Investor Portal Privacy Policy

DRAFT — pending counsel review (D11/D12). Not yet in force. Do not publish as final.

Last updated: 2026-10-05 (draft)

1. Who we are

The Investor Portal (the "Portal") is operated by [OPERATOR LEGAL NAME AND ADDRESS — to be completed]. For the personal data described in this policy, the Portal operator is the data controller. The Portal is a separate product from SwiftKeja and keeps its own accounts, its own database and its own sign-in. A SwiftKeja account does not sign you in here, and nothing here is shared with SwiftKeja.

2. What this policy covers in this release

This release is the public listings release. It lets visitors browse development projects and lets a developer's staff manage those listings. It does not collect investor records, national ID numbers, KRA PINs, payment details or payment history. If that changes, this policy will be updated and you will be told before any such data is collected.

3. What we collect and why

Visitors (no account). We do not set tracking cookies for visitors and we do not run advertising or analytics trackers. Our servers and the network in front of them may process your IP address transiently to deliver pages and protect the service.

Developer staff accounts. When a developer's staff member creates an account we hold:

• your name and email address;
• your password, stored only as a salted hash;
• session data (a session cookie, when and from where it was created, and a browser identifier string);
• the developer you belong to and your role;
• an audit record of your actions in the admin area (what was done, to which project, when, and your IP address).

We use this to run your account, keep the service secure, rate-limit sign-in attempts, investigate misuse, and keep an accountability trail of changes to listings. Lawful basis: performance of the agreement with your employer and our legitimate interest in security and accountability.

Public project content. Project names, descriptions, locations, unit details, prices, availability and images are supplied by developers and are published on purpose. Do not put personal data of third parties in project content.

4. Cookies

We use one strictly necessary session cookie for signed-in staff, and one preference cookie recording which developer a staff member is working as. Both are first-party, host-only and not used for tracking.

5. Who we share data with

We do not sell personal data. We use these categories of service provider, who process data only on our instructions:

• hosting and database: [HOSTING PROVIDER — D1];
• email delivery for verification and password-reset messages: [EMAIL PROVIDER];
• network protection and caching in front of the site: [CDN PROVIDER, e.g. Cloudflare].

We may disclose data where the law requires it.

6. Where data is stored and international transfers

Portal data is hosted in Germany (EU), via our hosting provider Contabo. Where personal data is transferred outside Kenya, the transfer basis is [TRANSFER BASIS — to be confirmed by counsel under the Data Protection Act, 2019, e.g. adequate safeguards or contractual clauses]. This section will not be finalised until counsel has confirmed the position (D12).

7. How long we keep data

• Account and session data: while the account is active; sessions expire automatically.
• Audit records: [RETENTION PERIOD — to be set], then deleted or anonymised.
• On account closure we delete or anonymise your data unless we must keep it by law.

8. Security

Passwords are hashed, email verification is required, sign-in is rate-limited, access to each developer's data is limited to that developer's members, and the application's back end is not exposed to the public internet. No system is perfectly secure; we will notify the Office of the Data Protection Commissioner and affected people of a breach as the law requires.

9. Your rights

Under the Kenya Data Protection Act, 2019 you may ask to access your personal data, correct it, delete it, object to or restrict processing, and receive a copy of it. To make a request, contact [SUBJECT-ACCESS CONTACT — name, email, postal address]. We will respond within the period required by law. You may also complain to the Office of the Data Protection Commissioner.

10. Changes

We will post changes here and, for material changes, email staff account holders.