Privacy notice
In short: we collect the minimum we need, we tell you why, we never sell your details, and scanned identity or number-plate images are processed in memory and discarded immediately — they are never stored.
This notice explains how MtaaSmart Kenya (“MtaaSmart”, “we”, “us”) collects and handles personal data, in line with the Kenya Data Protection Act, 2019 and the regulations of the Office of the Data Protection Commissioner (ODPC). It covers both this website and the MtaaSmart platform as deployed at an estate.
1. Who is responsible for your data
For enquiries submitted through this website, MtaaSmart is the data controller. You can reach us at info@mtaasmart.africa, Nairobi, Kenya.
When MtaaSmart is deployed at an estate, the estate’s property management company or residents’ association is normally the data controller for resident and visitor records, and MtaaSmart acts as a data processor on its documented instructions. Your estate’s own privacy notice governs that relationship.
2. What we collect, and why
- Enquiry form
- Your name, work email, phone or WhatsApp number, the role you selected, your estate or development name, its approximate size, your current access-control method, and anything you write in the message field. We use this solely to respond to your enquiry, arrange a demo, and prepare a gatehouse audit or quote.
- Estate deployments — residents
- Name, unit, contact details and the access permissions the estate assigns you. Used to issue visitor passes, deliver announcements and emergency alerts, and administer levies and bookings.
- Estate deployments — visitors
- The minimum identification the estate requires at the gate: name, an extracted vehicle registration string, and a redacted identity reference. We record the entry and exit event so the estate has a lawful access audit trail.
- Website usage
- This site sets no advertising or analytics cookies and embeds no third-party trackers. Your browser stores a single local preference (
ms-theme) recording whether you chose the light or dark theme; it never leaves your device and identifies no one. Our hosting provider keeps standard server logs for security and abuse prevention.
3. Images are never stored
Where the gatehouse app scans a National ID, driving licence or number plate, the image is held in the device’s memory only for as long as it takes to extract the text, and is then discarded. Images are never written to a photo gallery, to device storage, or to our cloud. We keep the extracted registration string and a redacted identity reference — never a copy of the identity document itself.
4. Lawful basis
- Consent — for enquiries you submit through this website, which you give by ticking the consent box.
- Performance of a contract — to deliver the platform to an estate that has engaged us.
- Legitimate interests — securing our systems and preventing abuse, balanced against your rights.
- Legal obligation — where Kenyan law requires us to retain or disclose records.
5. Who we share it with
We do not sell your personal data, and we do not share it for advertising. We disclose it only to: the estate or property manager your enquiry relates to, where that is the point of your enquiry; service providers who host and operate the platform under contract and on our instructions; and public authorities where the law compels disclosure.
6. Security
Personal data is encrypted in transit (TLS) and at rest. Access is role-based and restricted to the estate a record belongs to, so no estate can see another’s data. Access to production data by our staff is limited to what is needed to run and support the service.
7. Breach notification
We maintain a documented incident-response process. Where a personal-data breach is likely to result in real risk to affected people, we notify the ODPC within 72 hours of becoming aware of it, and we notify the estate and, where required, the affected individuals.
8. How long we keep it
Enquiry details are kept for up to 24 months from our last contact with you, unless you ask us to delete them sooner. Estate access logs are retained for the period the estate sets in its own retention policy, after which they are anonymised or deleted. We do not keep data simply because we can.
9. Your rights
Under the Kenya Data Protection Act you have the right to be informed about how your data is used; to access it; to have inaccurate data corrected; to have data deleted where there is no lawful reason to keep it; to object to processing; and to receive your data in a portable form. Where processing relies on consent, you may withdraw it at any time — that does not affect processing carried out before you withdrew.
To exercise any of these, email info@mtaasmart.africa. We will respond within the statutory timeframe. If we hold your data as a processor for an estate, we will pass your request to that estate and support it in responding.
10. Complaints
If you believe your data has been mishandled, please raise it with us first — we would rather fix it. You also have the right to complain directly to the Office of the Data Protection Commissioner (Kenya).
11. Changes to this notice
If we change how we handle personal data, we will update this page and the “last updated” date above. Material changes affecting existing enquirers or estates will be communicated directly.