Data Deletion Policy

1. Introduction

At BNB Kenya, we respect your right to control your personal data. The protection of your privacy is a core part of how we operate, and we believe you should be able to decide what happens to the information you share with us.

This Data Deletion Policy explains, in clear and simple terms, how you can permanently delete your account and the data associated with it, what happens to your information after you make this request, and the circumstances under which we may be required to retain some of your data after deletion.

This policy applies to all users of the BNB Kenya platform, including guests and hosts, and is issued in compliance with the Data Protection Act, 2019 (Laws of Kenya) and applicable international data protection standards.

2. How to Delete Your Account

You can delete your account and request the deletion of your personal data directly from the app at any time. You do not need to contact our support team to do this. Follow the steps below:

1. Log in to your account on the BNB Kenya app.
2. Open your Profile by tapping the profile icon.
3. Navigate to the Settings section from your profile.
4. Scroll to the account options and click the "Delete Account" button.
5. Read the confirmation message carefully and follow the on-screen instructions to permanently delete your account.

3. What Happens After Deletion

Once you confirm your deletion request, the following steps will take place:

• Immediate Deactivation: Your account will be deactivated instantly. You will be signed out of all sessions and will no longer be able to log in.
• Loss of Access: Your profile, active bookings, booking history, payment details, saved properties, messages, and any property listings will become inaccessible.
• Content Removal: Your profile information and publicly visible content will be removed from the platform.
• Pending Transactions: Any pending payments, refunds, or bookings that have not been completed will be cancelled or settled in line with our cancellation policy before your data is fully erased.
• Permanent Erasure: Your personal data will be permanently and securely erased from our systems after the retention period described below.

4. Data Retention Period

After you request account deletion, your data may be retained for a maximum period of 90 days. During this time, your account will be inaccessible to you, but your data may be held by us solely to:

• Complete pending financial transactions, payments, or refunds that were in progress at the time of your deletion request.
• Comply with legal, regulatory, tax, or accounting obligations applicable to us under Kenyan law.
• Resolve any disputes, claims, or complaints involving your account, including those initiated by hosts, guests, or third parties.
• Investigate and prevent fraud, abuse, or any other activity that violates our Terms of Service or applicable law.
• Maintain audit trails and business records required for regulatory compliance.

After this 90-day retention period expires, your personal data will be permanently erased from our databases, servers, and backups. No further action is required from you.

5. Exceptions & Legal Obligations

While we honour every deletion request, there are certain limited circumstances where we may be required to retain some of your data beyond the 90-day period, including:

• Legal Requirements: Where Kenyan law or a court order requires us to retain specific records for a longer period, we will do so only to the extent required and will delete the data as soon as the legal obligation ends.
• Ongoing Investigations: If your account is subject to an active fraud investigation, regulatory enquiry, or legal dispute, we may retain the necessary records until the matter is resolved.
• Transaction Records: Financial transaction records may be retained in line with applicable tax and anti-money laundering regulations, even after your account has been deleted. These records do not include personal data beyond what is required by law.
• Anonymised Data: We may retain anonymised and aggregated data (data that can no longer identify you) for analytics and business reporting purposes. This information cannot be linked back to you and is not considered personal data.

In all cases, any data we retain will be kept secure, used only for the permitted purpose, and deleted as soon as the legal or operational requirement has been satisfied.

6. Data Shared with Third Parties

When you use the BNB Kenya platform, some of your data is processed by trusted third-party service providers, such as Supabase (for database and authentication), Cloudinary (for image hosting), and payment processors (for M-Pesa and card transactions).

When you delete your account, we will instruct these providers to delete or return the personal data they hold about you, in line with our data processing agreements and the same 90-day retention window. You do not need to contact these providers yourself — deleting your account in the app handles this process for you.

7. Frequently Asked Questions