Legal
Effective 8 October 2026 · Version 2026-10-08
Kenya Home Services (KHS) operates a digital platform for discovering and connecting customers with service providers. The final published policy must identify the exact registered legal entity that determines the purposes and means of processing; this page does not invent one.
KHS aims to process personal data in accordance with Kenyan data-protection law, including the Data Protection Act, 2019 and applicable regulations. Controller and processor roles should be documented for each processing activity.
Depending on the feature, we may process account details such as name, username, email, phone number, profile photo, role, county and town; provider information such as services, experience, availability, price range and contact details; verification information; location information; payment/transaction metadata; device, technical, security and usage logs; reports, reviews and support communications.
Provider verification may involve government identification, selfie/liveness information and verification results processed by an identity-verification provider. Verification documents are not intended to be public profile content and access should be restricted to authorized systems and personnel.
Where enabled or provided, location may be used for provider discovery, service-area matching, maps, security and fraud prevention. Users should provide only the location information necessary for the feature.
We use data as necessary to operate accounts, provide provider discovery, perform verification, process payments, provide support, investigate reports, prevent fraud and abuse, enforce Platform rules, maintain reliability, send important service messages, comply with law, establish or defend legal claims and improve the service where permitted.
Provider profiles may intentionally display information such as name, photo, service, service area, biography, experience, availability, price range, verification status and contact methods. Users should never place unnecessary private or sensitive information in public fields.
We may provide relevant data to hosting/cloud providers, authentication/database providers, identity-verification providers, payment providers, communications providers, mapping providers where used, security providers, professional advisers and competent authorities where legally required or permitted. We do not sell personal data as a business model.
Some technology providers may process data outside Kenya. KHS should assess such transfers and implement applicable safeguards, contracts, notices and consent or another lawful mechanism where required. Vendor location and sub-processors are reviewed as part of compliance.
We use reasonable technical and organizational safeguards appropriate to risk, including access control, least privilege, row-level security where applicable, server-side secrets, hashed developer API keys, controlled verification-data access, security logging, abuse controls, backups and dependency management. No internet service can guarantee absolute security.
Data should be retained only for as long as reasonably necessary for its purpose, legal obligations, security, dispute handling, fraud prevention, accounting and legitimate operations. KHS should maintain category-specific retention schedules. Some records may remain after account deletion where lawful retention is required or reasonably necessary.
Subject to applicable law, users may have rights to be informed, access personal data, request correction, object, request deletion/erasure where applicable, request restriction, request portability and withdraw consent where consent is the lawful basis. Rights may have statutory exceptions and identity verification may be required.
Send privacy/data requests to support@christech.co.ke with the account identifier, the right you want to exercise and enough information to locate the data. We may verify identity before fulfilling a request.
Contact KHS first so we can investigate. Users may also complain to the Office of the Data Protection Commissioner where they believe their data-protection rights have been infringed.
KHS accounts are strictly limited to people who are 18 years of age or older. We do not intentionally offer ordinary KHS accounts to children. If we learn that an account belongs to a person under 18, we may restrict or close it and handle the information in accordance with applicable law. Any exceptional processing of children's data will receive the safeguards required by Kenyan law and applicable guidance.
KHS may use automated systems for security, fraud detection, abuse prevention, search, recommendations, moderation assistance and feature availability. Automated signals are not treated as infallible facts. Where legally significant automated decision-making applies, required safeguards and review mechanisms should be provided.
If an AI assistant is enabled, messages may be processed by KHS and approved AI infrastructure providers to generate responses and protect the service. Users should not submit passwords, payment secrets, government-ID numbers or unnecessary sensitive information to an AI assistant. AI output can be incorrect and is not professional advice.
See the Cookie Policy for necessary and optional browser technologies and how to manage optional choices. Optional technologies should not be activated before required consent.
Users may request account deletion through supported settings or support. KHS may use a controlled soft-delete process followed by deletion/retention workflows. Security, legal, payment, dispute and fraud-prevention records may remain where lawful.
KHS maintains incident-response processes for suspected breaches. Where a breach meets a legal notification threshold, KHS will follow applicable regulatory and notification requirements.
We may update this policy when the product, vendors, processing activities or legal requirements change. The version and effective date will be updated and appropriate notice/consent will be used where required.
Privacy and data requests: support@christech.co.ke. The final publication should include the operator's exact registered legal name, legal address and designated data-protection contact where applicable.
Also read Terms and 18+ Age Requirement and Cookie Policy.