Privacy policy

LeaseForce Systems Limited operates Occupy and is the data controller for the personal data described here, under the Kenya Data Protection Act, 2019. Contact: [email protected]. Where a lister receives a guest's details through an enquiry, the lister is responsible for its own use of them.

• Account details: name, email, phone number, password (stored only as a secure hash) and, for Google sign-in, the profile Google shares.
• Lister details: organisation name, contact details, logo and branding, and the listings, photos, videos and documents uploaded.
• Activity on the site: enquiries, messages and attachments, booking requests, saved spaces, saved searches, lister follows and "notify me" alerts, reports and feedback.
• Anonymous usage data: pages visited, time on a listing, taps on buttons such as WhatsApp, Call or Save, searches and how many results they found, and which sponsored items were shown or clicked - tied to a random number stored in the browser, not to a name, email, phone number or IP address.
• Technical data: device type and browser, needed to run and secure the service.
• Payments: when a lister buys promotion credits, the payment is handled by Paystack; Occupy receives the outcome, not card details.

• To provide the service: accounts, listings, search, messages, bookings, alerts and notifications (contract).
• To pass an enquiry or booking request to the lister it is addressed to, so they can respond (contract).
• To keep the marketplace safe: verification, fraud and spam checks, reports and listing quality (legitimate interests).
• To improve search and show listers how their listings perform, using anonymous usage data (legitimate interests; can be switched off).
• To meet legal, tax and accounting obligations (legal obligation).

• Listers: the details included in an enquiry, message or booking request go to the lister it is sent to. Listers see counts of followers and people waiting on a space, never who they are.
• Service providers who process data for us under contract: hosting and storage, email and SMS delivery, and payments (Paystack). They may not use it for their own purposes.
• LeaseForce: where a lister connects its LeaseForce account, listings sync from LeaseForce and enquiries for that lister can be read in LeaseForce.
• Authorities where the law requires it.

Personal data is never sold. No third-party advertising or tracking cookies are used; sponsored content is chosen and counted by Occupy itself.

Data may be stored and processed on servers outside Kenya. Where it is, LeaseForce Systems Limited relies on safeguards permitted by the Data Protection Act, 2019 and its regulations, and providers that offer a level of protection at least equivalent to Kenyan law.

• Account, listing, message and booking data: while the account exists, then deleted or anonymised within 90 days of closure, except what must be kept by law.
• Anonymous usage data: 13 months, then deleted.
• Payment and tax records: as long as Kenyan tax and accounting law requires.

The site stores a sign-in session, display preferences (theme, layout) and the random usage-data number in the browser, and keeps a count of sponsored items shown that day so the same one does not repeat too often. All of these stay on the device. Usage data can be switched off at any time in Settings › Privacy, and is off when the browser sends Do Not Track.

Under the Data Protection Act, 2019, anyone may:

• be told how their personal data is used, and get a copy of it;
• have inaccurate data corrected, or data deleted where it is no longer needed;
• object to its use for legitimate interests, and withdraw consent where consent was the basis;
• ask for their data in a portable format.

Requests go to [email protected] and are answered within the time the law allows. An account and its data can also be deleted from Settings. Anyone unhappy with the response can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Data is encrypted in transit, passwords are hashed, sensitive secrets are encrypted at rest, and access inside each lister's organisation is limited by roles and enforced in the database. No system is perfectly secure; suspected breaches are handled and notified as the law requires.

Occupy is not intended for anyone under 18, and does not knowingly collect their personal data.

This policy will be updated as the service changes. Material changes will be announced on the site or by email; the date at the top shows the latest version.