Privacy notice

Who we are

Ardhi Point Valuers Limited, of Greenspot Towers, Eastern Bypass, Ruiru, Kiambu County, Kenya, is the data controller for the personal data described in this notice.

For any question about this notice or your data, write to [email protected].

What we collect

Through the valuation request form we collect:

• Property details: type, county and area, title or LR number if you give it, land and building sizes, a description, the purpose of the valuation, who is instructing and your preferred completion date.
• Documents you choose to upload, such as titles, deed plans, building plans, photographs and rent rolls.
• Your name, organisation and role, email address, phone number and preferred contact method.
• Your privacy acknowledgement, your consent for uploaded documents and whether you want updates from us.
• Through the general enquiry form: your name, email address, phone number, subject and message.
• Technical data such as your IP address and browser type, and analytics data if you accept analytics cookies.

Sensitive data and other people's data

Property details and some documents may be sensitive personal data under the Act, for example where a title or rent roll reveals a person's property details, marital status or family details.

Documents can also contain other people's personal data, such as co-owners, tenants or family members. Please upload them only if you are entitled to share them with us for the valuation.

Why we use it and on what lawful basis

• To respond to your enquiry and prepare a quotation. This is a step you ask us to take before entering into a contract.
• To carry out a valuation you instruct us to do. This is necessary to perform our contract with you.
• To meet our legal and professional obligations under the Valuers Act and the rules made under it, including keeping records of our work.
• To keep the site and forms secure and prevent abuse. This is in our legitimate interest.
• To send you updates and to run analytics. We do this only with your consent, which you can withdraw at any time.

Who receives it

We do not sell personal data. We share it only with:

• Our valuers and staff who handle your enquiry or instruction.
• Service providers who host the site and our API, deliver email, store backups and protect our forms. They act on our instructions under written agreements.
• Lenders, advocates or public bodies, but only where you instruct us to share with them or the law requires it.

Transfers outside Kenya

Our API and form data are hosted with Truehost. Some of our other providers may process data outside Kenya:

• Cloudflare, which hosts the website, protects our forms with Turnstile, provides cookieless web analytics and stores our encrypted backups.
• Resend, which delivers our email.
• Google, which provides Google Analytics 4 if you accept analytics cookies.

Safeguards for transfers

Where data is processed outside Kenya, we rely on appropriate safeguards as the Act requires, such as contractual protections with the provider.

Sensitive personal data in uploaded documents is transferred outside Kenya only with your consent. The valuation request form asks for that consent before you upload.

How long we keep it

We keep personal data for the periods below, then delete or anonymise it.

• Enquiries and quotations that do not lead to an instruction: kept only as long as we need them to deal with the enquiry and keep a record of it, then deleted.
• Uploaded documents: deleted automatically 90 days after the request is closed or the report is delivered.
• Instruction files, including the valuation report and working papers: kept for as long as our professional and legal obligations require.

Security

• Uploaded documents are stored privately and are not publicly accessible.
• Backups are encrypted.
• Access is limited to authorised staff who need it.
• Documents are downloaded through short-lived links.

Data breaches

If a personal data breach poses a real risk of harm, we will report it to the Data Commissioner within 72 hours of becoming aware of it, and tell the people affected where the Act requires.

Your rights

Under the Act you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• have inaccurate or misleading data corrected;
• have data deleted where we no longer have a lawful reason to keep it;
• object to processing;
• ask us to restrict processing;
• receive your data in a structured, commonly used and machine-readable format, and have it sent to another controller;
• withdraw consent at any time, without affecting processing that took place before;
• complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Exercising your rights

To exercise any of these rights, write to [email protected]. We may ask you to confirm your identity before we act on the request.

Automated decisions

We do not make decisions about you based solely on automated processing. A registered valuer prepares and signs every valuation.

Changes to this notice

We may update this notice when our services, providers or the law change. The date at the top shows when it was last updated.