Privacy Policy

Tanduu LLC ("we", "us") operates the MakaoYetu property management platform. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the Kenya Data Protection Act 2019 (DPA) and the Office of the Data Protection Commissioner (ODPC) requirements, as well as internationally recognised data protection principles.

1. Data controller

Tanduu LLC
7901 4th St N, #18305, St. Petersburg, FL 33702, USA
Email: info@tanduu.com

2. Data we collect

Depending on your role and configuration, we may process:

• Account data: name, email, phone, organisation name, login credentials (hashed), role assignments;
• Property & tenant data: unit details, lease information, tenant names, contact numbers, ID references you choose to store, meter readings, invoices, and payment records;
• Technical data: IP address, browser type, audit logs, session metadata, and security events;
• Communications: support messages and demo signup requests.

3. Purpose limitation

We use personal data solely to provide, secure, and improve the MakaoYetu service | including rent management workflows, billing, notifications, customer support, and legal compliance. We do not use tenant or landlord data for unrelated marketing profiling.

4. Legal bases (Kenya DPA)

Processing is based on contract performance (providing the SaaS you subscribed to), legitimate interests (security, fraud prevention, product improvement), consent where required (e.g. platform support access), and legal obligations.

5. Security

Data in transit is protected using TLS/SSL encryption. Production databases run on secured infrastructure with access restricted to authorised personnel. Passwords are stored using industry-standard hashing. Platform administrators may access client accounts only when explicit support consent is enabled or for audited super-admin troubleshooting.

6. No sale of data

We never sell customer or tenant data and do not share it with third-party advertisers. Sub-processors (hosting, email, payment gateways such as IntaSend, SMS providers) receive only the minimum data required to deliver their service and are bound by contractual confidentiality obligations.

7. International transfers

Tanduu LLC is incorporated in the United States. Where data is processed outside Kenya, we apply appropriate safeguards consistent with the DPA and ODPC guidance.

8. Retention

We retain data for as long as your subscription is active and for a reasonable period thereafter for backups, legal claims, and audit requirements. You may request deletion subject to statutory retention duties.

9. Your rights

Under the Kenya DPA you may request access, correction, deletion, restriction, or portability of your personal data, and lodge a complaint with the ODPC. Contact info@tanduu.com to exercise your rights.

10. Changes

We may update this Policy. Material changes will be posted on this page with an updated date.