Privacy notice
Last updated 16 October 2026
Hauzisha Platforms LTD · ICEA Building, Chiromo Road, Nairobi 00100, Kenya · support@hauzisha.co.ke
On this page (19 sections)
This privacy notice is issued by Hauzisha Platforms LTD pursuant to section 29 of the Data Protection Act, 2019 (No. 24 of 2019) (the “Act”) and the Data Protection (General) Regulations, 2021. It sets out how personal data is collected, used, disclosed, retained and protected in connection with leads.hauzisha.co.ke and the Hauzisha Leads application, and the rights available to data subjects under the Act.
1. Interpretation
1.1 In this notice, unless the context otherwise requires:
- “Application” means the Hauzisha Leads mobile application for iOS and Android;
- “Client Business” means a business that has entered into an agreement with the Company for the receipt of enquiries through a website operated by the Company;
- “Company”, “we”, “us” and “our” mean Hauzisha Platforms LTD, a company incorporated in Kenya;
- “Customer” means a person who submits an enquiry, message or call through a website operated by the Company for a Client Business;
- “personal data”, “data subject”, “data controller”, “data processor” and “processing” bear the meanings given to them in section 2 of the Act; and
- “Website” means leads.hauzisha.co.ke and its pages.
1.2 Headings are for convenience only and shall not affect the interpretation of this notice.
2. The data controller
2.1 Hauzisha Platforms LTD, of ICEA Building, Chiromo Road, Nairobi 00100, Kenya, is the data controller in respect of personal data processed through the Website and the Application. Hauzisha Leads is a brand of the Company.
2.2 Where personal data of a Customer is made available to a Client Business, the Client Business determines the purposes for which it uses that data in the conduct of its own business and is, to that extent, an independent data controller responsible for its compliance with the Act.
3. Scope of this notice
3.1 This notice applies to the following categories of data subjects:
- (a) visitors to the Website;
- (b) persons who apply, on their own behalf or for a business, to work with the Company;
- (c) Client Businesses and their directors, employees and technicians who use the Application; and
- (d) Customers.
4. Personal data we process
4.1 Visitors. Information on how the visitor arrived at the Website (campaign parameters, referring website and landing page), which is held in the visitor's browser and is transmitted to us only within an application the visitor elects to submit; and aggregated visit statistics which do not identify any person.
4.2 Applicants. Name, telephone number, email address and role; business name, registration status, years of operation, location, website or social media pages and licences held; and information concerning the services offered, areas covered, staff numbers, capacity, current sources of business, marketing expenditure, budget and preferred payment arrangement.
4.3 Client Businesses and their personnel. Name, telephone number, email address, role (administrator or technician) and the telephone number to which calls are to be routed; device identifiers necessary for notifications (push token, application version and platform); activity within the Application (messages, notes, status changes and assignments); and billing records, including M-Pesa and bank transaction references.
4.4 Customers. Name, telephone number, email address where given, the content of enquiries and messages, any photographs attached, the product or service enquired about, the website used and the means by which it was found; and call records, including the date, duration and outcome of calls and, where applicable, the recording, transcript and summary referred to in clause 6.
4.5 The Company does not intentionally collect sensitive personal data as defined in the Act. Data subjects are requested not to include such data in enquiries or messages.
5. Purposes and lawful basis
5.1 In accordance with section 30 of the Act, the Company processes personal data on the following bases:
- (a) to consider an application and enter into an agreement, being processing necessary to take steps at the request of the data subject prior to entering into a contract;
- (b) to verify the identity, registration and standing of an applicant, being processing necessary for the legitimate interests of the Company in protecting Customers and the integrity of its service;
- (c) to provide the service to a Client Business, including the delivery of enquiries, messages and calls, the recording of calls, notifications and billing, being processing necessary for the performance of a contract;
- (d) to transmit a Customer's enquiry to the Client Business that will respond to it, being processing at the request of the Customer and necessary for the purpose for which the enquiry was made;
- (e) to comply with legal obligations, including obligations relating to taxation and accounting records;
- (f) to understand which pages and campaigns generate applications, being processing in the legitimate interests of the Company, using aggregated statistics; and
- (g) to send marketing communications, only with the consent of the data subject in accordance with section 37 of the Act, which consent may be withdrawn at any time.
5.2 The Company does not sell personal data.
6. Call recording and automated transcription
6.1 Calls between a Client Business and a Customer placed through the Application are connected through a business telephone line provided by the Company, such that the Customer is shown the business line and not the personal number of the Client Business's personnel.
6.2 Such calls are recorded. The Customer is informed, before the call is connected, that the call may be recorded.
6.3 Recordings are transcribed and summarised by automated means to enable the Client Business to review the substance of the call. Summaries are reviewed by natural persons at the Client Business and are not used to make decisions producing legal or similarly significant effects on any data subject.
6.4 Access to recordings, transcripts and summaries is restricted to the administrators of the relevant Client Business, the technician assigned to the enquiry and authorised personnel of the Company where necessary for support, investigation of complaints or compliance with law.
7. The Hauzisha Leads application
7.1 The Application issues notifications of new enquiries, assignments and Customer messages by means of the push notification services of Apple Inc. and Google LLC. Notifications may be disabled in the device settings.
7.2 A technician has access only to enquiries assigned to that technician and the associated Customer data, and has no access to the source of an enquiry or to the data of any other Client Business.
7.3 The data of each Client Business is logically segregated and is accessible only to that Client Business and to authorised personnel of the Company.
7.4 The Application does not access the device's location or contacts.
8. Disclosure to third parties
8.1 The Company discloses personal data only as follows:
- (a) to the Client Business to which a Customer's enquiry relates, and its personnel, in accordance with clause 7;
- (b) to data processors engaged by the Company under written contracts requiring confidentiality and appropriate security in accordance with section 42 of the Act, namely: Cloudflare, Inc. (hosting, database and file storage); Twilio Inc. and Africa's Talking Limited (telephone numbers, call connection and recording); Resend (email delivery); OpenAI (transcription and summaries of call recordings); and Expo, Apple Inc. and Google LLC (delivery of notifications);
- (c) to any authority or person where disclosure is required by law, by order of a court, or is necessary to protect the vital interests of any person; and
- (d) to a purchaser or successor of the business of the Company, subject to equivalent protection.
9. Transfers outside Kenya
9.1 Certain data processors referred to in clause 8 store or process personal data outside Kenya. The Company transfers personal data outside Kenya only in accordance with sections 48 to 50 of the Act and the applicable regulations, on the basis of appropriate safeguards for the security and protection of the data, and limits each transfer to what is necessary for the relevant service.
10. Retention
10.1 In accordance with section 39 of the Act, personal data is retained only for as long as is reasonably necessary for the purpose for which it was collected, as follows:
| Category | Retention period |
|---|---|
| Applications that do not result in an agreement | Twelve (12) months from receipt |
| Contracts, invoices and records of payment | The term of the agreement and not less than seven (7) years thereafter, or such longer period as the law requires |
| Application accounts | Until closure of the account; thereafter erased within thirty (30) days |
| Enquiries, messages and call logs | The term of the client business's agreement and twelve (12) months thereafter |
| Call recordings, transcripts and summaries | Twelve (12) months from the date of the call, save where required for a dispute or by law |
| Aggregated visit statistics | Twenty-four (24) months, in a form that does not identify any person |
10.2 At the end of the applicable period, personal data is erased or anonymised.
11. Security and breach notification
11.1 The Company implements appropriate technical and organisational measures in accordance with section 41 of the Act, including encryption of data in transit, encryption at rest by its hosting providers, authenticated and role-based access to the Application, and records of changes to data.
11.2 Where a personal data breach occurs that poses a real risk of harm to data subjects, the Company shall notify the Data Commissioner within seventy-two (72) hours of becoming aware of it and shall, where required, communicate the breach to the affected data subjects, in accordance with section 43 of the Act.
12. Cookies and local storage
12.1 The Website does not set advertising or tracking cookies. It stores in the visitor's browser a record of the campaign parameters and referring website by which the visitor first arrived, used solely to attribute an application the visitor elects to submit. The visitor may clear this record through the browser settings at any time.
12.2 The visit counter on the Website does not set cookies and does not identify visitors.
13. Rights of data subjects
13.1 Subject to the Act, a data subject has the right to:
- (a) be informed of the use to which their personal data is to be put;
- (b) access their personal data in the custody of the Company;
- (c) object to the processing of all or part of their personal data, including for direct marketing;
- (d) the correction of false or misleading data;
- (e) the deletion of false, misleading or unlawfully obtained data, or data no longer necessary; and
- (f) data portability in accordance with section 38 of the Act.
13.2 Requests may be made in writing to support@hauzisha.co.ke. The Company shall acknowledge a request within seven (7) days and shall respond within the time prescribed by the Act and the regulations, and may require reasonable verification of identity before acting on a request.
14. Account closure and erasure
14.1 A user of the Application may request the closure of their account and the erasure of associated personal data at any time in accordance with the procedure set out at Delete your account, subject to clause 10 and to any retention required by law.
15. Minors
15.1 The Website and the Application are intended for businesses and persons aged eighteen (18) years and above. The Company does not knowingly process the personal data of a child.
16. Automated decision-making
16.1 The Company does not subject any data subject to a decision based solely on automated processing which produces legal effects concerning, or significantly affects, the data subject, within the meaning of section 35 of the Act.
17. Complaints
17.1 A data subject who is dissatisfied with the handling of their personal data is invited to contact the Company at support@hauzisha.co.ke in the first instance. A data subject may also lodge a complaint with the Office of the Data Protection Commissioner under section 56 of the Act (www.odpc.go.ke).
18. Amendments
18.1 The Company may amend this notice from time to time. The date of the latest version appears at the top of this page. Material amendments shall be communicated to users of the Application through the Application or by email.
19. Contact
19.1 Enquiries concerning this notice may be addressed to Hauzisha Platforms LTD, ICEA Building, Chiromo Road, Nairobi 00100, Kenya, or by email to support@hauzisha.co.ke.