Privacy & Personal Data Protection Policy

This Privacy Policy is promulgated pursuant to the Data Protection Act, 2019 (Act No. 24 of 2019, Laws of Kenya) and the Data Protection (General) Regulations, 2021.

For the purposes of the Act, Zulogic Labs, operating the platform branded as Accommodica ("Accommodica", "we", "us", or "our"), acts as the Data Controller in determining the purposes and means of processing personal data collected from prospective tenants, registered landlords, property caretakers, and general platform visitors.

This policy applies to all personal data collected through accommodica.com, associated web endpoints, identity verification portals, move-out calculators, physical tour scheduling modules, and electronic communication channels.

In compliance with Section 25 of the Data Protection Act, 2019, Zulogic Labs ensures that all personal data is:

To deliver a verified rental accommodation service across Kenya, we collect the following discrete categories of personal data:

Section 30 of the Data Protection Act, 2019 prohibits processing unless a recognized lawful ground applies. Zulogic Labs processes your personal data strictly under the following statutory grounds:

Under Sections 44 and 47 of the Data Protection Act, 2019, certain categories of personal data—including national identity documents and government-issued credentials—are subject to heightened security standards.

We process personal data strictly to fulfill the following operational purposes:

• Physical Listing Audits: Conducting on-site physical audits across Kenyan counties to confirm unit existence and layout.
• Host Identity Vetting: Eliminating ghost listings and broker extortion by vetting host credentials before listing approval.
• Viewing Tour Coordination: Facilitating communication between tenant and host for confirmed on-site visits.
• Platform Optimization: Improving search accuracy, bedroom and pricing filters, and county categorization based on aggregated usage telemetry.
• Security & Anti-Abuse: Detecting bot scrapers, brute force attempts, and fraudulent advertisements under the Computer Misuse and Cybercrimes Act, 2018.

Zulogic Labs does not sell or trade personal data. We share personal information only with verified service providers acting as Data Processors under binding data processing agreements conforming to Section 42 of the DPA 2019:

While Accommodica serves the Kenyan market, cloud server clusters, managed database replicas, and telemetry pipelines may reside on infrastructure outside the Republic of Kenya (such as within the European Union or United States).

In compliance with Sections 48 and 49 of the Data Protection Act, 2019 and Regulation 41 of the Data Protection (General) Regulations, 2021, Zulogic Labs ensures that any cross-border transfer satisfies one or more of the following statutory safeguards:

• The destination jurisdiction provides an adequate level of data protection comparable to Kenyan standards.
• Execution of Standard Contractual Clauses (SCCs) binding the overseas processor to equivalent data security and audit obligations.
• Explicit consent provided by the data subject following disclosure of transfer destinations.
• Necessity for the performance of a contract entered into between the data subject and Zulogic Labs.

Under Section 26 of the Data Protection Act, 2019, you have specific, enforceable statutory rights in relation to your personal data:

To exercise any statutory right under Section 26, follow our standardized Data Subject Request procedure:

In compliance with Section 25(e) of the Act, personal data is retained only for as long as necessary to fulfill the specific purposes for which it was gathered:

Upon expiration of the retention window, records are permanently deleted or irreversibly anonymized using secure digital wiping standards.

Zulogic Labs implements rigorous organizational and technical safeguards pursuant to Section 41 and 43 of the Data Protection Act, 2019:

• Cryptographic Standards: Industry-standard TLS 1.3 encryption for data in transit and AES-256 encryption for sensitive verification data at rest.
• Access Partitioning: Role-based access controls ensuring internal staff access identity documents strictly on a need-to-know basis.
• Continuous Auditing: Automated monitoring for unauthorized intrusion attempts, credential stuffing, and bot scraping.

Statutory 72-Hour Breach Reporting Protocol

Pursuant to Section 43 of the Data Protection Act, 2019, in the event of a personal data breach posing a risk to the rights and freedoms of data subjects:

• Zulogic Labs shall formally notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach.
• Where the breach is likely to result in high risk to data subjects (e.g. exposure of national identification credentials), we shall promptly notify affected individuals in writing, specifying mitigation steps and security advisories.

Accommodica utilizes cookies and local storage tokens strictly to maintain session state, security, and platform usability:

Users may configure their web browsers to refuse cookies, though doing so may restrict access to authenticated features (such as uploading listings or scheduling tours).

If you believe that Zulogic Labs has failed to uphold your statutory rights under the Data Protection Act, 2019, you have the right under Section 56 of the Act to lodge a formal complaint with the regulatory authority:

We encourage users to contact our central compliance desk at info@accommodica.com first so that we can immediately investigate and resolve your concerns.