.png)
Last updated: 24 July 202
Who we are
Waterfall Country Homes Management Ltd. (“Waterfall”, “we”, “our”, “us”)
PLOT 1026, Nairobi, Kenya
Email: info@waterfalls.co.ke │ Tel: +254 757 446 117
Scope of this notice
This Policy explains how we collect, use, share and protect personal information when you:
- visit waterfalls.co.ke or any sub-domain,
- communicate with us by phone, e-mail or in person,
- interact with us via WhatsApp or other messaging channels integrated into our systems.
What data we collect
| Category | Typical items | How we collect |
| Identity & contact | name, postal address, e-mail, phone/WhatsApp number, national ID ⁄ passport (for tenancy files) | enquiry forms, WhatsApp chat, lease agreement |
| Account & contract | lease start/end dates, unit number, payment history, service tickets | Odoo ERP & CRM |
| Communications | messages, attachments, call recordings, support tickets | WhatsApp Business Platform, phone, e-mail |
| Usage & device | IP address, browser type, operating-system data, page interactions | website analytics cookies |
| Marketing preferences | opt-in/opt-out status, message template history | newsletter/WhatsApp subscription forms |
Lawful bases & purposes
| Purpose | Lawful basis (Kenya DPA 2019 / GDPR) |
| Account set-up, tenancy management, invoicing | Contract performance |
| Customer support via WhatsApp & phone | Contract performance / Legitimate interest |
| Outage or safety alerts | Vital interest / Legitimate interest |
| Marketing of new developments & events | Consent (you may withdraw any time) |
| Legal, tax & regulatory compliance | Legal obligation |
How we use WhatsApp Business Platform
- We use Meta’s WhatsApp Cloud API to send you transactional (e.g., payment receipts) and, where you have opted-in, marketing messages.
- Your phone number and message metadata are shared with Meta Platforms Ireland Ltd. and its affiliates solely to deliver and route the messages.
- Message content remains end-to-end encrypted; Meta cannot read it. WhatsApp BusinessFacebook Developers
- Meta processes this data under the WhatsApp Business Data Processing Terms and WhatsApp Business Messaging Policy. WhatsApp Business
Sharing your information
We do not sell your data. We only share it:
- with service providers acting under our instructions (e.g., Odoo S.A. cloud hosting in the EU, payment processors, maintenance contractors);
- with Meta Platforms for WhatsApp message delivery (see §5);
- when required by law, court order or to protect vital interests.
All third parties are bound by confidentiality and data-processing agreements.
International transfers
Odoo and Meta may store data on servers located in the European Union or United States.
Whenever data leaves Kenya/EU we rely on:
- contractual Standard Contractual Clauses (SCCs) or
- adequacy decisions / certified frameworks (e.g., EU-US Data Privacy Framework).
Retention
| Data set | Retention period |
| Lease, billing & statutory records | 7 years after contract end (tax laws) |
| WhatsApp & e-mail threads | 3 years after last interaction, unless needed longer for dispute resolution |
| Marketing opt-in logs | until you withdraw consent + 1 year for audit |
| Website analytics | 26 months (aggregated thereafter) |
When retention expires, data is securely deleted or irreversibly anonymised.
Security measures
We apply industry-standard safeguards including TLS encryption, access-control lists, 2-factor authentication for staff, regular security audits and data-backup routines.
Your rights
You may, at reasonable intervals and free of charge:
- Access the personal data we hold about you;
- Correct incomplete or inaccurate data;
- Delete or object to processing where legally permissible;
- Withdraw consent for marketing at any time (reply STOP on WhatsApp or e-mail us);
- Request data portability (Kenya DPA §38; GDPR Art. 20);
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya or your local supervisory authority.
Children
Our services target adults (18+). We do not knowingly collect data from children. If you believe a minor has provided us personal data, contact us and we will delete it.
Changes to this Policy
We may update this notice from time to time. Material changes will be highlighted on our website and, where appropriate, notified via e-mail or WhatsApp.
Contact
For any privacy enquiries, exercise of rights, or whistle-blowing concerns, e-mail privacy@waterfalls.co.ke or write to our postal address above.