Privacy Policy

DiasporaShield (“DiasporaShield”, “we”, “us”) is an investment intelligence, risk management and verification platform for diaspora and foreign investors in Kenyan and wider African real estate. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how we protect it, and the rights you have over it.

We are the data controller for the personal data described in this policy. We process personal data in line with the Kenya Data Protection Act, 2019 and, where they apply to you, the UK GDPR and the EU General Data Protection Regulation. This policy should be read together with our Cookies Policy and Terms of Use.

We collect most of this directly from you. Some comes from third parties: payment providers confirm your payments, social sign-in providers confirm your identity, and verification work may draw on public registries and records about a property or developer.

The Platform uses automated tools to support decisions. None of them makes a decision that has a legal or similarly significant effect on you without human involvement.

• Risk scoring, ROI forecasting and matchmaking run on our own rules-based engines, using property data and, for matching, your investment preferences. Every result is labelled to show whether it was model-computed or manually assessed.
• Document analysis reads uploaded property documents with text recognition on our own infrastructure to extract key details and flag potential legal issues. Legal findings only affect a risk score once an analyst has confirmed them.
• Text generation through OpenAI is used for the support assistant, suggested message replies, the wording of some notifications and internal summaries of audit records. Only the information needed for each task is sent, and it is not used to make decisions about you.

You can ask for a human review of any automated outcome that concerns you by contacting support.

Other users, only where it is needed

• Professionals you book see the details and documents you provide for that booking.
• Developers see verification requests about their own properties. Unless you opt out in your privacy settings, they may also see an anonymised lead profile of matching investors: first name, last initial, location and investment preferences. They never see your contact details through this feature, and opting out takes effect immediately.

Service providers acting on our instructions

We may also disclose data where the law requires it, to regulators or law enforcement with a valid legal basis, to protect users against fraud, or to a successor if our business is reorganised or sold, in which case this policy will continue to protect your data.

We do not sell personal data, and we do not share it for advertising.

We operate from Kenya and serve investors around the world, and some of our service providers process data outside Kenya. When personal data is transferred across borders, we do so only where the Kenya Data Protection Act allows it, such as where the recipient provides appropriate safeguards for the data, and we choose providers with strong security and data protection commitments.

• Data is encrypted in transit and documents are stored encrypted. Documents are only ever shared through links that expire after 15 minutes, never through public links.
• Every uploaded file is scanned for viruses before it is stored, and infected files are rejected.
• Access is controlled by role, so each user and each member of our staff only sees what their role requires.
• Two-factor authentication, account lockout after repeated failed sign-ins, new-device alerts and session management protect your account.
• Sensitive actions are written to an audit log that cannot be edited or deleted.
• Card details are handled only by Stripe and never touch our servers.

When data is no longer needed, we delete it or anonymise it so it can no longer identify you.

Under the Kenya Data Protection Act and, where applicable, the UK and EU GDPR, you have the right to:

• Be informed about how your data is used, as set out in this policy.
• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete data. Much of your profile can be updated directly in your account settings.
• Ask us to delete your data, subject to data we must keep by law.
• Object to, or ask us to restrict, processing based on our legitimate interests.
• Withdraw consent at any time, for example to marketing messages, without affecting processing that has already taken place.
• Receive your data in a portable format where the law provides for it.
• Not be subject to decisions based solely on automated processing that significantly affect you.

To exercise any of these rights, contact us at [email protected]. We may ask you to confirm your identity before acting on a request, and we will respond within the time the law allows.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.

• Turn developer discovery on or off in your investor privacy settings.
• Choose which notifications you receive, and by which channel, in your notification preferences.
• Review and sign out active sessions and devices, and enable two-factor authentication, in your security settings.
• Update your profile and investment preferences at any time.

The Platform is intended only for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

We will update this policy when our practices, our service providers or the law change. The “Last updated” date above shows when it last changed. We will notify signed-in users of material changes through the Platform or by email before they take effect.

For privacy questions or to exercise your rights, contact us:

• Email: [email protected]
• Online: our contact page