Introduction
Coral Property International Ltd is the leading real estate agency specializing in managing, leasing, property valuation and selling of properties in Kenya.
Coral Property International respects your privacy, and we are committed to protecting your privacy through our compliance with this Privacy Notice. We will only collect personal information, and process as described in this Policy and in accordance with the Kenyan Data Protection Act,2019 and subsequent regulations as amended from time to time.
In this Privacy Notice, we have referred ourselves as ‘Coral Property’, ‘We’, ‘Our’ or ‘Us’. An individual who is the subject of personal data is referred to as ‘Client’, ‘Customer’, ‘Visitor’ or ‘You’.
This Policy covers the processing of data that you have provided to us directly, or data that we collect about you from third parties whenever we do so.
This Privacy Notice applies to customers, prospective customers, website and office visitors, employment applicants, suppliers, contractors and other third parties whose Personal Data we process. Personal Data relating to current and former employees is addressed separately in Coral’s Employee Privacy Notice.
Information we collect from you
Coral Property International Ltd is the leading real estate agency specializing in managing, leasing, property valuation and selling of properties in Kenya.
Coral Property International respects your privacy, and we are committed to protecting your privacy through our compliance with this Privacy Notice. We will only collect personal information, and process as described in this Policy and in accordance with the Kenyan Data Protection Act,2019 and subsequent regulations as amended from time to time.
In this Privacy Notice, we have referred ourselves as ‘Coral Property’, ‘We’, ‘Our’ or ‘Us’. An individual who is the subject of personal data is referred to as ‘Client’, ‘Customer’, ‘Visitor’ or ‘You’.
This Policy covers the processing of data that you have provided to us directly, or data that we collect about you from third parties whenever we do so.
This Privacy Notice applies to customers, prospective customers, website and office visitors, employment applicants, suppliers, contractors and other third parties whose Personal Data we process. Personal Data relating to current and former employees is addressed separately in Coral’s Employee Privacy Notice.
| Data Subject | Data Collected | Purpose | Legal Basis |
|---|---|---|---|
| Customers | • Full names • ID number, ID, KRA Pin • Contact Info (Phone Number, Email) • Location Pin, Physical address • Property Preferences, Budget and source of funds. • Caretakers, Tenant's or other parties’ information • Email trails & WhatsApp messages | • Registration and Onboarding • Property matching • Co-ordinate viewings, sending reports. • Communication, sales and Marketing • Service Provider Coordination and Maintenance Requests | • Performance of Contract • Legal obligation |
| • Full names & Business details • KRA Pin, Occupation, employment details including Job title • Source of funds with supporting documentation • Property Ownership | • Client KYC, due diligence and compliance with Anti-money laundering, Terror Financing and other regulatory requirements. | • Legal Obligation | |
| • Copy of Title • Property Ownership Details • Property Photos • Deed Plans and Leases | • Property Listing Intake • Property valuation reports | • Performance of Contract | |
| • Name and Property details. • Offer Amount, Invoices, Payment Schedules, outstanding Balance and records. • Bank Details (if applicable) • ID/Passport number, • Advocate contact details | • To manage offers and Negotiation. • Commission tracking • Tracking Payment • Rent Collection & Tracking • Debt Recovery | • Performance of Contract • Legal obligation |
|
| • Full Names | • To organize viewing | • Legitimate interest | |
| • Client Feedback & Testimonials | • Enhance and improve internal operations • Publication of identifiable testimonials | • Legitimate interest • Consent |
|
| • Location Pin • Survey Maps • Architectural Design & Floor plan | • Property Valuation • Site inspections | • Performance of Contract | |
| Visitors | • Full name, Purpose for visit, employer name and designation | • Office security | • Legitimate interest |
| • CCTV footage | • Security monitoring, • incident investigation | • Legitimate interest | |
| Employment Candidates | • Full Names, ID No. email, Mobile phone number • CV, application letter, qualifications, references, • Contact Info, • Interview notes, Salary expectations • References | • To assess suitability for open roles • Co-ordinate interviews and other communication. • Obtain referee feedback | • Legitimate interest • Consent |
| Suppliers Proprietors, Directors and contact persons | • Company name • Business registration certificate | • Business verification • contract execution | Legal Obligation |
| • Email and Phone number. • Title, role or position | • Supplies co-ordination • Communication | Performance of Contract | |
| • KRA Pin, • Bank Details, MPESA Details • Invoices, credit notes and financial information | • Payment processing and reconciliation • regulatory compliance | Legal obligation |
Lawful Basis for processing your information
We will process your personal data based on either one of the following lawful bases:
- Performance of our contract
- Our legitimate interests
- Consent
- Compliance with legal obligations
- For the purposes of historical, statistical analysis and research.
Where Coral relies on consent as the lawful basis for a specific processing activity, consent will be freely given, specific, informed and unambiguous. You may withdraw your consent at any time by contacting dpo@coralpi.com. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal and will apply on a prospective basis. This means that withdrawal will be effected in respect of future publications or processing activities but may not require the removal of Personal Data that has already
been lawfully published or incorporated into materials prior to such withdrawal.
Your Data Protection Rights
Under applicable data protection laws, you have rights in relation to your Personal Data. These rights are subject to applicable legal requirements and limitations and may include:
- Right to be Informed: You have the right to be informed about how and why we collect and process your Personal Data.
- Right of Access: You have the right to request access to the Personal Data we hold about you and to obtain information about how it is being processed.
- Right to Rectification: You have the right to request correction of Personal Data that is inaccurate, incomplete, outdated or misleading.
- Right to Erasure: You have the right to request deletion of your Personal Data where the applicable legal requirements for deletion are met.
- Right to Restrict Processing: You may request that we restrict the processing of your Personal Data in certain circumstances.
- Right to Object: You have the right to object to the processing of your Personal Data in certain circumstances, including where processing is based on legitimate interests or for direct marketing purposes.
- Right to Data Portability: Where applicable, you have the right to request Personal Data you have provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another organisation where technically feasible.
- Rights relating to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects, subject to applicable legal exceptions.
- Right to Withdraw Consent: Where we rely on your consent as the lawful basis for processing your Personal Data, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing undertaken before your consent was withdrawn.
Exercising Your Rights
If you wish to exercise any of these rights, please submit your request to our Data Protection Officer at dpo@coralpi.com.
We may request information reasonably necessary to verify your identity before processing your request. This is a security measure designed to prevent Personal Data from being disclosed to an unauthorised person. These rights are subject to applicable legal requirements and limitations. Where Coral is unable to fulfil a request in whole or in part, we will explain the reason for our decision where required by law.
Retention period
We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. However, we may retain your data for a longer period if required by government regulations or legal obligations.
The key factors that we will use to determine the time it takes before we delete or anonymize your data include legal requirements and compliance with regulatory requirements as well as our business needs.
Anonymised data that can no longer be linked to you may be retained indefinitely for research, statistical, or
analytical purposes.
Sharing your personal data
We will share your personal data only in accordance with data protection legislation and with respect to customer confidentiality.
The following are circumstances where we may have to share your personal data with third parties:
- Landlords and developers of properties you have expressed interest in viewing.
- Professional advisers, including lawyers, auditors, accountants, valuers and other professional
service providers, where necessary for the provision of their services; - Sub-processors and Vendors we use to manage and optimise our internal operations. As these may change from time to time, you can reach to us if you require more information.
- Where obliged by law, we will share some personal data with the Government, law and enforcement agencies, or regulatory bodies. Where possible, we make this anonymous and only share statistics.
- With your consent: When your consent is required for transferring personal data to third parties, we will explain this clearly in simple language so that you can make an informed decision. We will never share your information if it is not legal to do so, and will always consider your rights, and whether there is another way of achieving our aim, before doing so.
Sharing your personal data outside the Republic of Kenya
We generally store and process your Personal Data within Kenya. Where Personal Data is transferred outside Kenya, Coral will ensure that the transfer is undertaken in accordance with applicable data protection laws and that appropriate safeguards are in place to protect your Personal Data. These may include appropriate contractual safeguards, assessment of the level of protection afforded in the destination country, or another transfer mechanism permitted by law.
Where sensitive personal data is transferred outside Kenya, Coral will comply with any additional requirements applicable to such transfers.
How we keep your data safe
We implement appropriate technical, organisational and physical measures to protect Personal Data against unauthorised access, loss, misuse, alteration or disclosure. Some of our measures include:
- Safeguarded Access to our premises
Our premises are equipped with access control systems utilizing biometric technology to enhance security by restricting entry to authorized personnel only. - Password Protection
We take every measure to safeguard your data, including password protection and enforcing entry control to storage rooms where your personal information is stored. - Secure Paper Data Storage
Even when data is stored on paper, it is kept securely locked away, with limited access to authorized personnel only. We also make sure that any paper waste that contains personal and sensitive personal data is appropriately disposed. - Regular Data Backups
Data is backed up regularly to ensure its availability in case of system failures or disasters. These backups are stored securely, and only authorised personnel have access to them. - Empowered Staff for Data Protection
Our team is trained in handling personal data appropriately to prevent data breaches, ensuring your information is in safe hands.
How we use Cookies
We employ cookies to gather insights regarding your interaction with our website. Further details can be found
in our Cookie banner on our website https://coralpi.com.
How to contact us
If you have a concern about how we process your Personal Data, please contact our Data Protection Officer at dpo@coralpi.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).
Amendments to this Privacy Notice
We may change, modify, or adopt a new Privacy Notice from time to time. You can access the most current
version of the privacy statement via our website.
