Paangu™
Paangu™ Privacy Policy
Version 2.1 · Effective 20 October 2026
This policy explains how CpTecknologys (the short name of Clements Paskal Tecknologys, the business registered under business registration number BN-MJS7QQ9E) (“we”, “us”) handles personal data in Paangu™, in line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
1. Two kinds of data, two roles
| Whose data | Examples | Our role |
|---|---|---|
| Our clients and their users (agencies, landlords, their staff) | Name, email, phone, company details, login history | Data controller: we decide how it is used |
| Data our clients put into Paangu (tenants, landlords, payers) | Tenant names, phone numbers, ID numbers, tax PINs / tax numbers, rent, payments | Data processor: we process it only for the agency or landlord who uses Paangu (the controller) |
If you are a tenant, the agency or landlord that manages your house decides how your data is used. Please contact them first; we will help them respond to you.
In short: tenant and landlord data belongs to the agency or landlord who uses Paangu. We use it only to run Paangu for them. We do not look at how much rent a client collects to decide their bill, we never sell data, and we never contact tenants for our own purposes.
2. What we collect
Account users: name, email, phone number, role, password (stored only as a one-way hash), two-step-login settings, and a security log of important actions (for example sign-ins, failed sign-ins, sign-outs, password changes and new users) with the time, IP address and device/browser type. We use this log only to protect accounts and investigate problems.
When a client signs up in person: the details on the Paangu set-up and agreement form (business name, registration number, tax PIN / tax number, address, the name, position, ID number and contact details of the person signing) and a scanned copy of the signed form, stored encrypted and seen only by CpTecknologys.
Tenants and landlords (entered by our clients): names; phone numbers; national ID or passport number; tax PIN / tax number; company status; the unit rented; lease dates and terms; rent, charges, water readings, invoices, credit notes and balances; M-Pesa and other payment records (transaction code, amount, time, payer name and phone number as sent by Safaricom); SMS messages sent; and, for landlords, eTIMS registration details.
When you ask Paangu support for help: with your approval (a code sent to the account owner’s phone and email, or “Approve” in the app), a named Paangu support person can view your account’s settings, users and sign-in information for a limited time. They cannot see money or tenants’ details and cannot change your finances or data. Every view and action is recorded and shown in your activity log, and you can end access at any time.
Backup contacts and security questions (optional, recommended): a second phone number and email, and three security questions. Answers are stored only as one-way hashes, so nobody - including Paangu staff - can read them; support can only check an answer you give on the phone. These are used only to confirm it is really you when you ask for help, and to send approval codes to your backup contacts.
Verifying the account owner (free plan fairness and fraud prevention): the owner’s national ID or passport number, tax PIN / tax number, mobile number and, for a business, its registration number. Stored encrypted and always shown hidden (••••). To check that the same person or business does not open more than one free account, we also keep a one-way fingerprint of the email, phone number, ID number and tax PIN / tax number (the value itself cannot be read back from it). Used for nothing else.
Optional profile details: the day and month of your birth (no year) and whether you live with a disability, only if you choose to add them. They are used only to personalise Paangu for you (for example the accessibility settings) and are never shown to tenants or landlords. You can remove them at any time in Edit profile.
Usage counts for billing: how many times each thing charged per use was used (for example “M-Pesa payment received”, “reminder sent”, “eTIMS invoice sent”, “report downloaded”), when, and Paangu’s fee for it. We never use the amounts of your tenants’ payments to bill you.
The Paangu marketplace: - People who say “I’m interested”: name, phone number, optional email, the units they want, when they want to move and their message. We pass these to that advertiser only, because the person asks us to (they tick a box). We also use the phone number to recognise when that person becomes the advertiser’s tenant, only to work out the marketplace commission. Kept for 24 months, then deleted. - Guest advertisers (no account): name, phone, optional email, the advert (text, photos, videos, GPS location, price) and M-Pesa payment records. The private link to manage the advert is stored only as a one-way fingerprint. - Location: a GPS point is shown on an advert only when the advertiser chooses to show it. “Near me” on the marketplace uses your phone’s location in your browser only to sort adverts by distance; it is not stored. - Sellers of houses and land without an account: name and ID or passport number (stored encrypted and shown to CpTecknologys only as ••••123) and the confirmed phone. Used only to prevent fraud. Kept while their adverts are on Paangu and 12 months after, then deleted. - “Did you rent it?” SMS: some weeks after “I’m interested”, we may SMS the person once to ask whether they rented. Their answer is used only to work out the marketplace commission and is shared with the advertiser only as “the person says they rented”. - Video adverts and the microphone: when an advertiser makes a video advert, the spoken description is made by the phone or browser from the advert’s own details. The microphone is used only if the advertiser ticks “Record sound with the microphone”; the sound goes into the video saved on their own device and is not sent to Paangu. Guest advertisers may receive one SMS and one email about Paangu plans after paying for an advert. - Photos and videos of adverts: we keep the photos and videos the advertiser uploads (resized, with hidden location and camera data removed) for as long as they are on the advert. When the advertiser deletes one, it is removed from public pages at once and from our backups within 30 days. Advertisers must not upload photos of people who can be recognised without their consent; we remove such photos when asked. - Camera, microphone and location on your device: Paangu asks before it uses your camera, microphone, location or notifications, and uses them only when you press the button (to take a photo or video for an advert, or to save where a building is or show places near you). Your answer is remembered on that device so you are not asked every time; you can change it in your phone’s or browser’s settings. Paangu does not track your location. - Google ads on public marketplace pages: when CpTecknologys switches them on, Google AdSense may set cookies and collect information about visits to show and measure ads, under Google’s own privacy policy (https://policies.google.com/technologies/ads). Visitors can turn off personalised ads at https://adssettings.google.com. Google ads are never shown inside the Paangu app. - Search alerts: the phone number and what you are looking for. Alerts start only after you tap the link we SMS you, stop when you tap stop, and end by themselves after 60 days. - One-time codes are stored only as a one-way fingerprint and expire in 10 minutes. - Advert statistics are counts only (views and taps); they do not identify visitors. - Reports: when someone reports an advert, the reason, their note and (if they give it) their contact, used only to check the report.
Deleted items: things you delete are kept (encrypted) in your Dustbin for 30 days so you can restore them, then deleted for good.
Automatically: technical data needed to run and secure the service (IP address, browser type, error logs).
We do not collect more than we need, and we do not sell personal data.
3. Why we use it (lawful basis)
| Purpose | Lawful basis (Data Protection Act, s.30) |
|---|---|
| Providing Paangu: rent records, invoices, matching payments, receipts, reports | Performance of our contract with the client; for tenant data, on the client’s instructions |
| Submitting invoices to eTIMS and preparing tax figures | Legal obligation of the landlord/client |
| Security: two-step login, fraud prevention, activity logs, automatic sign-out | Legitimate interests in protecting our clients and tenants |
| Billing our clients and support | Contract |
| Product news and marketing to clients | Consent (you can opt out at any time) |
4. Who we share it with
We share personal data only as needed to provide the service:
| Recipient | What for | Location |
|---|---|---|
| Safaricom PLC (M-Pesa / Daraja) | Receiving payment notifications and sending M-Pesa payment prompts on the client’s own paybill | Kenya |
| Kenya Revenue Authority (eTIMS) | Submitting the landlord’s invoices, when eTIMS is connected | Kenya |
| Pesapal (Pesapal Ltd) | Card, Airtel Money and M-Pesa payments made on Pesapal’s secure page (Paangu bills, and rent where a client uses Pesapal). Card details are entered only on Pesapal’s page and never reach Paangu | Kenya |
| Airtel Networks Kenya Ltd (Airtel Money) | Sending Airtel Money payment prompts and confirming payments (Paangu bills, and rent where a client uses Airtel Money) | Kenya |
| SMS provider (Africa’s Talking Ltd) | Sending receipts, reminders and login codes | Kenya |
| Hosting provider (Render Services, Inc.) | Running the servers and database | European Union (Frankfurt, Germany) |
| Your browser’s push service (Google for Chrome and Android, Apple for iPhone, Mozilla for Firefox, Microsoft for Edge) | Delivering phone / computer alerts you allowed. The alert is encrypted for your device only, so the push service cannot read it, and it never contains amounts, names or phone numbers | Worldwide (the browser maker’s servers) |
We may also disclose data where required by law or by a lawful order of a Kenyan court or authority.
Transfers outside Kenya: our database is hosted in the European Union, which has strong data-protection laws. We transfer data only with appropriate safeguards as required by sections 48–50 of the Data Protection Act, 2019, including contractual protections with our hosting provider.
5. How we protect it
- All connections use HTTPS encryption.
- The database and its backups are encrypted; in addition, ID numbers, tax PINs / tax numbers and M-Pesa credentials are individually encrypted inside the database.
- Passwords are never stored, only secure hashes.
- Two-step login by SMS code, automatic sign-out after inactivity, and lock-out after repeated wrong passwords.
- Each client can see only its own data. Staff access is limited by role, and important actions are recorded in an activity log.
- Our own administrative accounts are protected with two-factor authentication.
6. How long we keep it
| Data | Kept for |
|---|---|
| Client account data | While the account is active, then up to 90 days |
| Tenant, lease, invoice and payment records | While the client’s account is active. After it ends, the client has 30 days to export; we delete it within 90 days unless the law requires longer. (Kenyan tax law generally requires tax records to be kept for at least 5 years; clients should keep their own copy.) |
| Login codes | Expire after 5 minutes; deleted regularly |
| Security and activity logs | Up to 24 months |
| Phone / computer notification addresses (the browser’s push address and keys for a device where you allowed Paangu alerts) | Until you sign out on that device, take back the permission, change your password or sign out everywhere |
| Content-safety records (who was refused or blocked, where, which rule and when; fingerprints of refused pictures and videos - never the content) | Up to 24 months after the last event; fingerprints of harmful pictures and videos for as long as Paangu runs |
7. Your rights
Under section 26 of the Data Protection Act, 2019 you have the right to: be informed of how your data is used; access your data; have inaccurate data corrected; have data deleted where there is no longer a lawful reason to keep it; object to processing; and, where applicable, data portability.
- Tenants: contact your agency or landlord; we will assist them.
- Clients and users: email us at paangusupport@gmail.com.
We respond within the time required by law. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8. Data breaches
If a breach puts personal data at risk, we will inform the affected client without undue delay and in any case within 48 hours, and notify the Data Protection Commissioner within 72 hours where required by section 43 of the Act.
9. Children
Paangu is a business tool for adults and is not intended for use by anyone under 18.
10. Changes
We will post any update here and tell clients of important changes by email or in the app.
11. Contact
Data Protection contact, CpTecknologys (Clements Paskal Tecknologys, BN-MJS7QQ9E) · Nairobi, Kenya · 0786807375 · paangusupport@gmail.com
Paangu™ is a trademark of Clements Paskal Tecknologys (short name CpTecknologys), business registration number BN-MJS7QQ9E. © 2026 Clements Paskal Tecknologys. All rights reserved.