PRIVACY POLICY

1.1 Rentscore Africa Limited (trading as nesti) is the data controller responsible for your personal data. We are a limited liability company registered under the laws of the Republic of Kenya, with registration number PVT-8LU7LVZR.

1.2 We are committed to processing your personal data in accordance with the Kenya Data Protection Act, 2019 (KDPA) and, where applicable, the UK General Data Protection Regulation (UK GDPR) in relation to our UK-based infrastructure and storage providers.

1.3 For all data protection enquiries, requests, and complaints, you may contact our Data Protection Officer (DPO) at:

2.1 The data we collect depends on how you use nesti and which services you access. We collect only what is necessary for the purposes described in this policy.

2.2 We may also collect information automatically through log files when you access our platforms. This may include IP address, browser type, pages visited, and clickstream data. This data is used for security monitoring, analytics, and service improvement.

2.3 If you provide us with personal information about another person - such as your landlord's payment details - you confirm that you are authorised to share that information and that doing so is lawful under applicable data protection laws.

3.1 We collect your personal data through the following channels:

• Directly from you - when you register on the nesti Platform, complete KYC, add rental details, make payments, or contact our support team
• Through the nesti mobile app, M-Pesa mini-app, or website - including data entered, uploaded, or generated during your use of the platform
• From third parties - including your landlord or property manager, payment service providers, credit reference bureaus, regulatory authorities, and authorised partner platforms through which a screening may be initiated
• Automatically - through cookies, device data, and usage logs when you access our digital platforms

3.2 It is your responsibility to ensure that the personal information you provide to nesti is accurate and up to date. Please notify us of any changes within thirty (30) days by contacting support@rentscore.africa.

4.1 We collect and process your personal data for the following purposes:

• To verify your identity and complete KYC authentication before activating your account
• To operate, maintain, and improve the nesti mobile app, M-Pesa mini-app, and website
• To record and disburse your monthly rent payments to your landlord through our secure ledger system
• To build and manage your RentScore based on your rent payment history on the nesti Platform
• To generate tenant Screening Reports - including RentScore, affordability assessment, and KYC verification - for landlords and property managers who have obtained your valid consent
• To assess eligibility for loan facilities or other financial products offered through licensed third-party service providers
• To facilitate home deposit savings redirection to our regulated financial institution partners (Sanlam Allianz Investments Limited and ICEA Lion Group)
• To share your credit information with licensed credit reference bureaus where applicable
• To conduct fraud prevention and security monitoring to protect your account
• To comply with legal obligations under Kenyan law, including anti-money laundering (AML) and know-your-customer (KYC) requirements
• To send you service notifications, security alerts, and - where you have provided consent - marketing communications
• To respond to your support queries, feedback, or complaints
• To conduct internal analytics and develop data-driven insights to improve our services and enhance user experience

4.2 All processing of your data is undertaken in accordance with one or more legal bases set out in the Kenya Data Protection Act, 2019 - primarily consent, contractual necessity, legal obligation, or legitimate interest. Where we rely on legitimate interest, we will balance this against your data protection rights and freedoms.

5.1 We process your personal data based on the following legal grounds under the Kenya Data Protection Act, 2019:

• Consent - where you have given clear and informed consent for specific data processing activities, such as sharing your RentScore with third parties, opting into marketing communications, or enabling location tracking
• Contractual necessity - where processing is necessary to perform our contract with you, including operating your nesti account, facilitating rent payments, and building your RentScore
• Legal obligation - where we are required to process your data to comply with Kenyan law, including KYC, AML, and tax reporting obligations
• Legitimate interest - where we have a legitimate business interest in processing your data, such as improving our services, detecting fraud, and ensuring platform security, provided this does not override your rights and freedoms

5.2 You have the right to withdraw consent at any time by contacting us at support@rentscore.africa. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.1 We do not sell your personal data to third parties for marketing purposes. We share your data only where necessary to provide our services, comply with legal obligations, or where you have provided explicit consent.

6.2 We may share your data with the following categories of recipients:

• Landlords and property managers - your rent disbursement details are shared with your landlord or their designated recipient to complete payment
• Screening requesters - your RentScore, affordability assessment, and KYC verification outcome may be shared with landlords, property managers, or lenders who have obtained your valid consent to initiate a screening
• Regulated financial institutions - Sanlam Allianz Investments Limited and ICEA Lion Group, where you have opted in to the home deposit savings feature
• Credit reference bureaus - where applicable, for credit assessment and monitoring purposes
• Payment service providers - Safaricom (M-Pesa) and banking partners to facilitate rent payments and disbursements
• Authorised Partner Platforms - third-party property management platforms that have entered into a formal partnership agreement with nesti to offer tenant screening services to their clients
• Cloud infrastructure providers - including Supabase (UK-based) for secure database hosting and Google Cloud Platform for application hosting and data storage
• Analytics and performance monitoring providers - such as PostHog, for usage analytics and service improvement
• Customer support tools - to help us respond to your queries and resolve issues
• Legal and regulatory authorities - where required by law or court order, including law enforcement, tax authorities, and the Office of the Data Protection Commissioner
• Professional advisors - including legal, accounting, and auditing firms acting on nesti's behalf

6.3 Where data is shared with third parties, nesti enters into data processing agreements to ensure that your data is handled securely and in accordance with applicable data protection laws.

6.4 If nesti is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. In such cases, we will notify you before your data is transferred and becomes subject to a different privacy policy.

7.1 Some of nesti's service providers and infrastructure are located outside the Republic of Kenya, including in the United Kingdom and the European Union. This means that your personal data may be transferred to, stored in, or processed in these jurisdictions.

7.2 Where data is transferred outside Kenya, we ensure that appropriate safeguards are in place to protect your data, including:

• Standard Contractual Clauses (SCCs) - approved by the European Commission and recognised under Kenyan law for transfers to the UK and EU
• Adequacy decisions - transferring data only to jurisdictions that have been recognised as providing adequate data protection standards
• Data processing agreements - binding contractual obligations on third-party processors to protect your data in accordance with KDPA and GDPR standards

7.3 You may request further information about the safeguards we have in place for international data transfers by contacting our Data Protection Officer at support@rentscore.africa.

8.1 nesti retains your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

8.2 Our retention periods are as follows:

• Active account data - retained for the duration of your account and up to seven (7) years after your last transaction or account activity, in accordance with Kenyan financial record-keeping requirements
• RentScore history - retained for seven (7) years from the date of account closure to support credit assessments and dispute resolution
• Transaction records - retained for seven (7) years to comply with tax, accounting, and anti-money laundering obligations
• KYC documentation - retained for seven (7) years from account closure as required under AML regulations
• Marketing consent records - retained until you withdraw consent, or for two (2) years following account closure
• Support tickets and communications - retained for three (3) years to assist with ongoing service improvement and dispute resolution
• Anonymised analytics data - may be retained indefinitely for research and development purposes, as it can no longer identify you

8.3 After the applicable retention period expires, your personal data will be securely deleted or anonymised such that it can no longer be linked to you.

8.4 You may request deletion of your data at any time by contacting support@rentscore.africa. However, we may retain certain data where we are legally required to do so, or where retention is necessary to defend legal claims.

9.1 Under the Kenya Data Protection Act, 2019, you have the following rights in relation to your personal data:

• Right to access - you may request a copy of the personal data we hold about you, including your RentScore
• Right to rectification - you may request correction of any inaccurate or incomplete data
• Right to erasure - you may request deletion of your personal data, subject to legal retention obligations
• Right to restrict processing - you may request that we temporarily suspend processing of your data in certain circumstances
• Right to data portability - you may request a copy of your data in a structured, commonly used, machine-readable format
• Right to object - you may object to processing carried out on the basis of legitimate interest, including for marketing purposes
• Right to withdraw consent - where processing is based on your consent, you may withdraw it at any time
• Right to lodge a complaint - you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya

9.2 To exercise any of these rights, please contact our Data Protection Officer at support@rentscore.africa or call +254 793 628 515 / +254 743 466 209. We will respond to your request within a reasonable timeframe and in accordance with applicable law - typically within thirty (30) days.

9.3 We may require proof of identity before responding to your request, to ensure we are disclosing data only to the correct person. Requests are generally handled free of charge, unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee.

10.1 We take data security seriously and implement appropriate technical and organisational measures to protect your personal data from unauthorised access, accidental loss, destruction, or damage.

10.2 Our security measures include:

• Encryption - all data in transit is encrypted using TLS/SSL protocols, and sensitive data at rest is encrypted using AES-256 encryption
• Access controls - access to personal data is restricted to authorised personnel only and is granted on a need-to-know basis
• Multi-factor authentication (MFA) - required for all employee and contractor access to production systems
• Regular security audits - we conduct periodic internal and third-party security assessments to identify and address vulnerabilities
• Secure infrastructure - our hosting providers (Supabase and Google Cloud Platform) are ISO 27001 certified and comply with industry-standard security practices
• Data backup and recovery - automated daily backups are maintained to protect against data loss
• Employee training - all nesti team members receive regular training on data protection and security best practices

10.3 While we implement robust security measures, no system is completely secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner in accordance with KDPA requirements - typically within seventy-two (72) hours of becoming aware of the breach.

10.4 You are responsible for maintaining the security of your nesti account credentials. Do not share your password or PIN with anyone. If you suspect that your account has been compromised, please notify us immediately at support@rentscore.africa.

11.1 nesti is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal data from children.

11.2 If we become aware that we have inadvertently collected personal data from a person under the age of 18, we will delete that data immediately.

11.3 If you believe that we have collected data from a child, please contact us at support@rentscore.africa so that we can take prompt action to remove it.

12.1 nesti uses automated decision-making and profiling to generate RentScores and affordability assessments. These processes are based on algorithms that analyse your rent payment history, M-Pesa transaction data, and other relevant financial indicators.

12.2 Your RentScore is calculated automatically based on:

• Payment timing - whether each payment was made on time, early, or late
• Payment consistency - whether you paid every month without gaps
• Payment completeness - whether the full rent amount was paid each month

12.3 While RentScores are generated automatically, they are intended to supplement - not replace - human decision-making. Landlords, property managers, and lenders are expected to exercise independent judgment and conduct additional due diligence before making tenancy or credit decisions.

12.4 You have the right to:

• Obtain an explanation of how your RentScore was calculated
• Challenge the accuracy or fairness of your RentScore
• Request human review of any decision made solely on the basis of automated processing

12.5 To exercise any of these rights or to dispute your RentScore, please contact support@rentscore.africa.

13.1 Your RentScore is only as accurate as the data on which it is based. If you provide incomplete or inaccurate information - such as incorrect landlord payment details or misrepresented M-Pesa transactions - your RentScore may not reflect your true payment reliability.

13.2 Where a tenant screening is conducted based on M-Pesa statement analysis (as opposed to payments made directly through the nesti Platform), nesti relies in part on self-declared information provided by the tenant. We do not independently verify that the transactions identified as rent payments are, in fact, rent payments.

13.3 nesti does not guarantee that a RentScore will result in approval for credit, housing, or any other financial product. Past payment behaviour does not guarantee future performance. A tenant's future conduct is influenced by factors beyond the scope of any data-driven system, including changes in employment, income, health, and personal circumstances.

13.4 Any use of a RentScore or Screening Report to discriminate against a tenant on the basis of gender, race, ethnicity, religion, disability, or any other protected characteristic is strictly prohibited under Kenyan law.

14.1 nesti may send you service notifications, product updates, and - where you have provided consent - marketing communications via SMS, email, or through the nesti app.

14.2 You may opt out of marketing communications at any time by:

• Clicking the unsubscribe link included in any marketing email
• Adjusting your notification preferences in the nesti app settings
• Contacting us at support@rentscore.africa

14.3 Opting out of marketing communications will not affect transactional messages related to your rent payments, account activity, or security notifications. These messages are necessary for the delivery of our services and cannot be opted out of while your account remains active.

14.4 nesti does not sell your data to advertisers. Any targeted communications we send are based on your own activity on the nesti Platform and are not based on third-party advertising profiles.

15.1 nesti uses cookies and similar tracking technologies on our website to improve user experience, measure performance, and support security functions. Cookies are small data files stored on your device when you visit our website.

15.2 We use the following types of cookies:

• Essential cookies - required for the website to function correctly and cannot be disabled
• Analytics cookies - used to understand how visitors interact with our website, helping us improve performance and content
• Security cookies - used to detect and prevent fraudulent activity and protect your account

15.3 You may adjust your browser settings to restrict or block cookies at any time. Please note that disabling certain cookies may affect the functionality of our website. Our mobile app does not use browser cookies but may use device identifiers for analytics and security purposes.

15.4 For full details of how we use cookies, please refer to our Cookie Policy, available at nesti.africa.

16.1 Where you opt in to nesti's home deposit savings feature, your savings contributions will be directed to a regulated money market fund managed by Sanlam Allianz Investments Limited and/or ICEA Lion Group, both licensed fund managers regulated by the Capital Markets Authority (CMA) of Kenya.

16.2 By opting in to this feature, you consent to nesti sharing the relevant personal and financial data with the applicable Participating Financial Institution for the purpose of opening and managing your savings account. Each Participating Financial Institution operates under its own terms and privacy policy, which will be made available to you at the point of enrolment.

16.3 nesti is not a licensed investment manager and does not hold or manage savings on your behalf. All savings are held by and under the regulatory oversight of the Participating Financial Institution.

17.1 If you have a complaint about how we handle your personal data, please contact our Data Protection Officer in the first instance at support@rentscore.africa. We will acknowledge your complaint within five (5) business days and provide a substantive response within thirty (30) days of receipt.

17.2 If you are not satisfied with our response, or if you believe we have failed to address your complaint adequately, you have the right to escalate your complaint to:

17.3 Any dispute arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of the Republic of Kenya, and shall be governed by the laws of Kenya.

18.1 The nesti Platform may from time to time contain links to third-party websites, applications, or services. nesti is not responsible for the privacy practices or content of those third-party platforms. We encourage you to review the privacy policies of any third-party platforms you visit.

18.2 Where nesti integrates with third-party services - such as M-Pesa, credit reference bureaus, or Authorised Partner Platforms - your data is shared only as described in Section 6 of this policy and only where you have provided the required consent.

19.1 We may update this Privacy Policy from time to time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will notify you via the nesti app, by email, or by a prominent notice on our website.

19.2 The date at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically. Your continued use of the nesti Platform after any updates constitutes your acceptance of the revised policy.

19.3 If you have questions, comments, or requests regarding this policy, please contact our DPO at support@rentscore.africa.

20.1 Rentscore Africa Limited has appointed a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with the Kenya Data Protection Act, 2019 and applicable international standards.

20.2 The DPO is your primary point of contact for all matters relating to this Privacy Policy, including data access requests, corrections, deletion requests, consent withdrawal, and complaints.