Privacy Policy

This policy explains what personal data RealEVR Estates collects, why, who sees it, how long we keep it, and what you can do about it. It is written to meet Uganda's Data Protection and Privacy Act, 2019, and to follow the principles and rights found in the laws of other places we serve, including the GDPR/UK GDPR, South Africa's POPIA, Kenya's and Nigeria's data protection laws, and US state laws such as the CCPA/CPRA. See the laws we design around, by region.

1. Who is responsible

RealEVR Estates is the "data controller" (the party that decides how your data is used) for the Service. Contact for privacy matters and our data protection contact:

If you live in the European Economic Area or the UK and a representative is required for us there, we will name them here before we actively market in those places.

2. What we collect

• Account and contact data: name, email, phone, username, password (stored hashed), country, language, role (visitor, owner, agent, partner).
• Listing and content data: property details, photos, 360° images, tours, messages and enquiries.
• Transactions: bookings, viewing passes, fees paid, payment references and amounts, and the "money received" messages that confirm them. We do not store card numbers, expiry dates or security codes.
• Auction bidder verification (sensitive): identity document and number, date of birth, nationality, address, proof of address, proof of funds, source-of-funds and politically-exposed-person declarations, and your bids. Kept privately, seen only by administrators who vet bidders. See the Bidder Vetting Policy.
• Partner data: business name, registration details, the contact person, and authority documents for a bank or developer.
• Kevin conversations: what you type or say to Kevin, kept only where it is about properties; chit-chat is not saved. When you switch on listening or tap the microphone, a short clip of what you say (never while the room is quiet) is sent to a speech provider (ElevenLabs, Microsoft Azure or Groq, or your browser's own service) to be turned into text, and Kevin's spoken replies are made by a voice provider from the text of his answer. We do not keep the audio; the provider handles it under its own terms.
• Technical data: IP address, device and browser type, pages viewed, approximate location from your time zone, and precise location only if you allow it.
• Data you send us: support messages, data requests, complaints.

We get this from you, from the device you use, from the people you deal with on the Service (for example a seller replying to you), and, for sanctions and fraud checks, from public lists.

3. Why we use it, and the legal basis

Where the law asks us to name a legal basis, these are ours:

• To run the Service you asked for (account, listings, messages, bookings, auctions, fees): contract / performance of the agreement with you.
• To vet bidders and partners, prevent fraud and money laundering, check sanctions, keep records: legal obligation and legitimate interests in keeping the platform and its users safe.
• To improve and secure the Service (fixing errors, abuse detection, measuring what works): legitimate interests.
• Location beyond your time zone, microphone/voice for Kevin, optional cookies, and marketing messages to individuals: consent, which you can withdraw at any time.
• To meet legal requests and protect rights (courts, regulators, defending claims): legal obligation and legitimate interests.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We do not make decisions with legal or similarly significant effect about you by automated means alone: bidder approval and partner approval are decided by people; automated payment matching only confirms a payment and anything unclear goes to a person.

4. Who we share it with

• Other users, as you intend: a seller or agent sees your enquiry and contact details when you contact them. In auctions other people see only an anonymous bidder alias and bid amounts, never your name.
• Service providers (processors) who work for us under contract: cloud hosting and storage (including Amazon Web Services), email and messaging (including WhatsApp), speech and AI providers used by Kevin (for example ElevenLabs, Microsoft Azure and Groq for turning speech into text and text into a voice), mapping, analytics we run ourselves, and payment or mobile-money providers.
• Authorities and advisers where the law requires or allows: courts, tax, the Financial Intelligence Authority, law enforcement, our lawyers and auditors.
• A successor if the business is sold or merged, bound to this policy.

5. Sending data across borders

We are in Uganda and our providers run servers in other countries, so your data may be processed outside the country where you live. Where the law restricts this (for example Uganda's Data Protection and Privacy Act, the GDPR/UK GDPR, POPIA), we send it only where the destination gives adequate protection, or under approved safeguards such as standard contractual clauses, or with your consent. Ask us for details at [email protected].

6. How long we keep it

These are the longest periods we keep each kind of data. We review and delete at least once a year, and straight away when you ask and nothing requires us to keep it.

• Account data: while your account is open, then up to 12 months unless you ask for earlier deletion and nothing requires us to keep it.
• Listings and messages: while the listing is live, then up to 24 months for dispute handling.
• Bidder and partner verification files and payment/anti-money-laundering records: for the period the law requires (commonly at least 5 to 10 years after the relationship ends), then securely deleted.
• "Money received" messages used to match payments: 90 days.
• Kevin property conversations: up to 24 months; voice audio is not kept by us.
• Security logs: up to 12 months.

7. Security

We use access controls (administrator-only areas, private file storage for identity documents), encryption in transit, hashed passwords, limited retention, and monitoring. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the regulator within the time the law sets (for example 72 hours to the regulator under the GDPR) and say what happened and what to do.

8. Your rights

Depending on where you live, you can:

• know whether we hold your data and get a copy (access / portability);
• correct data that is wrong or incomplete;
• ask us to delete it (we will, unless the law or a dispute requires us to keep it, and we will say which);
• object to, or ask us to restrict, some uses, including direct marketing (always free to stop);
• withdraw consent at any time, without affecting what was done before;
• not be subject to a significant decision made only by automated means (we do not make one);
• in California and other US states: know, delete, correct and opt out of sale/sharing (we do neither), and not be treated worse for using these rights; you may use an authorised agent; and
• complain to your data protection authority.

Use the form on Your data rights or write to [email protected]. We reply within 30 days (sooner where the law says), may ask you to prove who you are, and do not charge unless a request is clearly excessive. If we refuse, we say why and how to complain.

9. Complaints

Please tell us first so we can fix it. You may always complain to a regulator: in Uganda the Personal Data Protection Office at NITA-U; elsewhere the authority in your country (see the regional list). For the EU/UK this is the authority where you live, work, or where you think the problem happened.

10. Cookies, microphone and location

See the Cookie Policy. The microphone and precise location only work if you allow them in your browser, and you can switch them off at any time.

11. Messages from us

Account and safety messages (a fee confirmed, a bid outbid, a listing problem) are part of the Service. Marketing or announcement messages to individuals are sent only where you agreed or the law allows, and each tells you how to stop. Messages to businesses about the partner programme identify us and include an unsubscribe link, and we keep a list of people who opted out so they are not contacted again.

12. Children

The Service is for people aged 18 and over. We do not knowingly collect data from anyone under 18 and delete it if we learn we have.

13. Changes

If we change this policy in a way that matters, we tell you in the Service or by email before it takes effect, and update the date above.