Interim version 2026-10-interim — Last updated 06th October 2026
Hestia (hestia.co.ke, "Hestia Property") is operated by Pinecrest Solutions Ltd ("we," "us," or "our"), a company incorporated in Kenya. For the personal data of our account holders and website visitors, we are the data controller within the meaning of the Kenya Data Protection Act, 2019 (the "DPA"). We are registered with the Office of the Data Protection Commissioner (ODPC) under registration number PENDING.
Questions or concerns? If you have any questions about this notice or how we handle your data, contact us at privacy@hestia.co.ke.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on hestia.co.ke, express an interest in our products and Services, or contact us. Depending on how you use the Services, this may include:
Payment Data. To process payment for your use of our services we collect the mobile money number you pay from, payment references, and — if you enable card auto-pay — a reference to your card held by our payment processor (we store only the last four digits, card brand and expiry, never the full card number).
Data you upload about others. Property managers using Hestia upload data about their tenants, landlords and vendors (names, contact details, KRA PINs, bank accounts, lease and billing records, documents). See section 9: for that data we are a processor acting on the property manager's instructions.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for the following purposes:
In Short: We only process your personal information when we have a valid legal basis to do so under the Data Protection Act, 2019.
| Purpose | Legal basis |
|---|---|
| Account creation & service delivery | Performance of a contract |
| Payments and billing | Performance of a contract / legal obligation (tax and accounting law) |
| Security & fraud prevention | Legitimate interests |
| Marketing communications | Consent (opt-in; withdraw at any time) |
| Operational logs & audit trail | Legitimate interests (we use no analytics or tracking) |
In Short: We share information only with the service providers needed to run Hestia, and in the specific situations described below.
Service providers. We share personal data with third-party service providers who process it on our behalf and on our instructions, under contracts designed to safeguard it. They are:
We also may need to share your personal information in the following situations:
We do not sell personal data, and we do not share it with advertising or analytics companies.
In Short: Our servers are hosted in Germany, a jurisdiction with data-protection safeguards equivalent to the DPA.
Our Services are hosted by Hetzner Online GmbH in its data centres in Germany. Germany is subject to the EU General Data Protection Regulation (GDPR), which provides data-protection standards comparable to those of the Kenya Data Protection Act, 2019. A data processing agreement is in place with our hosting provider — download a copy.
In Short: We keep your information for as long as you have an account with us, and for 6 months after termination.
We keep your personal information for as long as you have an account with us. Personal data is deleted or anonymised 6 months after the termination of your account, except for records we are required to keep by law (such as tax and accounting records), which are retained for the legally required period and anonymised where possible [COUNSEL TO CONFIRM period].
Where deletion is not immediately possible (for example, because personal information is held in backup archives), we securely store it and isolate it from any further processing until deletion is possible.
In Short: We protect your personal information through organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. These include:
No method of transmission or storage is completely secure, but we work to protect your information using measures appropriate to the risk, and we review them as the service evolves.
Breach notification. If a personal data breach occurs that presents a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and we will inform affected users without undue delay where the breach is likely to put their rights and freedoms at risk.
In Short: For tenant and landlord data uploaded by property managers, the property manager is the controller and Hestia is the processor.
Property managers use Hestia to keep records about their tenants, landlords and vendors (names, contact details, KRA PINs, bank accounts, leases, billing records and documents). For this data, the property manager — our client — is the data controller: they decide what is collected and why. Hestia acts as their data processor: we store and process that data only to provide the service, on the client's instructions, and we do not use it for our own purposes.
If you are a tenant, landlord or vendor whose details were entered into Hestia by a property manager, please direct requests about your data to that property manager in the first instance. You can also contact us at privacy@hestia.co.ke and we will assist or forward your request to the responsible property manager.
In Short: We use only strictly necessary cookies. We set no analytics, advertising or tracking cookies, so no cookie consent banner is required.
| Cookie | Purpose | Lifetime |
|---|---|---|
| hestia_property_session | Keeps you logged in during a visit (session) | 2 hours |
| XSRF-TOKEN | Protects forms against cross-site request forgery | 2 hours |
| remember_web_* | Keeps you logged in if you tick "Remember me" | Until logout |
Some pages load fonts and icons from content delivery networks (Google Fonts, Bunny Fonts, Cloudflare cdnjs). These requests disclose your IP address to the CDN but set no cookies and do not track you across sites.
In Short: The Data Protection Act, 2019 gives you rights over your personal data, and we honour them.
You have the right to:
To exercise any of these rights, email privacy@hestia.co.ke from the address on your account (or with enough information for us to verify your identity), telling us which right you want to exercise. We will respond within [COUNSEL TO CONFIRM response time]. Exercising your rights is free of charge.
In Short: We do not knowingly collect data from or market to children under 18 years of age.
We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@hestia.co.ke.
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
This is an interim version of our privacy notice, published while a full review against the Data Protection Act, 2019 is completed. We may update it from time to time; the updated version will be indicated by an updated "Last updated" date and version label and will be effective as soon as it is accessible. If we make material changes, we may notify you by prominently posting a notice or by contacting you directly. We encourage you to review this notice periodically.