Privacy Policy

1. Who We Are

Stread Tech Limited is a private company incorporated in Kenya, providing property technology products and services for the African real estate market. Pencil is one of those products.

Our registered office is at Delta Corner Annex, 5th Floor, Ring Road, Westlands, Nairobi, Kenya. Where required under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, we are registered with the Office of the Data Protection Commissioner.

2. Scope

This policy explains how we handle personal data in connection with Pencil: the account you create, the workspace your organisation uses, and the material you put into the platform.

3. Controller and Processor

For the personal data we hold about you as our customer — your account, your organisation's billing details, and your use of the platform — we are the data controller under the Data Protection Act, 2019.

For the material you enter into your workspace, including any personal data it contains about your own clients, buyers or counterparties, your organisation is the controller and we act as a processor on its instructions. We process that material only to provide the service, and we do not use it for our own purposes.

4. Information We Collect

We collect the following categories of personal data:

• Identity data: your name, job title and organisation name.
• Account data: your email address, password credentials, and the role you hold in a workspace.
• Contact data: email address and, where you provide it, phone number and postal address.
• Billing data: your organisation's billing country, address, tax identifier and invoice history. We do not store card details.
• Onboarding data: optional answers you give at signup about what you will use Pencil for and how many people will use it.
• Usage data: pages visited, actions taken, and technical information such as IP address, browser and device type.
• Content data: the projects, appraisals and other material you enter, which may contain personal data you have chosen to include.

5. How We Collect It

Most of it you give us directly, when you create an account, set up a workspace, subscribe to a plan or use the platform. Some is collected automatically as you use the service, through cookies and similar technologies described in our Cookie Policy. Some may come from a colleague, where they invite you into their organisation's workspace.

6. How We Use It

• To create and administer your account and your organisation's workspace.
• To provide the platform and its features to you.
• To invoice you, take payment, apply the correct tax rate, and pursue amounts due.
• To send service messages about your account, your subscription and your invoices.
• To provide support and respond to your enquiries.
• To secure the platform, investigate misuse and meet our legal obligations.
• To understand how the platform is used so we can improve it.
• To send you product updates by email, where you have asked us to.

7. Legal Basis for Processing

We process personal data on the basis of the contract between us, where processing is necessary to provide the service you have subscribed to; on the basis of our legitimate interests in securing, supporting and improving the platform, where those interests are not overridden by your rights; on the basis of your consent, for marketing email, which you may withdraw at any time; and where processing is necessary to comply with a legal obligation.

8. Sharing and Disclosure

We do not sell personal data. We share it only with service providers who help us run the platform — hosting, email delivery and payment processing — each acting on our instructions and under an obligation of confidentiality; with other members of your organisation's workspace, to the extent the platform makes your name and activity visible to them; and where we are required to do so by law, or to establish, exercise or defend legal claims.

9. Cross-Border Transfer

Some of our service providers operate outside Kenya. Where personal data is transferred out of Kenya we take the steps required by the Data Protection Act, 2019, including satisfying ourselves that appropriate safeguards are in place.

10. Retention

We keep personal data for as long as your account and workspace remain active, and afterwards for as long as we need it to meet legal, accounting or reporting obligations — invoices in particular are retained for the period required by tax law. Content you delete is removed from the platform, subject to a short period during which it may persist in backups.

11. Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls that separate one organisation's workspace from another's, and restricted internal access on a need-to-know basis. No system is completely secure, and we cannot guarantee absolute security.

12. Your Rights

Under the Data Protection Act, 2019 you have the right:

• To be informed of the use to which your personal data is put.
• To access the personal data we hold about you.
• To have inaccurate or misleading data corrected.
• To have data deleted where we no longer have a lawful basis to keep it.
• To object to the processing of your personal data, in whole or in part.
• To withdraw consent where processing is based on it, including for marketing email.
• To receive a copy of your data in a portable form.

13. Cookies

We use cookies and similar technologies to keep you signed in and to understand how the platform is used. Our Cookie Policy explains which, and why.

14. Complaints

If you are concerned about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

15. Changes to This Policy

We may update this policy from time to time. The version and date at the top of this page tell you which version you are reading. Where a change materially affects how we use your personal data, we will tell you before it takes effect.

Contact

Pencil is operated by Stread Tech Limited. You can reach us about this document at: