This notice explains how Goldstay (a brand of TADCO) collects, uses, stores, shares and protects personal data when you visit this website, contact us, submit a property enquiry, apply to rent a property, or engage us to manage or buy a property on your behalf.

We have written it in plain language on purpose. If anything below is unclear, email us at privacy@goldstay.co.ke and a human will reply.

1. Who we are (the data controller)

The data controller responsible for your personal data is Goldstay, a brand operated by A TADCO Company. Registered correspondence address: Pinetree Plaza, Kindaruma Road, Kilimani, Nairobi, Kenya.

For privacy questions or to exercise any of the rights listed in section 7, contact our Data Protection Office at privacy@goldstay.co.ke.

2. What personal data we collect

We only collect what we need to deliver the service you asked for:

Contact details: name, email, phone / WhatsApp number, country of residence.
Property information: address, neighbourhood, bedrooms, furnishing, availability, photographs, any notes you choose to share.
Tenant application data (only if you apply to rent a property through us): employment and income details, previous landlord references, a copy of your government ID or passport, and optionally a recent bank or M-Pesa statement. This category is treated as more sensitive and is described in more detail in section 6.
Financial and settlement data (only for active landlord clients): bank account details for USD remittance, identity documents required by our banking partners for know-your-customer checks, and transaction records.
Website usage data: pages visited, referrer, device and browser information, approximate location from IP address. This is the ordinary analytics data every website collects; we do not use it to build advertising profiles.

We do not knowingly collect data from anyone under the age of 18. If you believe a minor has submitted data to us, contact the address above and we will delete it.

3. Why we collect it and our lawful basis

Under the Kenya Data Protection Act 2019 we can only process personal data if we have a lawful basis. Ours are:

Your consent: when you submit a form and tick the consent box, or subscribe to any updates. You can withdraw this consent at any time (see section 7).
Performance of a contract: when you sign a management agreement with us, or when you apply to rent a property we operate, we process what is necessary to deliver that agreement (rent collection, remittance, statements, maintenance, licensing, tenant vetting).
Compliance with a legal obligation: tax reporting (KRA in Kenya, GRA in Ghana), anti-money-laundering checks required by our banking partners, rental income reporting, and lawful responses to court orders or regulator requests.
Our legitimate interests: replying to your enquiry, preventing fraud, securing our systems, and improving the service. Where we rely on this basis we balance it against your rights and only use the minimum data necessary.

4. Who we share your data with

We never sell your data and we do not share it with advertisers. We share only what is necessary, only with the parties listed below, and only under written contracts that require them to protect your data to at least the same standard:

Our service providers (sub-processors). Vercel Inc. (website hosting, United States), Airtable Inc. (CRM database, United States), Resend (transactional email, United States), our analytics provider when enabled, and our payment, FX and banking partners in Kenya that handle rent collection and USD remittance.
Legal and professional advisers. Our Kenyan property lawyers, auditors and accountants, bound by professional confidentiality.
Landlords and tenants you are transacting with. If you are a tenant applying for a specific property, we share your verified application with that landlord only after you have consented. If you are a landlord, we share the tenant's verified file with you before you sign the lease.
Tax and regulatory authorities: KRA, county or municipal authorities, the Office of the Data Protection Commissioner (ODPC), and any court where we are legally required to do so.

5. International transfers

Some of our sub-processors store data outside Kenya (for example, Vercel, Airtable and Resend are based in the United States). When we transfer personal data outside the country of origin we do so under the safeguards permitted by the Kenya Data Protection Act 2019, which in practice means either the data subject's explicit consent, contractual safeguards with the processor, or where the transfer is necessary for the performance of your contract with us.

6. Sensitive data on the tenant application

The tenant application form at /apply collects more sensitive categories: a copy of your passport or national ID, employment verification details, previous landlord references and (optionally) a recent bank or M-Pesa statement. We treat this data with stricter controls:

We only ever collect it from tenants we have personally invited by sharing a private link. It is not a public form.
Access inside Goldstay is restricted to the small team that does tenant vetting. Our General Manager reviews access monthly.
The data is retained for 24 months after your application concludes (placed or declined) so we can defend any dispute about the placement, then deleted.
If you are not placed, you can ask us to delete your file immediately, and we will within 30 days.

7. Your rights

Under the Kenya Data Protection Act 2019 you have the following rights in relation to the personal data we hold about you:

The right to be informed about how we use your data (this notice).
The right of access: ask us for a copy of what we hold.
The right to rectification: ask us to correct anything wrong.
The right to erasure (to be forgotten): ask us to delete your data, unless we are legally required to keep it.
The right to restrict or object to our processing.
The right to data portability: receive your data in a commonly used machine-readable format.
The right to withdraw your consent at any time, where consent is our lawful basis.
The right not to be subject to decisions made solely by automated processing that significantly affect you. (We do not make such decisions; tenant grading, for example, is reviewed by a human before it is acted on.)

To exercise any of these rights, email privacy@goldstay.co.ke. We respond within 30 days, as required by the Kenya Data Protection Act 2019, and in most cases within 72 hours.

8. How long we keep your data

Enquiry data (landlord leads, general contact): retained for 24 months from last contact, then deleted or anonymised.
Tenant application data: retained for 24 months after the application concludes, then deleted.
Active management clients: retained for the duration of the management agreement plus seven years after termination, to meet Kenyan tax record-keeping obligations.
Website analytics data: retained for 26 months at the aggregate level, never used to identify you personally.

9. How we protect your data

Access to systems that hold personal data is restricted to staff who need it, protected by unique accounts and two-factor authentication. Data in transit is encrypted over HTTPS. Backups are encrypted at rest. We review access quarterly and revoke it promptly when staff leave. If we ever suffer a personal-data breach that is likely to result in risk to your rights, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours and, where the risk is high, notify you directly.

10. Cookies

We use strictly necessary cookies to keep the site working, and (if and when enabled in Vercel) one analytics cookie to understand which pages are useful. We do not place advertising cookies and we do not share cookie data with ad networks.

11. Changes to this notice

We will update this page when our practices change. The effective date at the top tells you when the current version was published. If a change materially affects your rights, we will contact you by email before it takes effect.

12. How to complain

We would rather hear from you first so we can fix a problem, but you have the right to complain directly to the Office of the Data Protection Commissioner (ODPC) at any time. Complaint portal: https://complaints.odpc.go.ke.

Privacy notice