Privacy
Privacy Notice
Effective 10 July 2026. This notice explains how Archt Ltd handles personal data under Kenya's Data Protection Act, 2019.
Data Controller (Archt Ltd)
Archt Ltd is the data controller for the platform unless a separate written agreement says we process data only on another controller's instructions. We decide why and how platform personal data is processed for account, marketplace, escrow, audit, support, and compliance purposes.
Data Collected
Identity
Name, account profile, ID or registration references where required for verification.
Contact
Email address, phone number, postal address, and project communication details.
Project
Site address, plot details, milestones, approvals, disputes, documents, photos, and reports.
Professional
Licence, registration, portfolio, insurance, and KYC information for service providers.
Payment
Billing references, transaction identifiers, escrow records, refunds, and payout details.
Usage
Device, log, cookie, and analytics information generated when you use the platform.
Legal Basis
- Contract performance and pre-contract steps requested by you.
- Compliance with legal, tax, accounting, fraud prevention, KYC, and regulatory obligations.
- Legitimate interests in running a secure construction marketplace and resolving disputes.
- Consent, where required for optional cookies, marketing, or specific processing notices.
Use
- Operate accounts, marketplaces, dashboards, support, and notifications.
- Verify professional credentials and manage project quality controls.
- Process purchases, escrow milestones, payouts, refunds, invoices, and tax records.
- Investigate fraud, misuse, disputes, safety issues, and policy breaches.
- Maintain audit trails, security logs, backups, analytics, and service reliability.
- Send service messages and, where permitted, product or compliance updates.
Sharing
We share personal data only where necessary for the platform, project delivery, legal compliance, safety, or user-requested services.
- With clients, professionals, inspectors, and supervisors assigned to a project.
- With payment, escrow, identity verification, hosting, analytics, messaging, and support providers.
- With regulators, courts, law-enforcement agencies, or professional bodies where required or permitted by law.
- With advisers, auditors, insurers, or buyers in a business transaction subject to confidentiality controls.
We do not sell personal data.
Retention
We keep personal data only for as long as needed for the purpose it was collected, then delete, anonymise, or archive it according to legal, tax, accounting, audit, dispute, fraud prevention, and platform security needs.
Account, project, escrow, audit, and KYC records may be retained after account closure where required for legal claims, statutory records, fraud prevention, or regulatory compliance.
Rights
You can submit access, erasure, portability, and restriction requests through the Data Subject Request form.
Access
Ask for confirmation and a copy of personal data we hold about you.
Erasure
Ask us to delete personal data where no legal hold or retention duty applies.
Portability
Ask for eligible data in a structured, commonly used, machine-readable format.
Restriction
Ask us to restrict processing while a request, objection, or accuracy concern is reviewed.
You may also object to processing based on legitimate interests or direct marketing. Submit a request at /dpo.
International Transfers
Some service providers may process personal data outside Kenya. We use transfer safeguards such as contractual controls, due diligence, access restrictions, encryption, and vendor security reviews where required.
We will take reasonable steps to ensure transferred personal data receives protection consistent with the Kenya Data Protection Act, 2019.
Contact (DPO)
Data Protection Officer: dpo@archt.co.ke. You can also use the Data Subject Request form.