Privacy Policy

RentGoshen ("RentGoshen", "the Platform", "we", "us") operates in Uganda. This Privacy Policy explains what personal data we collect through the Platform, why we collect it, how we protect it, and the rights you have under Uganda's Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.

This policy applies to tenants, landlords, agencies, agents, service professionals, and visitors who use RentGoshen.

1. Who we are

RentGoshen is the data controller responsible for the personal data described in this policy. You can reach our data protection contact at [email protected].

2. What personal data we collect

• Account information — name, email address, phone number, password, and account type (tenant, landlord, agency, service professional).
• Identity information — national ID number (NIN) or other identification, nationality, and identity documents you upload.
• Contact and address details — postal/physical address, district, city, and emergency contact information.
• Tenant screening information — occupation, employer, monthly income, number of occupants, and references, where you apply for a rental.
• Financial information — bank account details (for landlords receiving payouts), and records of rent, deposits, and fees. RentGoshen does not process card payments directly; rent and deposit payments are recorded by landlords/agencies against payment methods you arrange directly (mobile money, bank transfer, cash, or cheque).
• Lease and property records — lease terms, property and unit details, maintenance requests, and related communications.
• Usage data — IP address, browser/device information, and pages visited, collected automatically when you use the Platform.

3. Why we collect it, and our legal basis

We collect and process your personal data because it is necessary to:

• Create and manage your account and verify your identity;
• Match tenants with available properties and process rental applications;
• Enable landlords and agencies to manage properties, leases, rent, and maintenance;
• Facilitate communication between tenants, landlords, agencies, and service professionals;
• Meet our legal, tax, and regulatory obligations; and
• Keep the Platform secure and improve how it works.

Our legal basis for processing is your consent (given when you register or submit information), performance of the contract between you and RentGoshen or the property owner, and compliance with our legal obligations, consistent with sections 7 and 8 of the Data Protection and Privacy Act, 2019.

4. Who we share your data with

We share your personal data only as needed to operate the Platform:

• With the landlord, agency, or agent responsible for a property you apply to, lease, or request maintenance on;
• With service professionals assigned to a maintenance request you raise;
• With service providers who process data on our behalf under contract, including Amazon Web Services (AWS) for sending transactional emails, Cloudflare for secure file storage of uploaded documents and photos, and Google Maps for property location and mapping features; and
• Where required by law, regulation, or a valid order of a court or public authority.

We do not sell your personal data.

5. Transfers of your data outside Uganda

Some of our service providers process data outside Uganda — for example, AWS processes transactional email in the United States (Virginia), Cloudflare stores uploaded documents and photos in the European Union (Frankfurt, Germany), and Google Maps processes location data used for property mapping. Where personal data is transferred outside Uganda, we rely on contractual data processing safeguards with these providers and, where applicable, your consent, consistent with section 19 of the Data Protection and Privacy Act, 2019. We only work with providers who commit to protecting your data to a standard consistent with Ugandan law.

6. How long we keep your data

We retain your personal data for as long as your account is active, and afterwards for as long as necessary to meet legal, tax, accounting, or dispute-resolution requirements — for example, lease and payment records are retained for 7 years after a tenancy ends. Where data is no longer needed for these purposes, we delete or anonymize it.

7. Your rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete personal data;
• Request deletion of personal data we no longer have a lawful reason to keep;
• Object to or restrict processing that is likely to cause you unwarranted harm or distress; and
• Withdraw consent at any time, where consent is our basis for processing.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by law. If you are not satisfied with our response, you also have the right to lodge a complaint with Uganda's Personal Data Protection Office (National Information Technology Authority – Uganda): [email protected], +256 417 801 008/9, www.pdpo.go.ug.

8. Keeping your data secure

We restrict access to your personal data to staff and roles that need it to do their job, use role-based access controls across landlord, agency, and admin accounts, and log changes made to sensitive records. We take reasonable technical and organizational measures, consistent with section 21 of the Act, to protect your data against loss, unauthorized access, or disclosure.

9. Data breaches

If a breach affecting your personal data occurs, we will notify Uganda's Personal Data Protection Office and, where required, affected users, in line with our obligations under the Act and the 2021 Regulations.

10. Children

RentGoshen is not directed at children, and accounts require a user to be at least 18 years old. We do not knowingly collect personal data from children.

11. Cookies

The Platform uses cookies that are strictly necessary to operate the site — to keep you signed in, remember your session, and protect forms against forgery (CSRF protection). These essential cookies cannot be switched off, as the Platform will not work correctly without them. We do not use advertising or third-party tracking cookies. If a page embeds Google Maps, Google may set its own cookies when the map loads; this is governed by Google's own privacy policy, not ours. See our Cookie Policy for full details.

12. Changes to this policy

We may update this policy from time to time. For material changes, we will notify you by email or a notice on the Platform at least 30 days before the change takes effect. We will post the updated version here and update the effective date above.

13. Contact us

Questions about this policy or your data can be sent to [email protected].