MySpace Africa Ltd — CMS Property Management Platform
13th August 2026
Kenya DPA 2019 & Art. 31
1.0
01
MySpace Africa Ltd is fully committed to protecting personal privacy under Article 31 of the Constitution of Kenya (2010) and the Data Protection Act (No. 24 of 2019). This policy governs how personal and property records are collected, processed, stored, and safeguarded across the CMS Property Management Platform.
02
Identity & Contact Data: Full names, national ID/passport numbers, phone numbers, and email addresses of property owners, managers, and tenants.
Financial & Transaction Data: Rent invoices, payment receipts, M-Pesa transaction references, bank transfer confirmations, and billing ledger entries.
Technical & Usage Metadata: IP addresses, browser fingerprints, session timestamps, device identifiers, API audit logs, and access records.
03
Authenticate users and manage secure platform access via RBAC and MFA.
Automate rent billing cycles, invoice generation, and payment reconciliation.
Dispatch critical SMS/email notifications, payment reminders, and financial statements.
Safeguard the platform against fraud, unauthorized API access, and cyber threats.
04
The Client (Property Owner / Manager) acts as the Data Controller and is responsible for obtaining lawful consent from tenants prior to uploading personal records. MySpace Africa Ltd acts as the Data Processor, processing data solely under documented, verified instructions from the Client, in accordance with the Data Protection Act (2019).
05
All data is protected with AES-256 encryption at rest and TLS 1.3 in transit. Systems are hardened with Role-Based Access Controls (RBAC), rate limiting, IP filtering, and automated daily backups stored in ISO-certified, tier-3 cloud datacentres. Security patches are applied during off-peak maintenance windows.
06
We do not sell, rent, or trade your data. Data is shared strictly with licensed infrastructure providers and SMS gateway operators solely to execute platform operations. Disclosure to regulatory or law enforcement authorities occurs only where mandated by Kenyan statutory law or court order.
07
Right to Access: Request a copy of all personal data held in our systems.
Right to Rectification: Request correction of inaccurate or incomplete records.
Right to Erasure: Request deletion of personal records subject to statutory KRA tax retention (up to 7 years for financial ledgers).
Right to Objection: Restrict or object to unlawful processing of your data at any time.
08
Data is retained for the duration of the active subscription agreement and as required by Kenyan tax and statutory law (Kenya Revenue Authority mandates financial record retention of up to 7 years). To exercise your data rights, contact our Data Protection Officer directly at the address below.