Kenya · Data Protection Act, 2019

Privacy & data protection

Sikohome handles personal data in Kenya. These pages set out how we collect, use, store and share it, and the rights you have under Kenyan law.

1. Who is responsible

Sikohome (“we”, “us”) operates this platform. For accounts, payments through the platform, support tickets and security logs, we are the data controller. When you book a stay, the host who lists the property is also a controller of the details they need to host you (name, phone, stay dates, and identity checks required at check-in). We process those details on their behalf as a processor where they instruct us to store them in the workspace.

To exercise your rights, email supprt@sikohome.com. If we cannot resolve it, you may complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

2. The law we follow

We design our handling of personal data around the Data Protection Act, 2019:

• Section 25 — lawfulness, fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
• Section 26 — rights of a data subject (to be informed, access, object, correction and deletion of false or misleading data).
• Sections 30 and 31 — a lawful basis before we process (contract, legal duty, legitimate interests, or consent).
• Sensitive identifiers — national ID numbers, passport numbers and KRA PINs are encrypted at rest and shown as recognition marks.
• Data Protection (General) Regulations, 2021 — how those principles are applied, including security and complaints to the ODPC.

3. What we collect

Only what is needed to run stays, pay people, keep the platform safe, and meet Kenyan tax and identity rules:

• Identity — full name, national ID / passport / alien ID number, ID type, ID scans when you or a host upload them, KRA PIN when a stay or payout requires it.
• Contact — phone, email, address you give us, emergency contact on a guest file.
• Stay and money — booking dates, property, amounts, M-Pesa or card references, invoices, payouts to hosts.
• Account — passwords (hashed, never stored in readable form), role, login times, device used to sign in.
• Host and owner files — business name, property ownership details, bank or M-Pesa payout details, staff HR fields (ID, KRA, NHIF, NSSF, bank) that a host records for payroll.
• Messages and support — tickets, WhatsApp or SMS we send you (OTPs, booking notices).
• Technical — IP address, browser, cookies needed to keep you signed in and to stop abuse. See Cookies.

We do not sell personal data. We do not use your ID number or KRA PIN for marketing.

4. Why we process it (lawful basis)

Under sections 30 and 31 of the Data Protection Act, 2019, we process data only where at least one of these applies:

• Contract — to create your account, hold a booking, take payment, pay a host, or run the workspace you signed up for.
• Legal obligation — Kenyan tax (including VAT on stays where it applies), identity checks hosts reasonably require at check-in, and keeping records we are required to keep.
• Legitimate interests — preventing fraud and double bookings, securing the service, measuring what is broken so we can fix it. We do not override your rights to do this.
• Consent — optional marketing messages, optional ID scans you choose to attach, optional cookies that are not strictly necessary. You can withdraw consent without affecting a booking already made.

5. How we protect identity numbers

National ID numbers, passport numbers and KRA PINs are treated as high-risk personal data. In the database they are encrypted. Lists, receipts, public confirmation pages and operator screens show only a recognition mark (typically the last four characters). Staff search uses a one-way lookup, not a copy of the number sitting in plaintext. Full values are shown only on edit forms to people who are allowed to correct a file. Names stay readable so a host can greet a guest — hashing a surname would make the service unusable.

ID photos go to private storage, not a public folder. Access is limited by role (identity permission). Passwords and PINs are hashed.

6. Who we share with

• The host of your stay — name, contact, stay details, and identity marks they need to check you in. They must use that data only for the stay.
• Payment providers — PayHero, M-Pesa / Daraja, Paystack — only what is required to take or send money.
• Message providers — SMS (Talksasa or fallback) and email, to deliver OTPs and booking notices you asked for.
• The platform operator — to run support tickets, investigate incidents, and meet our own legal duties. Operator staff see masked identity, not a live copy of your ID.
• Authorities — only when Kenyan law requires it, or to protect someone’s rights, safety or property.

If a provider stores data outside Kenya, we only do so where the Data Protection Act, 2019 allows a cross-border transfer (adequate protection, or another lawful safeguard). We do not publish guest ID numbers on listing pages.

7. How long we keep it

We keep booking and payment records for as long as Kenyan tax and dispute rules require, then delete or irreversibly anonymise what we no longer need. Guest identity documents can be removed by a host with the right permission, or on a valid erasure request where the law allows. Closed support tickets are kept only as long as needed to show what was done. Security logs are kept for a short period to investigate abuse.

8. Your rights (section 26)

You may, in respect of your personal data:

• be informed of the uses to which it is put (this page);
• access it (section 26 of the Act);
• object to processing that is not required for a stay or a legal duty;
• require correction of false or misleading data;
• require deletion of false or misleading data, and in other cases where the Act allows erasure;
• ask for a copy in a portable form where the Act gives that right;
• withdraw consent where we relied on consent;
• complain to us and then to the ODPC.

Write to supprt@sikohome.com from the email on your account and tell us what you need. We will not charge a fee unless a request is manifestly unfounded or excessive. We may need to confirm it is you before we act.

9. Children

Sikohome is for adult travellers and property operators. We do not knowingly create accounts for children. A parent or guardian booking for a family should not upload a child’s identity document unless the host lawfully needs it for that stay.

10. Changes

If we change this notice in a way that affects how we use data already collected, we will update the date at the top and, where the change is material, notify account holders by email or in-product notice.

This notice is written in plain language so you can use it. It is not a substitute for legal advice. If Kenyan law changes, we will update this page.