Privacy Policy

1. Who We Are

Sterling Real Estate Advisory is a private company incorporated in Kenya and licensed by the Capital Markets Authority of Kenya (CMA) as a Real Estate Investment Trust (REIT) Manager. For the purposes of the Data Protection Act, 2019, we are the data controller responsible for your personal data. Our registered office is at Delta Corner Annex, 5th Floor, Ring Road, Westlands, Nairobi, Kenya. Where required under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, we are registered with the Office of the Data Protection Commissioner (ODPC).

2. Information We Collect

We may collect the following categories of personal data:

• Identity data: name, job title, and company name.
• Contact data: email address, phone number, and postal address.
• Enquiry data: the subject and content of messages you send us through our contact or booking forms.
• Usage data: information about how you use our website, including pages visited, time spent, and browser type.
• Newsletter data: your email address if you subscribe to our research and market updates.

3. How We Collect Your Data

• Directly from you when you complete a contact, enquiry, or consultation booking form.
• When you subscribe to our newsletter.
• Automatically through cookies and analytics tools when you browse our website.
• Through correspondence with you by email, telephone, or in person.

4. How We Use Your Data

We use your personal data to:

• Respond to your enquiries and provide the services you request.
• Send you research publications, market updates, and newsletters where you have consented.
• Improve and maintain our website and services.
• Comply with our legal and regulatory obligations as a CMA-licensed entity.
• Manage our relationship with you as a client, investor, or partner.

5. Legal Basis for Processing

In line with the Data Protection Act, 2019, we process your personal data on one or more of the following bases:

• Consent: where you have given clear consent (for example, newsletter subscription).
• Contract: where processing is necessary to perform a contract with you, or to take steps at your request before entering into one.
• Legal obligation: where we must process your data to comply with applicable law or regulation.
• Legitimate interests: where we have a legitimate business interest that is not overridden by your rights and freedoms.

6. Sharing and Disclosure of Data

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• Service providers: technology and hosting providers who process data on our behalf under written data processing agreements.
• Professional advisers: lawyers, auditors, and consultants where required.
• Regulatory and government bodies: the Capital Markets Authority of Kenya, the Office of the Data Protection Commissioner, and other competent authorities where legally required.
• Associated companies: Sterling Capital Limited, for the purpose of providing integrated financial services to our clients.

7. Cross-Border Transfer of Data

We host and process personal data on our own infrastructure. In limited cases, a service provider may store or process personal data on servers located outside Kenya. Where we transfer personal data outside Kenya, we take reasonable steps to ensure that it is protected to a standard consistent with the Data Protection Act, 2019, including through appropriate contractual safeguards and, where required, your consent.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. Enquiry data is generally retained for three (3) years. Client and investor data is retained for the duration of our relationship and for seven (7) years thereafter, in accordance with applicable regulatory requirements.

9. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or destruction, as required under the Data Protection Act, 2019. Our website is served over HTTPS and our data infrastructure is hosted on secure, certified cloud platforms. Access to personal data is restricted to authorised personnel only.

10. Your Rights

Under the Data Protection Act, 2019, you have the following rights in relation to your personal data:

• Right to be informed of the use to which your personal data is put.
• Right of access to the personal data we hold about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure or deletion of your personal data where there is no lawful basis for its continued processing.
• Right to restrict or object to the processing of your data, including for direct marketing.
• Right to data portability, where applicable.
• Right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details below.

11. Cookies

Our website uses cookies. For detailed information on the cookies we use and the choices available to you, please see our Cookie Policy.

12. Complaints

If you are concerned about how we handle your personal data, please contact us first so that we can address your concerns. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), www.odpc.go.ke.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when the most recent changes were made. We encourage you to review this policy periodically.

14. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact us: