Privacy Policy

Introduction

REMS Global (Real Estate Management Software Limited, “we”, “our”, or “us”) is committed to protecting your privacy. This policy explains how we collect, use, disclose, and safeguard your information when you use our products: the REMS One property management platform, REMS VMS for visitor management and gate security, and REMS Edge, our CRM and property management service for estate agencies.

REMS Edge helps an estate agency keep its contacts, listings, enquiries, viewings, and deals, run its own website and client portal, and message its clients on WhatsApp, Messenger, Instagram, SMS, and email. Each agency runs on its own REMS Edge installation.

Who is responsible for your data

Our customers are landlords, property managers, estate agencies, and other organisations. Each decides what it records in our products about its tenants, clients, visitors, and contacts, and why. For that data the customer is the data controller, and we process it on the customer’s instructions.

We are the data controller for the accounts of the people who sign in to our products, and for the running and security of our services.

Information we collect

We collect information you provide directly, including account details, company and property information, tenant and lease records, and financial transaction data. When you use the platform we also collect device and usage information, log data, and error reports.

In REMS Edge we also handle the records an agency keeps: the contact details of its clients and prospects, their enquiries, properties, viewings, offers, documents, and notes, and the messages exchanged with them. When an agency connects a mailbox, calendar, or address book, REMS Edge files the emails, appointments, and contacts the agency chooses to bring in.

Data received from Meta: WhatsApp, Messenger, Instagram, lead ads, and ads

REMS Edge connects to Meta’s platforms only when an agency connects its own WhatsApp Business number, Facebook Page, or Instagram professional account. Through that connection we receive:

• Messages people send to the agency on WhatsApp, Messenger, or Instagram: the text, any photos, videos, voice notes, or files, the time, and the sender’s phone number or profile name
• Comments people leave on the agency’s Facebook Page or Instagram posts
• The answers people give in the agency’s lead ad forms on Facebook or Instagram, which arrive as enquiries
• Whether the agency’s messages were delivered and read

We use this data only to provide the conversation and the agency’s records: to show the conversation to the agency’s staff, to file it on the agency’s record of that person, to turn lead ad answers into enquiries, and to send the agency’s replies and notices.

If an agency also connects its Meta ad account, REMS Edge can create the ads the agency asks for to promote its listings on Facebook and Instagram, keep a catalogue of the agency’s listings in the agency’s own Meta account, and show the agency how its ads perform, such as reach, clicks, spend, and leads. Meta bills the cost of the ads to the agency’s own ad account.

We do not sell this data, and we do not use people’s messages, comments, or lead details for advertising or to build advertising profiles. It is not shared with other agencies: each agency’s data stays in its own installation. Apart from the providers that host and run REMS Edge for us, we pass it to no one else unless the law requires it. Meta handles the messages on its side under its own terms and privacy policy.

Messages and lead details stay on the agency’s records for as long as the agency keeps them. If the agency disconnects a channel, REMS Edge stops receiving data from it; what was already filed stays with the agency until it deletes it or closes its account. To have this data deleted, follow our data deletion instructions.

Data received from Google: sign-in, Gmail, Calendar, and Contacts

When a person at an agency connects their own Google account to REMS Edge, REMS Edge receives data through Google’s APIs and uses it only for the features that person turns on:

• Sign in with Google: their name, email address, and profile picture, to sign them in
• Gmail: to send the emails they write in REMS Edge from their own Gmail address, with a copy in their Sent folder. REMS Edge does not read their mailbox through this connection
• Google Calendar: to put their appointments and viewings on their calendar, and to bring back the changes and events they make there (private events only as “Busy”)
• Google Contacts: to keep their contacts the same in REMS Edge and in Google Contacts

What REMS Edge brings in is kept in the agency’s own installation, and the access keys for the Google account are stored encrypted. We do not sell Google user data, use it for advertising, or use it to develop, improve, or train artificial intelligence or machine learning models. Apart from the providers that host and run REMS Edge for us, we pass it to no one else unless the law requires it. Our staff do not read it unless the person asks us to for support, for security, or when the law requires it.

Disconnecting the Google account in REMS Edge ends REMS Edge’s access and deletes the access keys it kept; what was already brought in stays on the agency’s records. The person can also remove REMS Edge from their Google Account at myaccount.google.com/permissions.

REMS Edge’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send and receive our customers’ messages on the channels they connect, and file them on their records
• Respond to inquiries and provide support
• Send account holders sign-in codes, security notices, and news of changes to our services
• Ensure platform security and prevent fraud
• Comply with legal and tax obligations

We do not use the content of our customers’ records or messages for advertising.

Information sharing

We may share information with service providers, payment processors, banking partners for reconciliation, and tax authorities such as KRA for eTIMS, or where required by law. We do not sell your personal information.

For REMS Edge, our service providers include hosting and email delivery, and the services an agency chooses to connect: Meta for WhatsApp, Messenger, and Instagram, SMS carriers, Google and Microsoft for sign-in, mailboxes, calendars, and contacts, Dropbox for files, Zoom for meetings, and map services. Each handles data only as far as its part of the service needs.

Data security & retention

We use encryption in transit and at rest, access controls, and regular security assessments. In REMS Edge, passwords are stored as hashes, the access keys for connected accounts are stored encrypted, staff can protect their accounts with two-step verification, and access to the servers is limited to the people who run the service.

We retain your information for as long as your account is active or as required by law. When an agency closes its REMS Edge account, its records are deleted within 30 days, unless the law requires some of them to be kept longer, and copies in backups are overwritten within a further 30 days.

Your rights

Under the Kenya Data Protection Act, 2019, and the GDPR where it applies, you may request access to, correction of, or deletion of your data, object to certain processing, or ask for a copy in a portable form. To exercise these rights, contact privacy@rems.global. You can also request account deletion on our delete account page.

If a landlord, property manager, or estate agency holds your details in one of our products, ask it first, because it decides what is kept. You can also write to us: we pass your request to it and help it answer. Our data deletion instructions set out the steps.

You may complain to the Office of the Data Protection Commissioner of Kenya, or to the data protection authority where you live.

Changes to this policy

We publish changes to this policy on this page and update the date shown above.

Contact

Questions about this policy? Email privacy@rems.global or write to Pent 4, 6th Floor, Park Suites, Parklands Road, Nairobi.