Last updated: 2026.

This policy explains what personal data Bright Edge Agency collects when you use our website, contact us, or work with one of our agents, how we use that data, who we share it with, and the choices you have. We process personal data in line with Kenya's Data Protection Act, 2019.

1. What We Collect

Contact and inquiry details. Name, email, phone number, and message content submitted through inquiry, contact, or newsletter forms.

Account information. If you create an account, your email address and any profile fields you provide.

Server logs. Standard technical logs (IP address, browser type, pages visited, timestamps), used for security and to keep the site running.

Identity verification documents. For buyers and tenants moving toward a signed offer or lease, we collect ID or passport details to confirm identity. We do not require this at the initial inquiry stage.

Financial information. Where a purchase involves mortgage pre-qualification, we collect income and bank statement information directly from you and pass it only to the specific lender you're working with. We don't use it for any other purpose.

Call and WhatsApp records. We may record calls for training and dispute-resolution purposes; you'll be told this at the start of a recorded call. WhatsApp inquiry threads are kept as part of your inquiry record.

CCTV footage. Our offices and accompanied viewings use CCTV for security. Signage is posted where cameras operate.

Location data. If you opt in to alerts for listings near you, we use the location your device or browser shares with your permission. We never collect this without your explicit consent.

2. How We Use It

To respond to inquiries and arrange viewings.
To send service updates about properties you've asked about.
To send our newsletter, only if you've opted in.
To match you with relevant listings and, where you've asked us to, to share your inquiry with the landlord or seller of a specific property.

3. How Agent Access to Your Data Works

Your inquiry is visible to the agent assigned to it, and to agency management for oversight and quality purposes.

Agents work within our system and do not export lead data to personal devices, spreadsheets, or personal email. When an agent leaves the agency, their active leads are reassigned to another agent rather than remaining with the departing agent, and the underlying data stays in our system.

Each agent has their own individual login rather than a shared account, which lets us keep a record of who accessed a given lead's data and when.

4. Agent Conduct

Agents handling your data are expected to act honestly and in your interest. This includes not falsifying inquiries, not diverting or "poaching" leads for personal gain outside the agency's systems, and not sharing your data outside the scope of helping you find or list a property.

A first breach is addressed directly with the agent and may result in a formal warning; repeated or serious breaches, including data misuse or dishonest handling of client information, can lead to suspension or termination, and where warranted, a report to the Institution of Estate Agents Kenya (IEAK).

Clients and staff can report suspected misconduct in confidence by emailing info@brightedgeagency.co.ke marked for the attention of agency management.

All agents are briefed on these expectations and on how to handle client data responsibly as part of onboarding.

5. How Long We Keep Data

Inquiry data is kept for 24 months after a property is sold or rented, then deleted, except where a transaction record must be kept longer to meet Kenyan tax and accounting requirements.
Inactive agent profiles are kept for 12 months after an agent leaves, then deleted or anonymized.
Server logs are kept for 90 days.
If you delete your account, we delete your account data, other than records we're required to retain for a completed transaction or an active legal matter, which we keep only for as long as the law requires.

6. Security

We take reasonable technical and organizational measures to protect your data:

Data is encrypted at rest in our database (Supabase).
All traffic to and from the site is encrypted in transit (HTTPS/SSL).
Access to client and lead data is role-based; staff and agents see only what's relevant to their work.
We maintain an internal incident response process: if a breach occurs, we contain it, assess the risk to affected individuals, and notify the Office of the Data Protection Commissioner and anyone affected where the breach is likely to cause harm, in line with the Data Protection Act.

7. Third Parties We Work With

We don't sell your data. We share it only with the agent handling your inquiry and with the infrastructure providers strictly necessary to run the site and our services, such as database hosting, website hosting, and email delivery.

We do not currently use third-party analytics or advertising trackers, and we do not process payments through the platform; commission and rental payments are handled directly between the parties involved, outside our systems.

Each provider processes data only as needed to deliver their service to us, under their own security and data protection terms.

8. Your Rights

Under the Data Protection Act, 2019, you have the right to:

Access the data we hold about you.
Correct inaccurate data.
Request deletion of your data, except where we're required to keep it, for example, records of a completed transaction or data under an active legal or regulatory hold.
Object to certain processing, such as being removed from marketing communications at any time.
Request a copy of your data in a portable format. As a small agency, we currently handle this manually rather than through an automated export tool, but we will provide it on request.

To exercise any of these rights, email info@brightedgeagency.co.ke. We aim to respond within 30 days.

9. Kenya Data Protection Act, 2019 Compliance

Bright Edge Agency processes personal data as a data controller under the Data Protection Act, 2019, and complies with the registration and operating requirements that apply to a business of our size. If you'd like confirmation of our current ODPC registration status, contact us at the email above.

Given our current scale, we have not appointed a dedicated Data Protection Officer, as this is not yet required under the Act's thresholds. Data protection queries are handled directly by agency management.

Some of our service providers, including our hosting and database providers, may store data on servers outside Kenya. Where this happens, we rely on the security and contractual safeguards those providers maintain, consistent with the Act's requirements for cross-border transfers.

Contact

Questions about this policy, or to exercise any of the rights above: info@brightedgeagency.co.ke

Privacy Policy