Privacy Policy

Privacy Policy

At CleVista Group Limited ("CleVista", "we", "us", or "our"), protecting your privacy is fundamental to everything we do. This Privacy Policy explains in detail how we collect, use, store, share, and safeguard your personal information when you interact with our website, our three divisions — CleVista Estates, CleVista Care, and CleVista Hospitality — and any of our related services across Diani, Ukunda, and Kenya's South Coast.

We are committed to full compliance with Kenya's Data Protection Act (2019), the principles of the EU General Data Protection Regulation (GDPR) where applicable, and all other relevant privacy laws and regulations.

Effective Date: 1 January 2025

Last Updated: 1 January 2025

By using our website, engaging our services, or communicating with our team, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our services and contact us to discuss any concerns.

1. Who We Are (Data Controller)

For the purposes of Kenya's Data Protection Act, the data controller responsible for your personal information is:

CleVista Group Limited
Diani / Ukunda, South Coast Kenya
Email: info@clevistagroup.co.ke
Phone / WhatsApp: +254 796 443 424

If you have any questions about this Policy or want to exercise your privacy rights, you may contact us directly using the details above. We have not appointed a separate Data Protection Officer (DPO) at this time, but our team handles all data protection matters.

2. Information We Collect

We collect several types of information depending on how you interact with CleVista. Below is a detailed breakdown.

2.1 Personal Information You Provide

This includes information you actively give us when you:

• Create an account on our platform
• Submit an enquiry through any listing or contact form
• List a property (as a seller, landlord, or agent)
• Book a stay, retreat, or hospitality experience
• Request a CleVista Care quote or service
• Subscribe to our newsletter or marketing communications
• Submit a review, testimonial, or feedback

Specific data points may include:

• Identity Data: Full name, national ID or passport number (for property transactions), date of birth
• Contact Data: Email address, phone number (including WhatsApp), postal address, country of residence
• Financial Data: Payment details, bank account information, M-Pesa number, remittance confirmations (only when transacting)
• Property Data: Property details you list or inquire about (title deed info, land size, photos, address)
• Hospitality Data: Stay dates, guest counts, dietary preferences, transfer requirements (for Hospitality bookings)
• Communications: Emails, messages, WhatsApp conversations, call notes

2.2 Automatically Collected Information

When you visit our website, we automatically collect:

• Technical Data: IP address, browser type and version, operating system, device type, screen size
• Usage Data: Pages visited, time spent, links clicked, referring URLs, search queries
• Location Data: Approximate geographic location (city/region level, based on IP)
• Cookies & Similar Technologies: See Section 7 below for full details

2.3 Information from Third Parties

We may receive information about you from:

• Advocates and conveyancers coordinating property transactions
• Payment processors and banks (transaction confirmations)
• Social media platforms (if you interact with us through Facebook or Instagram)
• Analytics providers (Google Analytics, Meta Pixel, etc.)

3. How We Use Your Information

We use your personal information for the following lawful purposes, in accordance with the Kenya Data Protection Act:

3.1 To Provide and Improve Our Services (Contractual Necessity)

• Process your property enquiries, listing requests, or viewing arrangements
• Facilitate property purchase, sale, or rental transactions
• Deliver CleVista Care services (site visits, cleaning, landscaping, maintenance)
• Coordinate hospitality bookings, transfers, and curated experiences
• Process payments and issue receipts, invoices, or statements

3.2 To Communicate With You (Legitimate Interest)

• Respond to your enquiries, messages, and support requests
• Send service updates, booking confirmations, and reminders
• Notify you of changes to our terms, policies, or services
• Provide customer support through WhatsApp, email, or phone

3.3 For Marketing (Consent-Based)

• Send newsletters, property alerts, and promotional offers — only if you've opted in
• Personalise property or experience recommendations based on your interests
• Retargeting on social media platforms (Facebook, Instagram)

You can opt out of marketing communications at any time by clicking "unsubscribe" in any email, replying "STOP" to WhatsApp/SMS, or emailing us at info@clevistagroup.co.ke.

3.4 For Legal and Safety Purposes (Legal Obligation)

• Comply with anti-money laundering (AML) and counter-terrorism laws
• Meet tax reporting obligations (KRA, stamp duty)
• Respond to lawful requests from police, courts, or regulators
• Protect the rights, property, and safety of CleVista, our clients, and the public

4. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties. We only share your data in the following limited and necessary circumstances:

4.1 Trusted Service Providers

We share data with carefully vetted partners who help us deliver our services, including:

• Payment processors (M-Pesa, banks, remittance providers) to handle transactions
• Legal professionals (advocates, conveyancers) coordinating property transactions
• Property service providers (contractors, cleaners, landscapers) for Care services
• Hospitality partners (villa owners, transport providers, chefs) for bookings and experiences
• IT and hosting providers who maintain our website and systems
• Analytics providers (e.g., Google Analytics) for website performance

All partners are contractually bound to handle your data only for the purpose we specify and in compliance with Kenya's Data Protection Act.

4.2 Business Transfers

If CleVista Group is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests from:

• Kenya's Data Protection Commissioner
• The Kenya Revenue Authority (KRA)
• The Directorate of Criminal Investigations (DCI) or courts
• Other regulatory or governmental bodies where legally required

4.4 With Your Consent

We share information with potential buyers, sellers, tenants, or landlords to complete a transaction — only when you have explicitly consented to that sharing. For example, when you enquire about a property, we share your contact details with the property owner or agent so they can respond.

5. International Data Transfers

CleVista Group is based in Kenya. If you are accessing our services from outside Kenya — for example, as a diaspora client — your data may be transferred to, stored in, and processed in Kenya.

When we share data with third-party service providers (such as analytics or cloud hosting), we ensure that:

• Transfers are made only to jurisdictions with adequate data protection laws, or
• Appropriate safeguards are in place (standard contractual clauses, encryption)

6. Data Retention

We retain your personal information only as long as necessary to fulfil the purposes outlined in this Policy, or as required by Kenyan law. Our retention periods are:

7. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience and analyse usage. Cookies are small text files stored on your device when you visit a website.

7.1 Types of Cookies We Use

• Essential Cookies: Required for the website to function (login, session management, security). These cannot be disabled.
• Preference Cookies: Remember your settings and language choices.
• Analytics Cookies: Help us understand how visitors use the site (Google Analytics, Meta Pixel).
• Marketing Cookies: Used to show you relevant ads on other platforms. Only set with your consent.

7.2 Managing Cookies

You can manage or disable cookies through your browser settings at any time. Note that disabling essential cookies may affect website functionality. For more information, visit allaboutcookies.org.

8. Your Rights Under the Data Protection Act

Under Kenya's Data Protection Act (2019), you have the following rights:

• Right to be Informed: Know what data we collect and how we use it (this Policy).
• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data where there's no lawful reason to keep it.
• Right to Restrict Processing: Limit how we use your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interest, or to direct marketing.
• Right to Withdraw Consent: Withdraw any consent you've given us at any time.
• Right to Lodge a Complaint: File a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise any of these rights, email us at info@clevistagroup.co.ke with the subject line "Data Subject Request". We will respond within 30 days as required by law.

9. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption: SSL/TLS encryption for all data transmitted through our website (HTTPS).
• Access Control: Only trained team members with legitimate need can access your data.
• Password Protection: Strong password policies with multi-factor authentication for our systems.
• Secure Infrastructure: Trusted hosting partners with regular security updates.
• Staff Training: All team members are trained on data protection obligations.
• Breach Notification: If a data breach occurs, we'll notify affected users and the ODPC within 72 hours as required by law.

However, please note that no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at info@clevistagroup.co.ke, and we will delete such information promptly.

11. Third-Party Links

Our website may contain links to third-party websites (e.g., social media platforms, partner sites, Google Maps). We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of every website you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify you by email if you have an account
• Display a prominent notice on our website

Your continued use of our services after any change constitutes acceptance of the updated Policy.

13. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

CleVista Group Limited
Diani / Ukunda, South Coast Kenya
📧 Email: info@clevistagroup.co.ke
📧 Sales: sales@clevistagroup.co.ke
📞 Phone / WhatsApp: +254 796 443 424

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:

Website: www.odpc.go.ke
Email: info@odpc.go.ke