Privacy policy
How HAUS handles personal data: for the companies that use it, for the owners and residents of the units it covers, and for anyone signed in at a gate.
Last updated 19 October 2026
1.Who we are
HAUS is property and building-access software operated by Go Make Real Estate LTD, 4th Floor, Laiboni Center, Nairobi, Kenya (registration PVT-KW13QOZM). This policy is written under the Data Protection Act, 2019 (Kenya).
- For people with an account (owners, managers and security staff), we are the data controller for the account itself.
- For the records a customer keeps in the system (units, residents, tenancies and the visitor register), the management company or property owner using HAUS is the data controller and we are their data processor. We act on their instructions.
- For our own billing records (what we invoice a customer and what they pay), we are the data controller.
If you are a resident or a visitor and want your details corrected or removed, contact the management company that runs your building. You can also write to privacy@haus.africa and we will pass the request on and help them carry it out.
2.What we collect
| Who | What we collect | Where it comes from |
|---|---|---|
| Account holders | Name, email address, phone number, role, the properties you are assigned to, and your password (stored in a form that cannot be read back). | You, or the person who set up your account. |
| Owners and residents | Name, email address, phone number, postal address, identity document type and number, the unit you are linked to, and tenancy and payment records. | The management company. |
| Visitors | Name, phone number, email address, nationality, identity document type and number, vehicle registration, items declared on entry, the unit visited, and arrival and departure times. Where the building asks for them, answers to its own questions and photographs taken at the gate, which may include a photograph of your identity document. | You, at the gate, and the resident who invited you. |
| People who accept house rules | When the rules were opened and accepted, the language chosen, and the IP address and browser used. | Your device, when you accept the rules. |
| People issued an access pass | Name, role, the unit, the dates the pass is valid and its reference, and contact details where the building has provided them. | The building. |
| Customers we bill | Billing contact name and address, invoices, amounts paid and payment references. We do not hold card numbers or bank credentials. | Your account, and the payment reference you give us. |
| Everyone who uses the service | Technical records such as IP address, browser type and the time of each request, and records of messages sent to you. | Generated when you use the service. |
Giving a visitor’s details at a gate is a condition of entry set by the building. If you do not provide them, the building may refuse entry.
Each building decides, as controller, which of these details it asks for, and may add questions of its own. A building that photographs identity documents makes that decision itself and must have a lawful reason for it. It must tell you that the photograph is being taken, why, and how long it is kept, before it is taken.
3.Why we collect it, and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service to the customer who signed up, and keeping the records they enter. | Performance of a contract. |
| Recording who enters a building, for the safety of the people who live and work there. | Legitimate interests of the building. |
| Keeping an access register where a building is required to by law, lease or regulator, and keeping our own accounting records. | Compliance with a legal obligation. |
| Optional features a customer chooses to switch on, such as connecting third-party devices or calendars. | Consent. |
We do not sell personal data, we do not use it for advertising, and we do not use it to build profiles of anybody.
4.Who we share it with
Within a building, people see only what their role requires. A management company sees the records for its own properties.
We use service providers to run HAUS, in these categories:
- Cloud hosting and database providers.
- Email and SMS delivery providers.
- Automated text-processing providers, used for features such as translating documents and drafting text. A person checks the result.
- Device and calendar providers, only where a customer has connected them.
- Apple Wallet or Google Wallet, only if you choose to add a pass to your phone.
Each provider is bound by contract to use the data only to provide its service to us. A list of the providers we use is available on request from privacy@haus.africa. We will disclose data to a public authority where the law requires it.
5.Transfers outside Kenya
Some of our service providers store or process data outside Kenya. Under sections 48 and 49 of the Data Protection Act, 2019 (Kenya) we rely on the transfer being necessary for the performance of a contract, together with contractual safeguards that bind each provider to protect the data.
6.Automated decisions
We do not make decisions about you by automated means that have a legal or similarly significant effect, within the meaning of section 35 of the Data Protection Act, 2019 (Kenya). Where automated tools are used to help enter or translate information, a person reviews the result.
7.How long we keep it
| What | How long |
|---|---|
| The visitor register | As long as the building decides, as controller. Deleted on its instruction or when its account closes. |
| Photographs taken at the gate, including of identity documents | Deleted 7 days after the visitor signs out. A visit that is never signed out keeps its photographs until it is. The written register is kept as above. |
| House-rule acceptances and access passes | Kept with the visit or pass they belong to. |
| Unit, tenancy and financial records | For the life of the customer's account, and any further period the customer must keep them for tax or audit. |
| Our invoices and receipts | Seven years from the end of the tax year they fall in, as tax law requires. These cannot be deleted on request. |
| Account logins | Until the account or login is removed. |
| Backups | Up to 30 days after deletion. |
8.How we protect it
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access limited by role and by property, and separation between customers.
If a breach is likely to result in a risk to you, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of it and notify affected customers without undue delay.
9.Children
The service is not for use by children and no account may be created by one. Children arriving at a gate with an adult may be counted, but are not asked for an identity document, and buildings are told not to photograph a child’s documents.
10.Cookies
We use one strictly necessary cookie to keep you signed in. We do not use analytics, advertising or tracking cookies.
11.Your rights
Under the Data Protection Act, 2019 (Kenya) you have the right to be informed of how your data is used, to access it, to object to its processing, to have it corrected or deleted, and to receive it in a portable form.
For records held by a building, contact its management company, which is the controller. For your own account, or if you cannot reach the management company, write to privacy@haus.africa. We will respond within 30 days.
A request may be refused where the law allows, for example where a building has a legitimate reason to keep its access register or where we must keep accounting records. If we refuse, we will give the reason.
You may complain to the Office of the Data Protection Commissioner (ODPC) (https://www.odpc.go.ke). Our registration is registration pending.
12.Changes to this policy
We will notify account holders by email before a material change takes effect, and the date at the top of this page will change.
13.Contact
Go Make Real Estate LTD
4th Floor, Laiboni Center, Nairobi, Kenya
privacy@haus.africa
See also our terms of use.