the Sheria Housing Member App. For enquiries relating to this Policy, please contact our Data Protection Officer (DPO) using the details in Section 13.

3. Information We Collect

We collect personal information that is necessary to provide you with housing-related services, manage your membership account, and improve the App experience.

3.1 Account & Identity Information

• Full name, national identification number (ID/Passport), date of birth, gender
• KRA PIN and member number
• Profile photograph (optional)
• Membership registration details and share certificate number

3.2 Contact & Communication Information

• Mobile phone number (including M-Pesa registered number)
• Email address and physical/postal address
• Next of kin details

3.3 Financial & Transaction Information

• Contribution payments, loan repayments, and levy records
• M-Pesa transaction references and payment confirmations
• Bank account details (where applicable for disbursements)
• Statement history and account balances

3.4 Device & Technical Information

• Device type, model, and operating system
• Unique device identifiers and push notification tokens
• IP address, browser type, and session data
• App usage logs and crash reports

3.5 Location Information

• General location data (city/county level) to personalise property listings
• Precise GPS location only if you explicitly grant permission for property search features

3.6 Communication Records

• Messages, support tickets, and correspondence sent through the App
• Survey responses and feedback submitted voluntarily

4. How We Use Your Information

We process your personal data for the following lawful purposes:

• Account Management: To register, verify, and manage your member account.
• Service Delivery: To process contributions, loan applications, allocations, and related member services.
• Payment Processing: To facilitate M-Pesa, bank transfer, or other permitted payment methods and issue receipts.
• Communication: To send transaction confirmations, statements, notices, and updates relevant to your membership.
• Compliance: To verify your identity, comply with KRA obligations, AML regulations, and any court or regulatory orders.
• Customer Support: To respond to your queries, complaints, and requests through our help desk.
• Security & Fraud Prevention: To detect, investigate, and prevent fraudulent transactions and unauthorised account access.
• Product Improvement: To analyse anonymised usage patterns and improve App features, performance, and user experience.
• Legal Obligations: To meet any legal, regulatory, or contractual obligations imposed on Sheria Housing Limited.

5. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we rely on the following lawful bases:

• Contract Performance: Processing is necessary to perform the membership agreement and housing services contract between you and Sheria Housing Limited.
• Legal Obligation: Processing is required to comply with applicable Kenyan laws, including the Companies Act, the Housing Act, tax laws, and financial regulations.
• Legitimate Interests: Processing is necessary for fraud prevention, network security, and improving our services, where such interests are not overridden by your rights.
• Consent: For optional data uses such as marketing communications or precise location access, we will seek your explicit consent, which you may withdraw at any time.

6. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with the following third parties under strict confidentiality and data processing agreements:

• Payment Processors: Safaricom (M-Pesa) and licensed banks to facilitate transactions on your behalf.
• Government Authorities: Kenya Revenue Authority (KRA), the Registrar of Companies, and other regulatory bodies, where required by law.
• Technology Partners: Cloud hosting providers, SMS gateway providers, and software vendors who process data solely on our instructions.
• Legal and Professional Advisors: Lawyers and auditors engaged by Sheria Housing Limited for legitimate business purposes.
• Law Enforcement: Where we are legally compelled to disclose data by a court order, subpoena, or statutory authority.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with legal and regulatory obligations:

• Active member account data: Duration of membership plus 7 years following termination.
• Financial transaction records: Minimum 7 years as required by the Income Tax Act and related regulations.
• Identity verification documents: Duration of membership plus 5 years.
• Device and log data: Up to 12 months for security and audit purposes.
• Support and communication records: 3 years from date of correspondence.

When data is no longer required, we will securely delete or anonymise it in accordance with our internal data destruction procedures.

8. Your Data Protection Rights

Under the Kenya Data Protection Act, 2019, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of any inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where it is no longer necessary, subject to legal retention obligations.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• End-to-end encryption of data in transit using TLS/HTTPS protocols.
• Encryption of sensitive data at rest in our databases.
• Multi-factor authentication (MFA) for member login.
• Role-based access controls limiting staff access on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments.
• Secure coding practices and regular App security updates.

In the event of a data breach likely to result in risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach.

10. Cookies and Analytics

The App uses limited tracking technologies to improve performance and user experience:

• Session tokens to maintain your login state securely.
• Crash reporting tools (e.g., Firebase Crashlytics) to identify and resolve technical issues.
• Anonymised analytics to understand feature usage patterns — no personally identifiable data is collected for analytics.

We do not use third-party advertising cookies or tracking pixels. You may disable analytics tracking in the App settings at any time.

11. Children’s Privacy

The Sheria Housing Member App is intended for adults aged 18 years and above. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a minor has registered an account without parental consent, we will promptly delete the account and associated data. If you believe a minor has provided us with their information, please contact us at privacy@sheriahousing.co.ke.

12. International Data Transfers

Your personal data is primarily processed and stored within Kenya. Where it is necessary to transfer data outside Kenya (for example, to cloud service providers with servers in other jurisdictions), we will ensure that adequate safeguards are in place as required by Section 48 of the Kenya Data Protection Act, 2019, including standard contractual clauses or other approved transfer mechanisms.

13. Contact Us

If you have any questions, concerns, or complaints about how we handle your personal data, or to exercise your data rights, please contact our Data Protection Officer:

Organisation	Sheria Housing Limited
Role	Data Protection Officer
Email	privacy@sheriahousing.co.ke
Postal Address	P.O. Box [Insert Address], Nairobi, Kenya
Telephone	+254 [Insert Phone Number]

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:

Authority	Office of the Data Protection Commissioner
Website	www.odpc.go.ke
Email	info@odpc.go.ke

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Post the updated Policy in the App with a revised effective date.
• Send you an in-app notification or email advising you of significant changes.
• Where required by law, request your renewed consent.

Your continued use of the App after the effective date of any updates constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.