Data protection

CoralStones is operated from Kenya and our services are primarily directed at users in Kenya and East Africa. Our data practices are governed by the Kenya Data Protection Act 2019 and the oversight of the Office of the Data Protection Commissioner (Kenya).

We know many of our users are part of the East African diaspora. If you access the platform from the European Union, the EEA or the UK, the EU/UK General Data Protection Regulation (GDPR) may apply to the processing of your personal data. Where it does, we will:

• process your data only on the legal bases set out below;
• honour your GDPR rights (access, rectification, erasure, portability, objection, restriction) — the same rights we extend under the Kenya DPA;
• act as the data controller, reachable through our Data Protection Officer (below).

We do not currently have an EU/UK-established entity or representative. If you would prefer we did not process your data, please do not submit it, or contact our DPO to have it removed.

CoralStones Properties Listings Limited is the data controller for all personal data collected through this platform. We are registered in Kenya. Our Data Protection Officer can be reached at privacy@coralstonesproperties.co.ke.

Account data: Name, email address, phone number and country when you register or list a property.

Search and browsing data: Properties you view, save and compare. Search terms and filter preferences. This helps us show you more relevant results.

Enquiry data: Messages sent to agents through the platform. These are stored so both parties can refer to previous correspondence.

Verification data: For agents and listers, we collect ID documents, licence numbers and business registration certificates. These are stored securely and not visible to buyers.

Device and usage data: IP address, browser type, device type and pages visited — collected automatically by our servers. Used for security and to improve the platform.

• To facilitate property searches, enquiries and bookings
• To verify agents, listings and title deeds
• To send transactional emails (listing confirmations, enquiry notifications)
• To detect and prevent fraud on the platform
• To improve search relevance and platform features
• To comply with legal obligations in the countries we operate in

We do not sell your data to third parties. We do not use your data for advertising outside the platform.

We process your data under the following legal bases:

• Contractual necessity: To provide the service you signed up for
• Legitimate interests: Fraud prevention, platform security, service improvement
• Legal obligation: Anti-money laundering, tax and regulatory compliance
• Consent: Marketing emails (you can withdraw at any time)

Account data is retained for as long as your account is active, plus 7 years thereafter for legal compliance.

Enquiry messages are retained for 2 years. Verification documents are retained for 5 years.

Browsing and search logs are anonymised after 90 days.

Under the Kenya Data Protection Act 2019, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (subject to legal retention requirements)
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — limit how we use your data while a dispute is resolved

To exercise any right, email privacy@coralstonesproperties.co.ke. We will respond within 30 days.

We use strictly necessary cookies to run the site and optional analytics cookies to understand how the platform is used. Analytics only load after you accept them in the cookie banner. We do not use advertising cookies.

Withdraw or change consent: use the button below to reopen the cookie banner and accept or decline analytics at any time. You can also clear cookies/site data in your browser. Disabling strictly necessary cookies will affect platform functionality.

We use a limited number of trusted third-party processors, each contractually required to protect your data and not use it for their own purposes:

• Vercel — hosting and anonymous analytics
• Supabase — database and storage
• Resend — transactional and subscriber email delivery
• Flutterwave — payment processing (only when you make a payment)

All data is encrypted in transit (TLS 1.3) and at rest. Verification documents are stored in an isolated, access-controlled environment. Our team undergoes annual data protection training.

For privacy questions or to exercise your rights: privacy@coralstonesproperties.co.ke

To complain about how we handle your data, you may contact the Office of the Data Protection Commissioner (Kenya).