This notice explains how PALTAS handles personal information about the people who register and use PALTAS (your account), and about the people whose details businesses record in PALTAS — for example tenants, owners and suppliers.
When you register or are invited, we process your name, business details, email address, phone number, a securely hashed password, sign-in and two-factor settings, the terms version you accepted and when, and security and activity records. We use this to create and secure your account, verify your email, send you service messages about your account and trial, provide support, and prevent misuse. We are responsible (the controller) for this information. We do not use it for marketing unless you ask us to.
Businesses record information about their tenants, owners, contacts and suppliers in PALTAS — for example names, contact details, leases, invoices, payments and documents. For these records the business is responsible (the controller) and PALTAS processes them only on its instructions, to provide the service. If you are a tenant or contact of a business using PALTAS, please contact that business about your information; we will help them respond.
Passwords are stored only as secure hashes. Verification and reset links are time-limited and work once. Each business's records are kept separate and access depends on the role a person is given. Information travels over encrypted connections, and the database is backed up regularly.
We use carefully chosen providers to run PALTAS: Render (application hosting and database), Netlify (website hosting) and Google (Gmail, for sending service emails and support). They process information only to provide their service to us. Some providers may process information outside the country where you are; where that happens we rely on appropriate safeguards required by law.
We keep account information while your account is active. Business records are kept while the business's account is active or read-only, so they can be used and exported, and are deleted after the account is closed, except where the law requires us to keep something longer (for example accounting and tax records).
Depending on the law that applies to you — including the UK GDPR and Kenya's Data Protection Act, 2019 — you can ask to access, correct or delete your information, or to restrict or object to how it is used, and ask for a copy to take elsewhere. Write to supportpaltas@gmail.com. You can also complain to a data protection authority, such as the UK Information Commissioner's Office or Kenya's Office of the Data Protection Commissioner.
If we change this notice we will update the version and date above and, for significant changes, tell account holders before they apply.