Sadiamond Properties Limited
Privacy policy
How Sadiamond Properties Limited collects, uses, and shares personal data on this website, in client records, and in staff tools.
Last updated 23 June 2026
Who we are
Sadiamond Properties Limited is the data controller for the personal data described on this page. We are a Nairobi real estate firm. Our office is at Third Floor, The Promenade, General Mathenge Drive, Westlands, Nairobi.
Questions about your data: [email protected] or 0703 677 451. Office hours are Mon–Fri 7:00am – 6:00pm · Sat 7:00am – 1:00pm EAT.
This notice covers people who browse sadiamondproperties.com, people who enquire or whose details we keep as clients, landlords, tenants, or partners, and staff who sign in to the private tools.
Browsing the website
You can read listings and articles without an account. We do not ask public visitors to register.
The web server may keep short technical logs, such as IP address, browser, and the page requested, so we can keep the site available and look into abuse. Those logs are not a customer profile.
Visit statistics (Matomo)
We measure how the public site is used with Matomo, hosted by us at analytics.sadiamondproperties.com. Matomo records pages viewed, referring site, device type, and an approximate location derived from the IP address. It sets first-party cookies (including _pk_id and _pk_ses) so a returning browser can be recognised across pages. Blocking cookies in your browser does not stop you using the site. We use these statistics to see which listings and articles are useful. We do not sell them.
Error and performance reports (Sentry)
When a page fails, the browser or the server may send an error report to Sentry (Functional Software, Inc.), whose intake for this project is in the United States. A report can include the page address, browser, error detail, and the IP address tied to that request. In production we also send a performance trace for a sample of visits (about one in five) so we can see slow pages. We use this to fix faults. Sentry’s own retention applies to those reports.
Enquiries and client records
The enquiry form asks for your name, phone number, email address, and message. If you write from a listing, we also store which property you asked about. All of those fields are required to send the form. We save the enquiry as a lead with the source “Website”, attach your message as a note, and create or update a contact record matched on your phone number or email.
We also keep details you give us by phone, email, walk-in, or WhatsApp, and details our staff enter for a buyer, tenant, landlord, agent, or partner. A record can include name, phone, email, the area you are interested in, the properties you asked about, viewing notes, offer or budget figures staff record, and the stage of the conversation. If someone refers you, we keep the referrer’s name and contact so we know how the introduction was made.
The WhatsApp and call buttons open your own phone apps, with a short draft message when you start from a listing. That conversation then runs on WhatsApp or the phone network. We keep, in our own records, what we need to follow up.
We use this information to reply, arrange viewings, and carry through a sale, rent, lease, or property-management instruction. Staff see a record according to their role: an agent sees the people assigned to them; managers and administrators can see records across the firm. We do not use enquiry details for a mailing list, and there is no separate marketing subscription on this site.
Staff accounts
Agents, managers, and administrators receive an account by invitation. We store the name, work email, role, and a password hash (argon2id). We never store the password itself. Invitation and password-reset emails are sent through our mail server and contain the name, email address, and a one-time link. A reset link expires after 30 minutes.
Signing in sets an encrypted cookie (__Host-usersession on the live site). It is HTTP-only, sent only over HTTPS, and limited to this site. A session lasts up to seven days from the last time it is used, then it expires. With the session we store the IP address and browser of the device, so you can review signed-in devices in account settings and sign one out. Changing your password signs out the other sessions. Repeated sign-in and reset attempts are counted by email and by IP address for about 15 minutes, in memory, and are not added to your profile.
Field check-ins
Staff can log a property viewing, door-to-door visit, or site visit. Sharing a location is optional and happens only if that person switches it on and the browser allows it. We then store the latitude and longitude with the check-in, the staff member, the time, and any lead they linked. A property viewing linked to a lead is also recorded as a completed viewing.
Maps and address lookup
When staff place a listing on the map, the address they type, or the pin they drop, is sent to the OpenStreetMap Nominatim service so we can turn it into coordinates or a place name. The map tiles for that editor load from OpenStreetMap. Public listing pages do not load that map. Nominatim is operated outside our own servers.
Listing photos
Photos and files for listings are stored in Cloudflare R2 and served from cdn.sadiamondproperties.com. They are property images we publish. A photo can incidentally show people or a number plate; we use it to present the property.
Why the law allows this
We process personal data under the Data Protection Act, 2019. Depending on the activity, that is because you asked us to respond or to take steps toward a sale, lease, or management instruction; because we have a legitimate interest in running the agency, measuring the site, and protecting accounts; because a legal duty requires a record; or, for optional check-in location, because the staff member turned location on for that visit.
Providing the enquiry fields is required if you want us to receive the form. Browsing the rest of the site does not require them.
Who else receives data
- Our staff, as far as their role allows, to handle the enquiry or the account.
- Our mail server, for staff invitation and password-reset email.
- Sentry, in the United States, for error and performance reports.
- Cloudflare R2, for listing photos and files served on our CDN.
- OpenStreetMap (Nominatim and map tiles), when staff edit a listing location.
- WhatsApp, your phone network, or Facebook, only if you choose those links. Their own terms then apply.
- A court, regulator, or other body when the law requires us to disclose.
Client and staff records are kept on the systems we operate for the firm. Error reports sent to Sentry, and address lookups sent to OpenStreetMap, are processed outside those systems. We do not sell personal data.
How long we keep it
We keep personal data only for as long as we need it for the purpose it was collected. For an enquiry or a client, that includes the time we are working with you and any later period we need for follow-up, a dispute, or a duty to keep records. When we no longer need it, we delete it or remove the details that identify you.
A staff session ends when it expires or is revoked. Password-reset links expire after 30 minutes. Sign-in attempt counters last about 15 minutes.
Your rights
Under the Data Protection Act you can ask to be told how we use your data, to receive a copy, to correct what is false or misleading, to object to processing, to ask us to delete false or misleading data, and to receive data we hold in a structured, machine-readable form where the right to portability applies.
Write to [email protected]. We may need to confirm that the request comes from you. We will respond within the time the Act requires. You can also complain to the Office of the Data Protection Commissioner, Kenya, at odpc.go.ke.
This site is aimed at adults looking for property and at our staff. We do not seek information about children. If a message includes it, we use it only to handle that enquiry.
Changes
If we change how we handle personal data, we will update this page and the date at the top. The current version is always at /privacy . Use of the website is also covered by our terms of use .