Privacy Policy

1. Introduction

Ardhi Verified Limited ("Ardhi Verified", "we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website, mobile applications, and services (collectively, the "Services").

We process personal data in accordance with the Kenya Data Protection Act, 2019 (Act No. 24 of 2019) ("KDPA") and, for users located in the United Kingdom, the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. This dual-compliance approach reflects our commitment to serving both Kenyan residents and the Kenyan diaspora in the UK and beyond.

Ardhi Verified Limited is registered as a data controller with the Office of the Data Protection Commissioner (ODPC), Kenya.

2. Data We Collect

We collect the following categories of personal data:

Account Data

When you create an account, we collect your full name, email address, phone number, nationality, country of residence, and, for Agent accounts, professional credentials, KRA PIN, national ID or passport number, and regulatory registration details.

Enquiry Data

When you enquire about a Listing or contact an Agent, we collect the content of your messages, enquiry timestamps, the Listings you are interested in, and any documents you share (such as proof of funds or identification).

Payment Data

When you make payments through our escrow service or subscribe to Land Guardian, we collect transaction amounts, payment method details (M-Pesa number, bank account, or card details processed by our PCI-DSS compliant payment provider), billing address, and transaction history.

Browsing Data

We automatically collect information about how you interact with our Services, including IP address, device type, browser type, operating system, pages visited, search queries, Listing views, time spent on pages, referral URLs, and approximate location derived from your IP address.

3. How We Use Your Data

We use your personal data for the following purposes and legal bases:

• Service delivery — Creating and managing your account, facilitating Listing enquiries, processing escrow payments, and providing Land Guardian monitoring alerts. (Legal basis: performance of contract)
• Verification & trust — Verifying Agent credentials, computing Trust Scores, conducting identity checks, and preventing fraud. (Legal basis: legitimate interest and legal obligation)
• Communications — Sending transaction confirmations, Land Guardian alerts, service updates, and, with your consent, marketing communications. (Legal basis: consent and legitimate interest)
• Improvement & analytics — Analysing usage patterns, improving search relevance, developing new features, and generating anonymised market insights. (Legal basis: legitimate interest)
• Legal compliance — Complying with tax obligations, anti-money laundering (AML) requirements, regulatory reporting, and responding to lawful requests from authorities. (Legal basis: legal obligation)

4. NLIMS Data Processing

A core feature of Ardhi Verified is cross-referencing Listing information with data from the National Land Information Management System (NLIMS). When we perform NLIMS verification, we process the title reference number, registered owner name(s), parcel dimensions, encumbrance records, and any caveats or restrictions registered against the title.

NLIMS data is sourced from publicly available government records and is processed for the legitimate purpose of verifying land ownership and protecting buyers from fraud. We do not store NLIMS data beyond what is necessary for verification and monitoring purposes, and we refresh verification data periodically to ensure accuracy.

Land Guardian subscribers' title reference numbers are retained for the duration of their subscription to enable ongoing monitoring. Upon cancellation, this data is deleted within 90 days unless retention is required by law.

5. Data Sharing

We share your personal data with the following categories of recipients:

• Agents & sellers — When you enquire about a Listing, your name, email, and phone number are shared with the relevant Agent to facilitate communication.
• Payment providers — We share payment data with our PCI-DSS compliant payment processors (including M-Pesa/Safaricom, our banking partner, and international transfer providers) to process transactions.
• Legal & regulatory — We may disclose data to the ODPC, Kenya Revenue Authority, law enforcement, or courts when required by law or to protect our legitimate interests.
• Service providers — We engage trusted third-party providers for hosting, analytics, customer support, and communication services. These providers process data only on our instructions and are bound by data processing agreements.

6. International Transfers

As a platform serving the Kenyan diaspora, particularly in the United Kingdom, personal data may be transferred between Kenya and the UK. We ensure that all international transfers comply with the requirements of the KDPA and the UK GDPR by implementing appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) for transfers from the UK to Kenya
• Data processing agreements that comply with Section 48 of the KDPA for transfers from Kenya
• Encryption in transit (TLS 1.3) and at rest (AES-256) for all personal data
• Data minimisation principles ensuring only necessary data is transferred

Our primary data processing infrastructure is hosted within secure, SOC 2-certified data centres. Data residency preferences may be available for enterprise and institutional clients upon request.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data — Retained for the duration of your account and for 7 years after account closure (in accordance with KRA record-keeping requirements).
• Transaction data — Retained for 7 years after the transaction date for tax and AML compliance purposes.
• Browsing data — Retained for 24 months, after which it is anonymised or deleted.
• Land Guardian monitoring data — Retained for the duration of the subscription and deleted within 90 days of cancellation.
• Communication records — Retained for 3 years after the last interaction.

8. Your Rights

Under the KDPA and, where applicable, the UK GDPR, you have the following rights:

• Right of access — You may request a copy of the personal data we hold about you.
• Right to rectification — You may request correction of inaccurate or incomplete personal data.
• Right to erasure — You may request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
• Right to data portability — You may request your personal data in a structured, commonly used, machine-readable format.
• Right to object & restrict processing — You may object to processing based on legitimate interest and request restriction of processing in certain circumstances.
• Right to withdraw consent — Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact our Data Protection Officer at dpo@ardhiverified.com. We will respond to your request within 30 days in accordance with the KDPA, or within one month as required by the UK GDPR.

9. Cookies

Our Services use cookies and similar tracking technologies to improve your experience, analyse usage, and support our marketing efforts. We use the following types of cookies:

• Strictly necessary — Required for the Platform to function (e.g., session management, security tokens). These cannot be disabled.
• Functional — Remember your preferences such as language, currency, and saved searches.
• Analytics — Help us understand how users interact with the Platform (e.g., page views, feature usage). We use privacy-respecting analytics tools.
• Marketing — Used only with your consent to deliver relevant advertisements and measure campaign effectiveness.

You can manage your cookie preferences at any time through your browser settings or our cookie consent banner.

10. Children's Privacy

Our Services are not directed at individuals under the age of 18 (or the age of majority in the relevant jurisdiction). We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact our Data Protection Officer immediately. If we become aware that we have collected personal data from a child without verified parental consent, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will notify you by email (to the address associated with your account) and by posting a prominent notice on our Platform at least 30 days before the changes take effect.

Your continued use of the Services after the effective date of any updated Policy constitutes your acceptance of the changes. We encourage you to review this Policy periodically.

12. Contact Our Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, or the Information Commissioner's Office (ICO), UK, if you believe your data protection rights have been violated.