HOMELINK360 PRIVACY POLICY

1. Who We Are

Homelink360 is owned and operated by HARNAN EDGE LIMITED, a company based in Kenya.

For personal data processed through Homelink360, HARNAN EDGE LIMITED is responsible for determining the purposes for which personal data is processed and the manner in which it is handled, subject to applicable data protection law.

Data Controller:
HARNAN EDGE LIMITED

Registered/Business Address:
Western Heights, Westlands, Nairobi, Kenya

Website:
https://www.homelink360.co.ke/

Privacy Contact:
hnandwa52@gmail.com

For privacy, personal-data, access, correction, deletion, objection, or other data-protection enquiries, users may contact us using the privacy contact above.

Homelink360 does not currently designate a Data Protection Officer. Where a dedicated data-protection contact is required or designated in the future, the relevant contact details will be provided through this Privacy Policy or the Homelink360 website.

2. Personal Data We Collect

Depending on how you use Homelink360 and the services you request, we may collect and process the following categories of personal data:

2.1 Identification and Contact Information

This may include your name, telephone number, client or account identifier, national identification details, branch or service information, and other information necessary to identify and communicate with you.

2.2 Account and Authentication Information

This may include authentication credentials and related security information, account activation information, device identifiers, authentication events, and information used to protect your account and prevent unauthorised access.

2.3 Service, Application and Loan Information

Where you request a Homelink360 service, we may process information relating to your request, including the service requested, requested amount, applicable period or tenure, purpose, service status, loan or request references, approval information, and related administrative records.

2.4 Financial and Transaction Information

We may process financial and transaction information relevant to providing and administering our services. This may include payment records, repayment information, outstanding amounts, transaction references, disbursement information and related account history.

2.5 Credit and Risk Information

Where applicable, we may process information used for credit or risk assessment, including credit scores, risk classifications, credit-related history, repayment behaviour and information relevant to determining eligibility or applicable service terms.

2.6 M-Pesa Statement Information

Where a service requires supporting financial information, you may provide an M-Pesa statement in PDF format. We may process the information contained in that statement for the specific service, verification and assessment purposes for which it was provided.

Where required for a specific statement submission, we may also process the statement PDF security PIN associated with that particular statement request. This is a security value connected to the specific statement submission and is not your M-Pesa account PIN or transaction PIN.

2.7 Photograph and Selfie Information

For services that require identity or security verification, we may collect a live selfie or photograph captured through the client portal. Homelink360 does not perform facial recognition, extract biometric templates, or perform biometric matching from the selfie.

2.8 Location and Address Information

Where required for a service or security verification, we may process location information, including latitude, longitude, location accuracy and the time at which the location was captured. We may also collect address-related information such as residential area, building or door information and a nearby stage or landmark.

2.9 Device and Technical Information

We may collect information relating to the device and browser used to access Homelink360, including device identifiers, browser or user-agent information, security events, and related technical information used for authentication, fraud prevention, troubleshooting and system security.

2.10 Communications and Support Information

Where you communicate with Homelink360 through the client portal, we may process the contents of messages, support requests, attachments, communication timestamps and information linking the communication to your account or service request.

2.11 Referral Information

Where you use referral features, we may process information about the person you refer, such as their name, telephone number, relationship to you and referral or reward information that you provide.

2.12 Loyalty and Reward Information

Where applicable, we may process information relating to loyalty points, reward eligibility, vouchers, reward selections, redemption activity and related programme records.

We collect personal data for defined and lawful purposes and seek to limit collection to information relevant to those purposes. Some information may be collected directly from you, while other information may be generated or obtained through your use of Homelink360, your service transactions, or authorised sources permitted by applicable law.

3. How We Use Personal Data

HARNAN EDGE LIMITED processes personal data for specific and lawful purposes connected with the operation of Homelink360 and the provision, administration and protection of its services.

Depending on the nature of your relationship with Homelink360 and the service you use, we may use personal data for the following purposes:

3.1 Account Registration and Administration

To create, maintain and manage your Homelink360 account, verify your identity, maintain your client profile and provide you with access to the client portal and relevant services.

3.2 Authentication and Account Security

To authenticate users, protect accounts against unauthorised access, maintain device and security controls, detect suspicious activity, manage account recovery and maintain records of relevant security events.

3.3 Service and Application Processing

To receive, evaluate, process and administer requests for Homelink360 services, maintain request records, communicate the status of requests and provide the services requested by the client.

3.4 Financial and Transaction Administration

To verify and administer transactions, repayments, outstanding balances, disbursements and other financial records associated with Homelink360 services.

3.5 Credit and Risk Assessment

Where applicable, to assess service eligibility, creditworthiness and repayment risk using relevant financial, transaction and repayment information and credit-related information available to Homelink360.

3.6 Verification of Supporting Documents

Where required for a particular service, to review information contained in supporting documents such as an M-Pesa statement and to process the associated statement PDF security PIN for that specific statement submission.

3.7 Identity and Security Verification

Where required, to use a live selfie or photograph for identity, security or fraud-prevention purposes. Homelink360 does not use the selfie to perform facial recognition, create biometric templates or perform biometric matching.

3.8 Location and Address Verification

Where required for a service, to collect and use location and address information for service verification, security, operational processing and other purposes specifically connected with the relevant service.

3.9 Customer Support and Communications

To respond to enquiries, provide customer support, communicate service information, maintain support records and manage communications and attachments submitted through Homelink360.

3.10 House Tours and Property-Related Services

Where you request a property-related service such as a House Tour, to process the selected property or property link, requested package, location, date and time information, payment-related information and communications necessary to arrange and administer the service.

3.11 Loyalty, Rewards and Referrals

Where these features are available to you, to administer loyalty points, rewards, vouchers, referral activity and related eligibility, redemption and programme records.

3.12 Fraud Prevention and Information Security

To protect Homelink360, its clients and authorised users against fraud, abuse, unauthorised access, account compromise and other security threats, including through security monitoring, device controls, event records and technical information.

3.13 Legal and Regulatory Compliance

To comply with applicable Kenyan laws, regulatory requirements, lawful requests and obligations relating to the operation, administration and protection of our services.

3.14 Record-Keeping and Service Administration

To maintain accurate records, administer client accounts and service relationships, investigate disputes or service issues, and support the proper operation and governance of Homelink360.

We will not use personal data for a new or materially different purpose that is incompatible with the purpose for which it was collected unless permitted or required by applicable law or an appropriate legal basis for the new processing has been established. Kenya’s data-protection framework requires purpose limitation and appropriate legal bases connected to specific processing purposes.

4. Legal Bases for Processing Personal Data

HARNAN EDGE LIMITED processes personal data only where there is a lawful basis for doing so under applicable data protection law. The legal basis depends on the particular information being processed and the purpose for which it is processed.

4.1 Performance of a Contract or Pre-Contract Steps

We may process personal data where it is necessary to provide a Homelink360 service, administer your account or application, respond to a request you have made, or take steps at your request before entering into an agreement.

This may include processing information needed to verify your identity, evaluate and administer a service request, manage financial or repayment records, provide requested property-related services, communicate with you, and maintain records relating to the service.

4.2 Legal and Regulatory Obligations

We may process personal data where processing is necessary to comply with obligations imposed on HARNAN EDGE LIMITED by applicable Kenyan law, regulations, lawful orders or other applicable legal requirements.

This may include maintaining required records, addressing lawful requests, preventing or investigating unlawful activity, and meeting applicable regulatory, accounting, tax or reporting requirements.

4.3 Legitimate Interests

We may process personal data where necessary for legitimate interests pursued by HARNAN EDGE LIMITED or an authorised party, provided that those interests are not overridden by the rights and freedoms of the data subject.

These interests may include maintaining information security, preventing fraud and unauthorised access, protecting clients and the Company, investigating misuse of the platform, maintaining technical and security records, improving service reliability, and administering legitimate business operations.

Where we rely on legitimate interests, the processing will be relevant and proportionate to the purpose for which it is undertaken.

4.4 Consent

Where consent is the appropriate legal basis, we will request consent for a specific and clearly identified purpose and provide information necessary for you to understand what you are consenting to.

This may apply to particular uses of personal data where consent is required by law or where Homelink360 chooses to rely on consent for that particular processing activity.

Where consent is relied upon, you may withdraw your consent through an appropriate method provided by Homelink360. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.5 Processing Required for a Requested Service

Some information may be necessary for Homelink360 to provide a particular service. Where information is required for that purpose, failure to provide the required information may mean that we cannot process the request or provide the relevant service.

The specific information required will depend on the service being requested. For example, a service may require supporting financial information, location information, identity-verification information or other information relevant to the particular request.

4.6 No Blanket Consent

Acceptance of this Privacy Policy does not constitute blanket consent to every possible use of personal data.

Each processing activity must have an appropriate lawful basis and must be connected to a defined purpose. Where processing requires consent, consent will be addressed in a manner appropriate to that specific processing activity.

We will not use personal data for purposes incompatible with the purpose for which it was collected unless such further processing is permitted or required by applicable law or another lawful basis applies.

5. Sharing and Disclosure of Personal Data

HARNAN EDGE LIMITED does not sell your personal data. We may disclose or make personal data available only where necessary for a defined and lawful purpose connected with the operation of Homelink360, the provision of a requested service, protection of our systems and clients, or compliance with applicable law.

Depending on the circumstances, personal data may be shared with the following categories of recipients:

5.1 Homelink360 Personnel and Authorised Personnel

Personal data may be accessed by authorised employees, officers, contractors or other personnel who require the information to perform their legitimate responsibilities, including account administration, service processing, verification, credit or risk assessment, customer support, operations, security, compliance and management functions.

Access should be limited to information reasonably required for the relevant role and purpose.

5.2 Referring Agents and Service Participants

Where a client has been introduced or assisted by a referring agent, relevant information may be made available to that agent where necessary for the administration or facilitation of the relevant service and where permitted by applicable law.

The referring agent does not thereby obtain unrestricted access to the client’s personal information.

5.3 Property and Transaction-Related Parties

For property-related or housing services, relevant information may be shared with parties involved in the specific transaction where reasonably necessary to provide the requested service.

This may include a landlord or other transaction party where information is necessary to complete or administer the particular housing transaction. The current service terms state that approved amounts may be transferred directly to a landlord’s official rent payment account or as otherwise instructed for the specific housing transaction.

5.4 Service Providers and Technology Providers

We may use third-party service providers that support Homelink360’s operation, including providers of hosting, cloud infrastructure, storage, communications, security, software and other technical services.

The current implementation uses Google services, including Google Apps Script, Google Sheets and Google Drive, for parts of the system’s processing and storage infrastructure. M-Pesa statements and selfie files are currently stored using Google Drive infrastructure.

Website and email infrastructure may also involve service providers used by HARNAN EDGE LIMITED.

Where a third party processes personal data on behalf of HARNAN EDGE LIMITED, we will seek to ensure that the processing is governed by appropriate contractual, security and data-protection requirements.

5.5 Legal, Regulatory and Law-Enforcement Authorities

We may disclose personal data where required or permitted by applicable law, regulation, court order, lawful request or other valid legal process.

We may also disclose information where reasonably necessary to prevent, detect or investigate fraud, unlawful activity, security incidents or other misuse of Homelink360, subject to applicable law.

5.6 Recovery and Enforcement Parties

Where a client has failed to meet applicable obligations and lawful recovery action is required, relevant information may be shared with authorised parties involved in recovery or enforcement, subject to applicable law and the need to limit disclosure to relevant information.

The current Homelink360 service terms expressly contemplate the use of authorised partners for recovery of outstanding amounts and the pursuit of lawful recovery measures.

5.7 Business Transfers and Corporate Transactions

If HARNAN EDGE LIMITED undergoes a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, personal data may be transferred or disclosed where necessary for the transaction and permitted by applicable law.

Any such transfer will remain subject to applicable confidentiality, security and data-protection requirements.

5.8 Information We Do Not Share

We do not sell personal data for advertising or data-broker purposes.

We seek to disclose only information that is relevant and reasonably necessary for the specific purpose for which the disclosure is made, subject to applicable legal requirements.

Where personal data is shared with another party, HARNAN EDGE LIMITED will take appropriate steps to ensure that the recipient is permitted to receive the information and that appropriate safeguards are applied as required by law.

6. International and Cross-Border Data Transfers

HARNAN EDGE LIMITED is based in Kenya. Depending on the systems, technology providers and service providers used by Homelink360, personal data may be stored or processed in Kenya or in another country.

Where personal data is transferred, stored or processed outside Kenya, HARNAN EDGE LIMITED will do so only where permitted by applicable data-protection law and where the relevant legal requirements and safeguards have been satisfied.

Depending on the circumstances, these safeguards may include appropriate contractual protections, recognised data-protection safeguards, adequacy requirements, legally permitted contractual arrangements, or other safeguards recognised under Kenyan law.

Where applicable law requires explicit consent for an international transfer, particularly in relation to sensitive personal data, we will obtain the required consent and provide information about the relevant transfer and associated risks.

We may use international technology and infrastructure providers to support services such as secure storage, application infrastructure, communications, authentication, security and other technical functions. The location of processing may therefore depend on the provider, service and configuration being used at the relevant time.

We will take reasonable steps to ensure that personal data transferred outside Kenya continues to receive protection consistent with applicable Kenyan data-protection requirements.

Where Homelink360’s technology infrastructure changes, including migration to new databases, hosting environments or security systems, the applicable data-transfer arrangements will be reviewed and updated where necessary.

7. Data Retention

HARNAN EDGE LIMITED retains personal data only for as long as it is reasonably necessary for the purposes for which it was collected and processed, unless a longer retention period is required or permitted by applicable law or is otherwise necessary for a lawful purpose.

The period for which particular information is retained depends on its nature, the purpose for which it was collected, the ongoing relationship with the client, applicable legal and regulatory requirements, legitimate business and security needs, and whether the information is required for the establishment, exercise or defence of a legal claim.

Different categories of information may therefore be retained for different periods.

For example, information relating to an active client account, service request, financial transaction, repayment obligation, dispute, compliance requirement or security investigation may need to be retained for as long as reasonably necessary to administer that matter and satisfy applicable obligations.

Where personal data is no longer required for a lawful purpose, we will take appropriate steps to delete, erase, anonymise or pseudonymise it, subject to applicable law and any requirement to preserve information as evidence or for another lawful purpose.

Where appropriate, we may periodically review retained personal data to determine whether continued retention remains necessary and proportionate.

7.1 Client Communications and Archived Information

Information contained in client communications may be removed from the active client-facing view when it is archived. Archiving does not necessarily mean that the underlying information has been immediately or permanently deleted.

Archived information may continue to be retained where necessary for account administration, security, dispute resolution, audit, legal compliance or another lawful purpose.

7.2 Uploaded Documents and Images

Documents and images submitted in connection with a service, including M-Pesa statements and selfie photographs, may be retained for as long as reasonably necessary for the service, verification, security, legal, regulatory or other lawful purposes for which they are required.

Once the applicable retention purpose has expired, the information will be subject to appropriate deletion, erasure, anonymisation or pseudonymisation processes, subject to lawful retention requirements.

7.3 Changes to Retention Practices

Homelink360’s systems and infrastructure may change over time, including migration to databases, new hosting environments, security systems or other technology platforms.

Such changes will not alter the underlying retention principle: personal data will be retained only for as long as reasonably necessary for a defined lawful purpose or as otherwise required or permitted by applicable law.

8. Your Data Protection Rights

Subject to applicable law and any lawful limitations or exceptions, you have rights in relation to personal data that HARNAN EDGE LIMITED processes about you.

8.1 Right to Be Informed

You have the right to know that your personal data is being collected and used, the purposes for which it is processed, and other information required by applicable data-protection law.

8.2 Right of Access

You may request access to personal data that HARNAN EDGE LIMITED holds about you.

Where the legal requirements for access are satisfied, we will provide the applicable information in accordance with the timelines and procedures prescribed by law. Under the current Kenyan Regulations, an access request is generally to be complied with within seven days.

8.3 Right to Correction

You may request correction of personal data that is inaccurate, outdated, incomplete, untrue or misleading.

Where correction is justified, the current Regulations provide for rectification within fourteen days. Where a request is declined, reasons for the refusal should be provided in writing within the prescribed period.

8.4 Right to Object

You may object to the processing of all or part of your personal data where the law gives you that right.

An objection will be considered in accordance with the applicable legal basis and circumstances of the processing. Where processing is based on legitimate interests, the relevant legal requirements concerning overriding interests and objections will apply.

8.5 Right to Deletion or Erasure

You may request deletion or erasure of personal data where the conditions provided by law apply, including where the information is no longer necessary for the purpose for which it was collected or where another statutory ground for erasure exists.

The right to erasure is subject to legal exceptions. For example, information may need to be retained to comply with a legal obligation or for the establishment, exercise or defence of a legal claim. The current Regulations provide a fourteen-day response period for an erasure request.

8.6 Right to Data Portability

Where the legal requirements for portability are satisfied, you may request a copy or transfer of your personal data in accordance with applicable law.

The current Kenyan Regulations provide for portability requests and generally require fulfilment within thirty days, subject to the prescribed conditions and any lawful reasonable fee applicable to the request.

8.7 Right to Withdraw Consent

Where we process your personal data on the basis of consent, you may withdraw that consent.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Withdrawal may not require deletion of information where another lawful basis permits or requires continued processing.

8.8 Right to Human Intervention in Applicable Automated Processing

Where applicable, you may have rights in relation to automated decision-making and profiling, including the ability to obtain human intervention and express your point of view where required by law.

Homelink360 may use credit or risk-related information in assessing service requests. Where automated or partially automated decision-making is used, the applicable safeguards and rights under Kenyan law will apply, including relevant human-intervention requirements. The Regulations specifically address fairness and human intervention in automated decision-making.

8.9 Right to Lodge a Complaint

You may raise a privacy or personal-data complaint directly with HARNAN EDGE LIMITED using the privacy contact provided in this Policy.

Where you are not satisfied with how your personal-data concern has been handled, you may also exercise any right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or seek another remedy available under applicable Kenyan law.

8.10 Exercising Your Rights

To exercise a data-protection right, contact us at:

Email: hnandwa52@gmail.com

We may request information reasonably necessary to verify your identity before releasing, correcting, transferring or deleting personal data, particularly where the request involves sensitive or confidential information.

Requests will be handled in accordance with applicable Kenyan data-protection law and the procedures applicable to the particular right being exercised.

9. Security of Personal Data and Data Breach Response

HARNAN EDGE LIMITED takes reasonable and appropriate technical and organisational measures to protect personal data processed through Homelink360 against unauthorised access, loss, misuse, alteration, disclosure, destruction and other forms of unlawful or accidental processing.

The security measures applied to Homelink360 are designed with regard to the nature and sensitivity of the information processed, the risks associated with the processing, available technology, and the need to maintain appropriate protection throughout the information lifecycle.

9.1 Technical and Organisational Safeguards

Depending on the circumstances and the systems involved, our safeguards may include:

9.1.1 secure authentication and account-access controls;

9.1.2 strong cryptographic protection of authentication credentials and other security-sensitive information;

9.1.3 OAuth-based authentication and secure session management where applicable;

9.1.4 role-based and need-to-know access controls;

9.1.5 device and account security controls;

9.1.6 encryption and other technical protections for personal data where appropriate;

9.1.7 security monitoring, event logging and incident detection;

9.1.8 controls designed to reduce unauthorised access and fraudulent use;

9.1.9 secure handling of uploaded documents, photographs and other client information;

9.1.10 backup, recovery and service-continuity measures where appropriate; and

9.1.11 periodic review and improvement of security measures in response to identified risks, technological developments or security deficiencies.

Access to personal data is intended to be limited to authorised persons and service providers who require the information for a legitimate purpose.

No method of transmission, storage or electronic processing can be guaranteed to be completely secure. We therefore maintain security measures appropriate to the risks and continually review them as Homelink360’s systems and processing arrangements evolve.

9.2 Protection of Authentication Information

Authentication credentials are protected using security measures designed to prevent the recovery or disclosure of credentials in ordinary system operation.

Homelink360 may use additional authentication and security mechanisms, including secure session controls and device-related security checks, to help protect client accounts.

Where stronger authentication methods are introduced or updated, including cryptographic or passwordless authentication mechanisms, they will be implemented in accordance with applicable security and data-protection requirements.

9.3 Data Breach Response

If HARNAN EDGE LIMITED becomes aware of a personal data breach, we will assess the incident, take reasonable steps to contain and investigate it, mitigate potential harm, restore affected systems where necessary, and determine whether notification or communication is required under applicable law.

Where a personal data breach involves unauthorised access to or acquisition of personal data and there is a real risk of harm to affected data subjects, HARNAN EDGE LIMITED will notify the Data Commissioner without delay and within the period required by law, currently seventy-two hours from becoming aware of the qualifying breach.

Where required by law, affected data subjects will also be informed within the applicable period and provided with relevant information about the breach, the measures taken or proposed to address it, and reasonable steps they may take to reduce potential adverse effects. Communication may be delayed or restricted where permitted by law, including where necessary for the prevention, detection or investigation of an offence.

Where a service provider acting as a data processor becomes aware of a personal data breach, we require it to notify the relevant data controller without delay and, where reasonably practicable, within the period required by applicable law.

We maintain records of relevant personal data breaches, including the facts of the incident, its effects and the remedial measures taken, as required by law.

9.4 Security During Technology Changes

Homelink360’s technology infrastructure may change over time, including migration from existing systems to databases, new hosting environments, authentication systems or other technical platforms.

Such changes will be subject to appropriate security and data-protection considerations. Changing the underlying technology does not reduce the security obligations applicable to personal data processed by HARNAN EDGE LIMITED.

10. Children and Age Restrictions

Homelink360 is intended for individuals who have attained the age of 18 years.

Individuals under 18 years of age are not permitted to register for, access or use the Homelink360 client services.

We do not knowingly provide client-portal access or intentionally collect personal data from individuals under 18 for the purpose of providing Homelink360 client services.

Where we become aware that personal data relating to an individual under 18 has been collected through the Homelink360 client service contrary to this age restriction, we will take reasonable and appropriate steps to assess the circumstances and address the information in accordance with applicable Kenyan data-protection law.

Nothing in this section affects any lawful processing of information relating to a child that HARNAN EDGE LIMITED may be required or permitted to undertake for a separate legal, regulatory, security or other lawful purpose.

11. Cookies and Similar Technologies

Homelink360 may use cookies and similar browser technologies where necessary to operate, secure and improve the client portal and website.

These technologies may be used for purposes such as:

11.1 maintaining secure authentication and session state;

11.2 remembering security or device-related information;

11.3 protecting accounts and detecting unauthorised or fraudulent activity;

11.4 maintaining essential application functionality; and

11.5 understanding technical usage where necessary to maintain security, performance and reliability.

The Homelink360 client portal may use browser storage technologies, including local storage, for security-related purposes such as maintaining a device identifier associated with the client browser. Such information is used to support account and device-security controls.

We do not use cookies or similar technologies to sell your personal data or for behavioural advertising unless this is expressly disclosed to you and permitted by applicable law.

The technologies used by Homelink360 may change as our systems develop. For example, authentication and session technologies may be updated when new security mechanisms, databases or authentication systems are introduced.

You can control or restrict certain browser storage and cookie technologies through your browser or device settings. Disabling technologies required for essential security or authentication functions may prevent some parts of Homelink360 from operating correctly.

12. Third-Party Services and Technology Providers

HARNAN EDGE LIMITED may use third-party technology and service providers to support the operation, security and delivery of Homelink360.

These providers may process personal data on behalf of HARNAN EDGE LIMITED, or may process certain information independently in accordance with their own legal obligations and published terms or privacy notices.

12.1 Google Services

Homelink360 currently uses Google services as part of its technical infrastructure, including services used for application processing, data storage and file storage.

Depending on the service involved, this may include Google Apps Script, Google Sheets, Google Drive and related Google infrastructure. For example, documents submitted through the client portal, including M-Pesa statements and selfie photographs, may be stored using Google storage infrastructure.

Where Homelink360 uses Google OAuth or another Google authentication service, Google may process the information necessary to authenticate the user and provide the authentication service. Homelink360 will request and use only the information and permissions necessary for the relevant functionality.

Homelink360 does not represent its ordinary use of Google infrastructure as meaning that it collects a user’s Google profile information for unrelated purposes.

Google may process information in accordance with Google’s own privacy policies, security practices, terms and applicable contractual arrangements.

12.2 Hosting, Email and Infrastructure Providers

HARNAN EDGE LIMITED may use providers of website hosting, email, cloud infrastructure, security, backup, communications and related technical services.

Our current hosting and webmail provider is Truehost.

Such providers may process information necessary to provide the relevant technical service, subject to applicable contractual and data-protection requirements.

12.3 Future Database and Infrastructure Providers

As Homelink360’s technology develops, including migration from its current systems to database-based infrastructure, HARNAN EDGE LIMITED may engage additional infrastructure, database, hosting, security or cloud-service providers.

Where such providers process personal data on behalf of HARNAN EDGE LIMITED, we will seek to ensure that appropriate contractual, security and data-protection safeguards apply.

Changes to the underlying technology or service provider do not change the purposes for which personal data may lawfully be processed.

12.4 Authentication and Security Providers

Homelink360 may use third-party technologies or providers supporting secure authentication, authorisation, fraud prevention, identity verification, session security and related security functions.

Where OAuth, cryptographic authentication, passwordless authentication or other secure authentication mechanisms are used, the relevant provider may process limited information necessary to perform that function.

12.5 Service-Specific Providers

Where a particular Homelink360 service requires involvement of another service provider or external service participant, relevant personal data may be shared only to the extent reasonably necessary for that service and where permitted by applicable law.

12.6 Provider Access to Personal Data

Where a provider acts on behalf of HARNAN EDGE LIMITED, we will seek to restrict its access and processing to what is necessary for the contracted service and require appropriate confidentiality, security and data-protection measures.

We do not authorise third-party providers to sell Homelink360 client personal data for advertising or data-broker purposes.

12.7 Provider Changes

The specific technology providers used by Homelink360 may change over time. This may occur as a result of system upgrades, database migration, security improvements, operational requirements or changes in service availability.

Where a material change affects how personal data is processed, transferred or protected, HARNAN EDGE LIMITED will review the relevant privacy, contractual and security requirements and update this Privacy Policy where appropriate.

13. Automated Decision-Making, Profiling and Credit or Risk Assessment

Homelink360 may use personal data to assess eligibility, creditworthiness, affordability, repayment behaviour, risk and suitability for particular services. This may include information such as credit scores, risk categories or bands, qualifying amounts, previous service or loan history, repayment performance, transaction information and information contained in supporting documents.

Where applicable, Homelink360 may use automated or partially automated processes, including rules, calculations, scoring methods or other analytical tools, to support these assessments. The client portal currently displays credit-score and related assessment information, including a score, risk category and qualifying amount.

Homelink360 does not describe every assessment or decision as being solely automated unless that is in fact how the relevant process operates. Where a decision is made solely by automated processing and has a legal or similarly significant effect on you, Homelink360 will provide the notices and safeguards required by applicable data protection law, including information about the automated processing, the significance and envisaged consequences where applicable, and an appropriate opportunity to seek human intervention, express your point of view or request reconsideration.

Homelink360 will take reasonable measures to promote accuracy, fairness and appropriate use of personal data in profiling or automated assessment, including measures to identify and correct inaccurate information and to reduce the risk of inappropriate or discriminatory outcomes. Where required by law, Homelink360 will carry out an appropriate Data Protection Impact Assessment for processing that presents a high risk to the rights and freedoms of data subjects. Kenyan regulations specifically identify certain automated decision-making involving profiling, sensitive personal data or significant effects on access to services as high-risk processing.

You may contact Homelink360 using the contact details in this Privacy Policy to request access to relevant personal data, correction of inaccurate information, or review of a decision where applicable. Nothing in this section limits any rights available to you under the Data Protection Act, 2019 or other applicable law.

14. Sensitive Personal Data, KYC and Verification Information

Homelink360 may process identification, financial, location, address, supporting-document and verification information when this is necessary for providing its services, assessing requests, maintaining account security, preventing fraud, meeting legal or regulatory obligations, or protecting the rights and legitimate interests of Homelink360 and its clients.

The client portal may collect and process information such as an identification number, M-Pesa statement, statement PDF security PIN, selfie or photograph, precise location coordinates, address information, device information and transaction or repayment information. The client backend records references to uploaded M-Pesa statements and selfies and may associate those records with a client’s service request.

Some information processed by Homelink360 may constitute sensitive personal data under Kenyan law depending on its content and circumstances. This may include information falling within statutory categories such as biometric data, property details, health information, family information or other categories defined by applicable law. Homelink360 will apply the additional safeguards and lawful grounds required for processing sensitive personal data.

A selfie or photograph submitted through Homelink360 is used for the stated verification or service-related purpose. Homelink360 does not currently use the selfie process to perform facial recognition, create biometric templates or perform biometric matching.

The statement PDF security PIN requested by Homelink360 refers only to the unique security PIN associated with the particular statement PDF request. It is not an M-Pesa account PIN, transaction PIN or mobile-money account credential. Homelink360 will treat this information as confidential verification information and will not use it for an unrelated purpose.

Where consent is required by applicable law, Homelink360 will seek consent in a manner that is specific, informed and capable of being withdrawn, subject to lawful limitations. Where another lawful basis applies, processing will be limited to what is reasonably necessary for that basis and the relevant service or legal obligation. Sensitive personal data will not be processed merely because it is convenient to do so.

Homelink360 may request additional information or verification where reasonably necessary to protect an account, verify identity, process a service request, investigate suspected fraud or comply with legal or regulatory requirements. You may exercise the data protection rights described elsewhere in this Privacy Policy in relation to such information.

15. Data Accuracy, Minimisation and Client Responsibilities

Homelink360 aims to collect and use personal data that is adequate, relevant and limited to what is necessary for the particular purpose for which it is processed. The information requested through the client portal is intended to support account management, identity and service verification, service requests, credit or risk assessment, transaction processing, security and other purposes described in this Privacy Policy. The client request process may require information such as identification details, address information, supporting documents, location information and verification photographs.

You are responsible for providing information that is truthful, accurate, complete and current to the best of your knowledge. You should promptly notify Homelink360 when information relevant to your account or an active service request changes or is inaccurate.

Homelink360 will take reasonable steps to maintain the accuracy of personal data and to correct or update information where an inaccuracy is identified or brought to its attention. Kenyan law requires personal data to be accurate and, where necessary, kept up to date, with reasonable steps taken to rectify inaccurate data without delay.

Where information is required for identity verification, service eligibility, credit or risk assessment, fraud prevention, legal compliance or another legitimate purpose, failure to provide the required information, or providing inaccurate or misleading information, may affect Homelink360’s ability to provide the relevant service, process a request or maintain account access.

Homelink360 will not require additional personal information merely for convenience where that information is not reasonably relevant or necessary to the applicable purpose. Where a particular service requires additional information, Homelink360 will seek to explain the purpose for which that information is required.

16. Direct Marketing and Promotional Communications

Homelink360 may communicate with you where necessary to provide, administer or secure the services you have requested. These communications may include account and security notices, service-request updates, transaction or repayment information, verification requests, support communications and other information necessary for the operation of your account or requested service. These are service communications and are not treated as direct marketing.

Where Homelink360 uses personal data for direct marketing or promotional communications, it will do so in accordance with applicable Kenyan law. Where consent is required, Homelink360 will obtain the required consent before using your personal data for direct marketing and will provide a clear and simple mechanism for withdrawing that consent or opting out of future promotional communications. Kenyan regulations require a simplified opt-out mechanism and prohibit continued use or disclosure for direct marketing after a valid opt-out request.

You may opt out of direct marketing without affecting your ability to receive essential communications relating to your account, security, transactions, active requests, contractual obligations or services you have requested. An opt-out from marketing will therefore not be treated as a request to stop necessary service or legally required communications.

The client messaging functionality currently supported by Homelink360 is used for client-service communications and support rather than establishing that a separate promotional marketing channel exists. Where Homelink360 introduces additional communication channels or promotional programmes, the applicable privacy notices, consent and opt-out mechanisms will be updated as necessary.

17. Data Security, Access Controls and Confidentiality

Homelink360 takes reasonable technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, destruction or other forms of unlawful or accidental processing.

Security measures may include access controls, authentication controls, device-security measures, protection of credentials, secure transmission and storage, security logging, monitoring, backups, vulnerability management and procedures for responding to security incidents. The client portal currently includes PIN hashing and salting, failed-attempt controls, account locking, registered-device controls and security-event logging.

Personal data is accessible only to persons, systems or service providers that have a legitimate need to access it for authorised processing activities. Access may be differentiated according to role and responsibility, and access to supporting documents or other sensitive information may be restricted where appropriate.

M-Pesa statements and client selfies submitted through the portal are stored as files in designated Google Drive locations and are associated with client records or service requests through file references. Homelink360 will apply appropriate controls to these records and will seek to prevent unauthorised access, copying, alteration or disclosure.

Homelink360 does not guarantee that any electronic system or method of transmission is completely secure. Where a security incident occurs, Homelink360 will assess the incident and take reasonable containment, investigation, remediation and notification measures required by applicable law. Where applicable, affected clients and relevant authorities will be notified in accordance with the legal requirements governing personal-data breaches.

Security controls may change as Homelink360’s technology infrastructure develops, including the planned transition to database-based storage and improvements to authentication and account-security architecture. Such changes will not reduce the requirement to protect personal data through appropriate technical and organisational safeguards.

Kenyan data-protection regulations require organisations to restrict access to authorised personnel, secure storage and transfers, maintain appropriate backups and logs, use audit trails and event monitoring, protect sensitive personal data, maintain breach-response procedures and regularly review systems for vulnerabilities.

18. Personal Data Breaches and Notification

Homelink360 maintains procedures for identifying, assessing, containing, investigating and responding to personal data breaches and other security incidents involving personal data.

A personal data breach may include unauthorised access to, acquisition of, disclosure of, alteration of, loss of or destruction of personal data. Homelink360 will assess the nature and circumstances of an incident, the categories and amount of personal data affected, the persons potentially affected, and the likelihood and severity of harm.

Where personal data has been accessed or acquired by an unauthorised person and there is a real risk of harm to the affected data subject, Homelink360 will notify the Data Commissioner without delay and within the period required by applicable Kenyan law. Under section 43 of the Data Protection Act, 2019, this period is within 72 hours of becoming aware of the breach. Where notification is made after that period, the law requires reasons for the delay to accompany the notification.

Where a qualifying breach is required to be communicated to affected data subjects, Homelink360 will provide the information required by law within a reasonably practical period. This may include the nature of the breach, measures taken or proposed to address it, steps that affected individuals can take to reduce potential harm, and an appropriate contact point for further information. Communication may be delayed or restricted where permitted by law, including where necessary and proportionate to assist the prevention, detection or investigation of an offence.

Where a data processor handling Homelink360 personal data becomes aware of a personal data breach, Homelink360 requires the processor to notify the relevant data controller without delay and, where reasonably practicable, within 48 hours, as provided by the Data Protection Act.

Homelink360 will maintain records relating to personal data breaches, including relevant facts, effects and remedial action, and will take reasonable steps to prevent recurrence. Not every technical or security incident necessarily constitutes a legally notifiable personal data breach; notification will be determined according to the applicable legal requirements and the circumstances of the incident.

19. Complaints, Privacy Contact and the Office of the Data Protection Commissioner

Homelink360 aims to handle personal data fairly, lawfully and transparently and to address concerns raised by clients about the collection, use, disclosure, storage or security of their personal data.

If you have a question, concern or complaint about how Homelink360 handles your personal data, you should contact HARNAN EDGE LIMITED using the privacy contact details provided in this Privacy Policy:

Email: hnandwa52@gmail.com

Address: Western Heights, Westlands, Nairobi, Kenya

Homelink360 will review privacy complaints and take reasonable steps to investigate and address legitimate concerns. Where appropriate, we may request information reasonably necessary to verify your identity and properly investigate the matter.

Homelink360 has not currently designated a Data Protection Officer. The privacy contact above is therefore the designated contact point for privacy and data-protection enquiries unless and until Homelink360 appoints or designates a Data Protection Officer and publishes the relevant contact details.

Nothing in this Privacy Policy limits your right to make a complaint to the Office of the Data Protection Commissioner (ODPC) where you believe your personal-data rights have been infringed. The ODPC provides an official process for data subjects to lodge complaints concerning the handling or misuse of personal data.

The ODPC can be contacted through its official complaint channels, including its online complaint process. Its published contact details include info@odpc.go.ke and telephone 0207801800.

Homelink360 will cooperate with lawful investigations, regulatory enquiries and directions issued by the ODPC or another competent authority in accordance with applicable law.

20. Changes to This Privacy Policy

HARNAN EDGE LIMITED may update this Privacy Policy from time to time to reflect changes in Homelink360’s services, technology, data-processing practices, security measures, legal or regulatory requirements, or the introduction of new service providers or processing activities.

The latest version of this Privacy Policy will be made available through the Homelink360 website. Where a change is material and applicable law requires additional notice or consent, Homelink360 will provide the required notice or seek the required consent before the relevant processing takes effect.

The effective date displayed with the Privacy Policy will indicate the version currently applicable. Clients are encouraged to review the Privacy Policy periodically so that they remain informed about how their personal data is handled.

Any update to the Privacy Policy will not remove or reduce rights already available to you under applicable data-protection law.

21. Effective Date and Contact Details

This Privacy Policy applies to Homelink360 services operated by HARNAN EDGE LIMITED and is intended to explain how personal data is handled in connection with those services.

Data Controller:
HARNAN EDGE LIMITED

Physical Address:
Western Heights, Westlands, Nairobi, Kenya

Website:
https://www.homelink360.co.ke/

Privacy Policy:
https://www.homelink360.co.ke/privacy-policy/

Terms of Service:
https://www.homelink360.co.ke/terms-of-service/

Privacy Contact:
hnandwa52@gmail.com

This Privacy Policy should be read together with the Homelink360 Terms of Service and any other privacy notices or disclosures provided in connection with a particular service or processing activity.

The effective date and version of this Privacy Policy should be displayed on the published policy page. Where this Privacy Policy is updated, the latest published version will apply from its stated effective date, subject to any additional notice or consent required by applicable law.