Privacy Policy
Last updated: July 20, 2026
1. Who we are
UniStay operates a platform connecting students with student accommodation landlords in Kenya. We are committed to protecting your personal data in accordance with Kenya's Data Protection Act, 2019.
2. What data we collect
From students:
- Full name, phone number, email, institution name
- Booking history and messages sent through the platform
- M-Pesa phone number and transaction references for deposit payments
- Reviews and reports you submit
- Device/technical data (IP address, browser type) for security and service operation
From landlords:
- Full name, phone number, email
- Identity/verification documents submitted during landlord verification
- Hostel listing details (location, pricing, capacity, images)
- M-Pesa phone number and transaction references for hosting fee payments and reservation fee payouts
We do not collect: payment card numbers (M-Pesa transactions are handled via Safaricom's Daraja API; we store transaction references and receipts, not payment credentials), or any data unrelated to the accommodation-booking purpose of the platform.
3. Why we collect it (lawful basis)
- Performance of a contract — to create your account, process a booking, or process a payment
- Legitimate interest — verifying landlord identity, detecting fraud, resolving disputes, and improving the platform
- Legal obligation — retaining transaction records as required by Kenyan financial and tax law
- Consent — where we ask separately (e.g. marketing communications, if introduced)
4. How we use your data
- To operate bookings, payments, messaging, reviews, and dispute resolution
- To verify landlord identity before a listing is published
- To send you transactional notifications (booking status, invoice/payment confirmations, dispute updates) via email and push notifications
- To investigate reports of fraud, misrepresentation, or Terms violations
- To comply with legal and regulatory obligations, including those relating to payment processing
We do not sell personal data to third parties.
5. Who we share data with
- Safaricom (M-Pesa/Daraja API) — to process reservation fee payments, landlord hosting fee payments, and reservation fee payouts
- Email providers — to deliver transactional emails
- Hosting/infrastructure providers — to store and operate the platform's data and infrastructure
- Landlords and students, to each other, in limited form — e.g. a landlord sees a booking student's name and phone number once a booking is requested; a student sees a landlord's verified contact details for an approved booking
- Law enforcement or regulators, where required by Kenyan law
6. Data retention
- Account and booking data is retained for as long as your account is active, plus 3 years after closure for financial record-keeping and dispute resolution
- M-Pesa transaction records are retained as required by applicable Kenyan financial regulations
- Landlord verification documents are retained for as long as the landlord account is active, plus 3 years after account closure
7. Your rights under the Data Protection Act, 2019
As a data subject, you have the right to:
- Be informed of how your data is used (this policy)
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data, subject to our legal obligations to retain certain records (e.g. financial transaction history)
- Object to or restrict certain processing
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data has been mishandled
To exercise these rights, contact us at support@unistayhostels.co.ke
8. Security
We use industry-standard measures to protect your data, including row-level access controls on our database, encrypted connections, and restricted access to payment-related records. No system is completely secure, and we cannot guarantee absolute security.
9. Children
UniStay is intended for use by students of higher-education age. It is not directed at children under 18.
10. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via the platform or by email before they take effect.
11. Contact
For privacy-related queries, contact us at support@unistayhostels.co.ke