Privacy policy

1. Introduction

Welcome to ITorama Property Management Agency ("ITorama", "we", "us", or "our"). We operate the ITorama platform and the Pegasus Property Management System (PMS) accessible at pegasus-pms.co.ke (collectively, the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our platform, or connect our Service with third-party platforms such as Facebook. Please read this policy carefully. By using the Service, you agree to the practices described here.

If you do not agree with the terms of this Privacy Policy, please do not use the Service.

2. Information We Collect

We collect information that you provide directly, information collected automatically, and information received from third-party services you connect to our platform.

2.1 Information You Provide Directly

• Account registration details: full name, email address, phone number, and password.

• Property and unit information: property names, addresses, unit numbers, and rental amounts.

• Tenant information: tenant names, phone numbers, email addresses, lease start/end dates, and rent amounts.

• Payment records: M-Pesa transaction references, payment amounts, and dates.

• Communications: messages or inquiries submitted through our contact form.

• Business information: company name, KRA PIN (where required for invoicing), and banking details.

2.2 Information Collected Automatically

• Log data: IP address, browser type, operating system, referring URLs, pages viewed, and time spent on pages.

• Device information: device type, unique device identifiers, and mobile network information.

• Cookies and similar tracking technologies: session cookies, persistent cookies, and analytics identifiers. See our Cookie section below.

• Usage data: features accessed, actions taken within the platform, and frequency of use.

2.3 Information from Third-Party Services (Including Facebook)

If you choose to connect your account to Facebook or use Facebook Login, we may receive the following information from Facebook, subject to your privacy settings on Facebook:

• Your Facebook user ID.

• Your public profile information: name and profile picture.

• Your email address (if you grant permission).

• Any other information you explicitly authorize Facebook to share with us.

We only request the minimum permissions necessary to authenticate your identity and provide the Service. We do not access your Facebook friends list, timeline, or private messages unless you explicitly grant such access.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To create and manage your account and provide access to the Service.

• To process and record M-Pesa payments, generate receipts, and produce financial reports.

• To send rent invoices, payment confirmations, and reminders to you and your tenants via SMS or WhatsApp.

• To generate lease agreements and other property management documents.

• To provide customer support and respond to inquiries.

• To improve, personalize, and expand our Service based on usage patterns.

• To send transactional and service-related communications (e.g., account alerts, system updates).

• To send promotional or marketing communications, where you have given consent or where permitted by law.

• To comply with applicable legal obligations, including tax and financial reporting requirements in Kenya.

• To detect, prevent, and address fraud, security breaches, and other harmful activities.

• To authenticate your identity when you use Facebook Login.

3.1 Use of Facebook Data

Information obtained through Facebook Login is used solely to authenticate your identity and pre-fill your account registration details (name and email). We do not use your Facebook data for advertising, profiling, or any purpose beyond authenticating you and operating your account. We do not sell, transfer, or share Facebook user data with third parties except as described in Section 4 of this policy.

Our use of information received from Facebook APIs will adhere to Meta's Platform Terms and Facebook's Developer Policies.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

4.1 Service Providers

We may engage trusted third-party companies and individuals to perform services on our behalf, such as hosting infrastructure, SMS/WhatsApp delivery, email delivery, and analytics. These service providers are contractually bound to protect your information and may not use it for any purpose other than providing the service.

4.2 Business Transfers

If ITorama is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.

4.3 Legal Compliance

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., courts or government agencies in Kenya), or to protect the rights, property, or safety of ITorama, our users, or the public.

4.4 With Your Consent

We may share your information with other parties where you have given us explicit consent to do so.

4.5 Facebook Data — No Unauthorized Sharing

We do not transfer, sell, or share data received from Facebook (including Facebook user IDs and profile information) with any third party, advertiser, or data broker. Facebook data is not used for re-targeting or audience enrichment on any platform.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service. A cookie is a small data file placed on your device. We use the following categories of cookies:

• Essential cookies: Required for the Service to function correctly (e.g., session authentication, CSRF protection). These cannot be disabled.

• Analytics cookies: Help us understand how users interact with the Service (e.g., pages visited, time on site). We use this data in aggregate and anonymised form.

• Preference cookies: Remember your settings and preferences (e.g., language, timezone).

You can control cookies through your browser settings. Disabling certain cookies may limit the functionality of the Service.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained for the duration of your account and for up to 7 years after account closure to comply with Kenyan tax and financial record-keeping obligations (Income Tax Act, VAT Act).

• Payment records and financial data: Retained for a minimum of 7 years as required by Kenyan law.

• Communication records: Retained for up to 3 years.

• Log and analytics data: Retained for up to 12 months.

• Facebook authentication data: Retained only for as long as required to maintain your active session. We do not store Facebook access tokens beyond the authenticated session.

When retention periods expire, we securely delete or anonymise your data. You may request early deletion of your data as described in Section 8.

7. Data Security

We implement industry-standard technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using TLS/SSL.

• Encrypted storage for sensitive fields (e.g., passwords are hashed using bcrypt).

• Role-based access controls to limit employee access to personal data.

• Regular security assessments and vulnerability testing.

• Secure server infrastructure hosted in reputable cloud environments.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and we encourage you to use strong, unique passwords and enable two-factor authentication where available.

In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.

• Correction: Request correction of inaccurate or incomplete data.

• Deletion: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.

• Portability: Receive your data in a structured, machine-readable format.

• Objection: Object to processing of your data for direct marketing purposes.

• Restriction: Request that we restrict processing of your data in certain circumstances.

• Withdrawal of consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at mkieru55@gmail.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

8.1 Deleting Facebook-Connected Data

If you used Facebook Login, you may revoke our app's access to your Facebook account at any time through Facebook's settings at facebook.com/settings → Apps and Websites. Revoking access will disconnect your Facebook account from our Service. To delete the Facebook data we have stored (name, email, Facebook user ID), email us at mkieru55@gmail.com with the subject line "Facebook Data Deletion Request" and we will process your request within 30 days.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information without parental consent, please contact us at mkieru55@gmail.com and we will take steps to delete such information.

10. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services (such as M-Pesa, Facebook, WhatsApp, or SMS providers). This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use.

11. International Data Transfers

ITorama is based in Nairobi, Kenya. Your information may be processed and stored on servers located outside Kenya, including in the European Union or the United States, where our infrastructure providers operate. Where we transfer data internationally, we ensure appropriate safeguards are in place (such as standard contractual clauses or equivalent protections) consistent with applicable data protection law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of the page. For material changes, we will notify you by email or by a prominent notice within the Service at least 14 days before the change takes effect.

Your continued use of the Service after any changes constitute your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: