Kestrel Management Limited

(Imaara – The New Address)
Effective Date: 01 JAN 2024
Last Updated: 31 DEC 2025

 

1. INTRODUCTION

Kestrel Management Limited (“Kestrel”, “we”, “our”, “us”) is committed to protecting the privacy and personal data of users who access and interact with our website www.imaara.ke (the “Website”).

This Website Data Privacy Policy explains how we collect, use, disclose, store, and safeguard personal data in compliance with:

• • The Data Protection Act, 2019 (Kenya)

• • The Data Protection (General) Regulations, 2021

• • Any other applicable data protection laws

By accessing or using this Website, you acknowledge that you have read and understood this Privacy Policy.

 

2. DATA CONTROLLER DETAILS

Kestrel Management Limited
Imaara – The New Address
Dedan Kimathi Avenue
Mombasa, Kenya

Data Protection Officer (DPO):
Izbanu Issak
Email: accounts@Imaara.co.ke
Telephone: 254 716 571386

Kestrel Management Limited acts as the Data Controller for personal data collected through this Website.

 

3. SCOPE OF THIS POLICY

This Policy applies to:

• • Website visitors

• • Prospective tenants

• • Service providers

• • Individuals making inquiries

• • Any person submitting personal data through the Website

It does not apply to third-party websites linked from this Website.

 

4. TYPES OF PERSONAL DATA WE COLLECT

4.1 Information You Provide Voluntarily

We may collect personal data when you:

• • Submit an inquiry form

• • Request leasing information

• • Submit a data protection acknowledgment

• • Contact us via email or web forms

This may include:

• • Full name

• • Company name

• • Designation

• • Email address

• • Telephone number

• • Physical address

• • Any additional information voluntarily submitted

 

4.2 Automatically Collected Information

When you access the Website, we may automatically collect:

• • IP address

• • Browser type and version

• • Device type

• • Operating system

• • Referring website

• • Pages visited

• • Time and date of access

• • Website navigation patterns

 

4.3 Cookies and Tracking Technologies

 

We may use cookies and similar technologies to:

1. • Improve Website functionality

1. • Enhance user experience

1. • Analyze traffic patterns

1. • Maintain security

1. • Cookies do not typically identify you personally unless you provide information through forms.

1. • Users may control cookies through browser settings.

1. • Where required by law, consent will be obtained for non-essential cookies.

 

5. PURPOSE OF PROCESSING

We process personal data for the following purposes:

• • Responding to inquiries

• • Providing property and leasing information

• • Managing tenant and service provider communications

• • Improving Website functionality

• • Ensuring Website security

• • Detecting and preventing fraud or cyber threats

• • Complying with legal and regulatory obligations

We do not use Website data for automated decision-making or profiling.

 

6. LEGAL BASIS FOR PROCESSING

We process personal data based on one or more of the following lawful bases:

• • Consent

• • Legitimate interest

• • Contractual necessity

• • Legal obligation

Security and fraud prevention measures are undertaken under legitimate interest.

Where consent is required, it will be obtained explicitly.

 

7. DATA MINIMISATION

We only collect personal data that is:

• • Adequate

• • Relevant

• • Limited to what is necessary for the intended purpose

 

8. DATA RETENTION

Personal data collected through the Website shall be retained only:

• • For as long as necessary to fulfil the stated purpose; or

• • As required by law; or

• • Until consent is withdrawn (where processing is based on consent)

Retention periods are periodically reviewed to ensure compliance.

 

9. DATA SHARING AND DISCLOSURE

1. 1. We may share personal data with:
      1. IT service providers and hosting providers
      1. Website maintenance vendors
      1. Professional advisors (legal, regulatory, audit)
      1. 1. Regulatory authorities where required by law

1. 1. All service providers are required to implement appropriate data protection safeguards.

1. 1. We do not sell personal data.

 

10. INTERNATIONAL DATA TRANSFERS

Where Website hosting or service providers are located outside Kenya, personal data may be transferred internationally.

In such cases, Kestrel ensures:

• • Adequate safeguards are in place

• • Data protection standards meet the requirements of the Data Protection Act, 2019

• • Appropriate contractual protections exist

 

11. DATA SECURITY MEASURES

We implement appropriate technical and organisational measures to protect personal data, including:

• • Secure hosting infrastructure

• • SSL encryption (HTTPS)

• • Access controls

• • Role-based system permissions

• • Firewall protections

• • Periodic security monitoring

• • Incident response procedures

Despite these measures, no system is completely secure. Users transmit information at their own risk.

 

12. DATA SUBJECT RIGHTS

Under the Data Protection Act, 2019, you have the right to:

• • Be informed about data processing

• • Access your personal data

• • Request correction of inaccurate data

• • Request deletion (where legally permissible)

• • Object to processing

• • Withdraw consent

• • Data portability

• • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

Requests may be submitted to the Data Protection Officer via the contact details above.

We will respond within the timelines prescribed by law.

 

13. DATA BREACH MANAGEMENT

In the event of a data breach involving personal data collected through the Website:

• • The Office of the Data Protection Commissioner will be notified within 72 hours (where applicable)

• • Affected individuals will be notified without undue delay where required by law

 

14. THIRD-PARTY LINKS

This Website may contain links to external websites.

Kestrel Management Limited is not responsible for:

• • Content of third-party websites

• • Their privacy practices

• • Their data handling policies

Users are encouraged to review the privacy policies of those websites.

 

15. CHILDREN’S DATA

This Website is not intended for children under 18 years of age.

We do not knowingly collect personal data from minors without lawful basis.

 

16. POLICY UPDATES

This Privacy Policy may be updated periodically.

Changes will be published on this page with an updated “Last Updated” date.

Continued use of the Website after updates constitutes acceptance of the revised policy.

 

17. CONTACT INFORMATION

For any privacy-related inquiries or to exercise your data protection rights, contact:

 

Data Protection Officer
Kestrel Management Limited
Imaara – The New Address
Dedan Kimathi Avenue
Mombasa, Kenya

Email: accounts@Imaara.co.ke
Telephone: 254 716 571386

 

For our Terms of Use, Click Here