Privacy notice
Last updated 22 September 2026
This notice explains what happens to your details when you visit, live in or work at an estate that uses Lease Lion to run its gate. It applies to guests (including couriers and regular visitors), residents and estate staff such as guards and managers.
Who is responsible for your data
The estate is responsible. That is the landlord, owner or managing agent who runs the property you are visiting, living in or working at. They decide why your details are collected and how long they are kept. In law, they are the data controller.
Lease Lion provides the software the estate uses. We store and process your details only on the estate's instructions, and for no other purpose. In law, we are the data processor.
What is collected
If you are a guest
- Your name, and the phone number or email the pass is sent to
- Your national ID or passport number, if the estate asks for it
- The number plate and description of the car you arrive in
- The names and ages of children arriving with you
- Any assistance you need at the gate (for example, a drop-off at the building entrance)
- Who invited you, which home you are visiting, the reason for the visit, and when your pass is valid
- When you entered and left, through which gate, and which guard checked you in or out
If you are a resident
- Your name, phone number, email and the home you live in
- The guests you book, the regular visitors you add, and requests you make (such as extended stays)
- Emergency (duress) alerts you raise, and how they were handled
If you work at the estate
- Your name, phone number, email, role and the property you are assigned to
- If the estate records them: your ID or passport number, nationality, address and photo
- The actions you take in the system, such as scanning a pass or letting someone out
Why it is collected
- To keep the estate secure: to check that the person at the gate is expected, keep a record of who is on site, and investigate incidents. This is the estate's legitimate interest in the safety of its residents, staff and property.
- To provide the service residents signed up for: sending passes, telling you when your guest arrives, and responding to emergency alerts.
- To meet legal obligations where the estate has them, for example responding to a lawful request from the police.
Your details are never sold, used for advertising or shared with anyone for their own purposes.
The resident who books a guest confirms that they have told the guest their details will be kept for gate security. When children are listed, the resident confirms that they are the child's parent or guardian, or have the parent's permission (DPA s.33).
Who can see it
- Guards at the estate see the guests expected today and who is on site. They see a guest's full ID number only when the pass is scanned, so they can check it against the document.
- The resident who invited you, and the estate's managers and landlord.
- Lease Lion staff, only when needed to support the estate or keep the service running, under a duty of confidentiality.
- Service providers that host and deliver the service for us (listed below), under contract and only for that purpose.
A pass link shows only the last four digits of an ID number, because pass links are often forwarded.
| Provider | What it does | Where |
|---|---|---|
| Convex | Database and application backend | United States |
| Vercel | Website hosting | Global edge network; United States |
| Clerk | Sign-in and account security | United States |
| Resend | Email delivery (passes, invitations) | United States |
| Africa's Talking | SMS delivery (passes, alerts) | Kenya |
| Safaricom (M-Pesa) | Subscription payments (landlords only) | Kenya |
Where it is stored
The main database and several of the providers above are in the United States. Your details are transferred there under contracts that require the provider to protect them to the standard Kenyan law expects (DPA ss.48–50). They are encrypted in transit and at rest, and ID numbers are additionally encrypted by Lease Lion before they are stored.
How long it is kept
Unless the estate sets a shorter period, and counting from the end of a guest's pass:
| What | Kept for |
|---|---|
| Guest ID and passport numbers | 30 days, then deleted |
| Guest name, phone, email, car and children | 365 days, then replaced with "Former guest" |
| Anonymised visit records and the estate's audit trail | 730 days, then deleted |
| In-app notifications | 90 days |
| Regular-visitor (whitelist) entries | Until the resident removes them |
| Blacklist entries | Until the estate removes them |
| Resident and staff accounts | While you are a member of the estate; deleted when you are removed |
The estate may keep specific records longer if they are needed for an ongoing investigation or legal claim.
How it is protected
- Each estate's data is kept separate from every other estate's, and every request is checked against the person's role on the server.
- Gate codes and PINs are stored only as one-way hashes, so a copy of the database contains no working pass. QR codes carry a random token, not your details.
- ID numbers are encrypted with a key held separately from the database.
- Every change is written to a time-stamped audit trail.
- Connections are HTTPS-only, and sign-in is handled by a dedicated security provider.
Your rights
Under the Data Protection Act (s.26) you have the right to:
- be told how your data is used (this notice)
- get a copy of the data held about you
- have wrong or incomplete details corrected
- have your details deleted, where they are no longer needed or were collected unlawfully
- object to your details being used
To make a request, contact the estate. They can find your records, send you a copy or erase them from their Privacy page. The estate's privacy contact is shown on your pass, or ask the management office. Residents and staff can also download a copy of their own data at any time from the account menu in the app.
If you cannot reach the estate, contact Lease Lion at the contact details on leaselion.pabmerchants.com and we will pass your request on and help them respond.
You can also complain to the Office of the Data Protection Commissioner: www.odpc.go.ke.
Changes
If this notice changes in a way that matters, the date at the top changes and estates are told in the app.