Privacy Policy

1. Who we are

Fundi Concierge Ltd., a company incorporated in the Republic of Kenya (company registration number to be confirmed), trading as Fundi Concierge and operating the Fundi Plus application (“Fundi Concierge”, “we”, “us”, “our”), is the data controller responsible for the personal data described in this Policy.

• Registered office: Nairobi, Kenya (full registered office address to be confirmed)
• ODPC data controller registration: application in progress with the Office of the Data Protection Commissioner
• Contact for privacy matters / Data Protection contact person: dpo@fundiconcierge.com

This Policy explains what personal data we collect, why, the lawful basis on which we process it, who we share it with, how long we keep it, how we protect it, and the rights you have under the Data Protection Act, 2019.

It applies to our website (fundi.plus), our app (Fundi Plus), and all related services. It should be read together with our Terms of Use.

2. The personal data we collect

Depending on how you interact with us, we collect the following categories of personal data.

• Identity and contact data: your name, phone number, email address, and account login details.
• Property and location data: your property’s physical address, map pin/geolocation, property type, age, features and contents you tell us about, access arrangements (for example, whether a gardener or guard may admit a technician), and the identity of any authorised person you designate. Because “property details” are classified as sensitive personal data under the Act, we apply enhanced protections to this category.
• Inspection and job data — including photographs and video: images, video, and written findings recorded during inspections and jobs; property-health scores; the works requested and performed; recommendations; and your property history and timeline.
• Recordings of visits and calls: audio (as a minimum standard) and, where you consent, video/photographs of service visits, and recordings or logs of calls and messages relating to your jobs. These are used for safety, quality, dispute resolution, and record-keeping (see Section 6).
• Payment and transaction data: membership tier, quotations, invoices, deposits, payment status, and history. Payments are processed by Paystack; we do not store your full card or bank details — those are handled by the payment provider.
• Communications data: messages you send us through the App, WhatsApp, email, or phone, and our correspondence with you.
• Technical and usage data: device type, app version, IP address, log data, and how you use the Platform, collected to operate, secure, and improve it.

We may also process limited data about third parties you tell us about (for example, an authorised person who will admit a technician). If you provide someone else’s data, you confirm you may lawfully do so and that they are aware of this Policy.

3. How we collect your data

We collect data: (a) directly from you, when you create an account, register a property, book a job, communicate with us, or make a payment; (b) automatically, when you use the Platform (technical/usage data); and (c) generated by us, when our technicians inspect your property and record findings, photographs, video, and audio.

4. Why we process your data, and our lawful basis

We only process personal data where the Act permits it. Our purposes and lawful bases (under Sections 25, 30, and 37 of the Act) are:

Where we rely on consent, you may withdraw it at any time (see Section 9). Withdrawing consent does not affect processing carried out before withdrawal, and we may be unable to provide certain services without the minimum data and recording needed to deliver them safely.

5. Marketing and communications

We will only send you marketing communications where you have opted in, and you can opt out at any time — using the unsubscribe link, your in-App settings, replying STOP to messages, or contacting us. Service and transactional messages (for example, appointment confirmations, quotations, emergency updates) are not marketing and will continue while you hold an account.

6. Recordings, photographs, and video — how we handle them

Given the sensitivity of recording inside people’s homes, we apply specific rules:

• Notice and consent. You are told about recording at the point of booking and consent to audio as a minimum condition of service. Video/photographic recording is captured where you consent to it. Our technicians are also informed that visits may be recorded.
• Purpose limitation. Recordings and images are used to document the scope and quality of work, protect the safety of both members and technicians, resolve disputes (including pre-existing-damage disputes), and maintain your property record. We do not use them for unrelated purposes.
• Access controls. Recordings and inspection images are stored securely with restricted, role-based access. Technicians see only the information for the property they are attending, and only for the relevant period.
• Retention. We keep recordings and images for the duration of your membership plus 24 months, or as required for a live dispute or legal claim, then delete or anonymise them.
• Withdrawing consent. You may decline or withdraw consent to video/photographic recording; we will honour this going forward, though it may limit the services we can safely provide or our ability to assess a later claim.

7. Who we share your data with

We share personal data only as necessary, and under appropriate agreements, with:

• Our technicians and staff (including vetted contractors performing your work), limited to what they need to attend and complete the job;
• Our payment processor, Paystack, to take payments;
• Technology and hosting providers (cloud hosting, database, mapping, messaging such as WhatsApp/Meta, analytics) who process data on our behalf as data processors;
• Professional advisers (lawyers, accountants, insurers) where necessary;
• Authorities, regulators, or courts where required by law, or to establish, exercise, or defend legal claims; and
• A successor entity, if we reorganise, merge, or sell the business, subject to this Policy.

We require our processors to protect your data, use it only on our instructions, and comply with the Act. We do not sell your personal data.

8. International transfers of data

Some of our service providers (for example, cloud hosting) may store or process data outside Kenya. Where we transfer personal data outside Kenya, we do so only in accordance with Sections 48 and 49 of the Act — that is, where the destination provides adequate protection, where appropriate safeguards (such as contractual protections) are in place, where the transfer is necessary to perform our contract with you, or with your consent. Details of the safeguards we use are available on request.

9. Your rights under the Data Protection Act

Under the Act (Section 26) you have the right to:

• be informed of the use of your personal data (which this Policy provides);
• access the personal data we hold about you (we will respond within 7 days as required by the Regulations);
• rectify inaccurate or incomplete data (we will act within 14 days as required by the Regulations);
• object to or restrict processing, including where we rely on legitimate interests;
• stop processing for direct marketing (opt out at any time);
• data portability — receive certain data in a structured, commonly used, machine-readable format;
• erasure/deletion of your data where it is no longer necessary or where processing is unlawful; and
• not be subject to a decision based solely on automated processing (including profiling) that significantly affects you. We do not make legally or similarly significant decisions about you by solely automated means; property-health scores are prepared with human involvement by our technicians.

To exercise any right, contact us at dpo@fundiconcierge.com. We will not charge you for a reasonable request and will verify your identity first. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (see Section 13).

10. How long we keep your data

We keep personal data only as long as necessary for the purposes described, or as required by law (for example, tax and accounting records). Indicative periods:

When data is no longer needed, we securely delete or anonymise it.

11. How we protect your data

We implement appropriate technical and organisational measures (as required by Section 41 of the Act), including access controls and role-based permissions, encryption in transit and at rest, secure hosting, staff and technician confidentiality obligations, and separation of sensitive data where practicable. No system is completely secure, but we work to protect your data and to detect, contain, and address incidents.

12. Personal data breaches

If a breach occurs that poses a real risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it (as required by Section 43), and we will notify affected data subjects without undue delay where the Act requires. We keep an internal record of breaches and the remedial action taken.

13. Complaints and the regulator

If you have a concern about how we handle your data, please contact us first at dpo@fundiconcierge.com so we can try to resolve it. You also have the right to complain to:

14. Children’s data

The Platform is intended for adults (18+). We do not knowingly collect personal data from children. Where we must process a child’s data, we will do so only with the consent of a parent or guardian and in the child’s best interests, as required by Section 33 of the Act. If you believe we hold a child’s data without proper consent, contact us and we will address it.

15. Cookies and similar technologies

Our website and app may use cookies and similar technologies to operate the Platform, remember your preferences, and understand usage. We do not currently use advertising or analytics cookies beyond what is necessary to operate the Platform. If this changes, we will update this Policy and provide appropriate notice. You can control cookies through your browser or device settings.

16. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will notify you (for example, by in-App notice or email) before they take effect. The “Last updated” date at the top shows the latest version, and we encourage you to review it periodically.

17. How to contact us

This Privacy Policy should be read together with our Terms of Use.