Privacy Policy

1. Who we are

Kwathu (“Kwathu”, “we”, “us” or “our”) is a mobile application that helps people in Malawi find and list residential and commercial property to rent or buy. The Kwathu app and its supporting services are operated by Skywares Systems (the “data controller”).

This Privacy Policy explains what personal information we collect through the Kwathu mobile app and related services (together, the “Service”), why we collect it, and the rights you have over it. We are committed to handling your information in line with the Data Protection Act, 2024 of the Republic of Malawi and other applicable laws.

2. Scope of this policy

This policy applies to everyone who uses Kwathu, whether you are:

• A seeker — someone browsing or searching for a home;
• A landlord or agent — someone listing property; or
• A premium subscriber — someone paying for alerts and priority features.

It does not cover third-party websites, services or apps that we link to but do not operate.

3. Information we collect

We collect only the information we need to provide a safe, working marketplace. This falls into the following categories.

3.1 Information you give us

3.2 Information we collect automatically

3.3 Information from third parties

We may receive limited information from the service providers who help us run Kwathu — for example a payment-status confirmation from our payment processor, or a delivery status from our SMS provider. We do not buy personal data about you from data brokers.

4. How we use your information

We use your information to:

• Create and secure your account and verify your phone number by SMS one-time code;
• Show, search and manage property listings;
• Enable in-app chat, viewing requests and contact between seekers and landlords;
• Verify landlord identity (KYC) where you choose or are required to do so;
• Process Premium subscriptions and send you the alerts you sign up for;
• Detect, investigate and prevent fraud, scams, spam, abuse and ban evasion;
• Send you service messages, security codes and, if you opt in, listing alerts;
• Provide customer support and respond to your reports and requests;
• Understand how the Service is used so we can maintain and improve it; and
• Comply with legal obligations and enforce our Terms of Service.

5. Legal bases

Where the Data Protection Act, 2024 applies, we rely on one or more of the following legal bases to process your personal data:

• Performance of a contract — to provide the Service you asked for (for example running your account, listings and subscription).
• Consent — for example when you opt in to SMS alerts or submit identity documents. You may withdraw consent at any time.
• Legitimate interests — to keep Kwathu safe and prevent fraud, secure our systems, and improve the Service, balanced against your rights.
• Legal obligation — where we must process data to comply with the law or a lawful request.

6. SMS & notifications

We use SMS to send you one-time verification codes and, if you are a Premium subscriber who has set up alerts, to notify you of matching listings. Standard carrier message rates may apply. You can stop receiving alert messages at any time by removing your saved alerts in the app or cancelling Premium; we will still send essential security messages (such as login verification) needed to operate your account. We may also send push notifications, which you can control in your device settings.

7. How we share information

We do not sell your personal information. We share it only in these situations:

• With other users, by your choice. When you post a listing, the details and contact information you include are shown to other users. When you chat or request a viewing, your message and the phone number associated with the listing are shared with the other party so you can arrange the transaction.
• With service providers who process data on our behalf under contract (see “Third-party services” below).
• For safety and legal reasons — to detect or prevent fraud, protect the rights and safety of our users, comply with the law, or respond to a valid legal request from a competent authority.
• In a business transfer — if Kwathu is involved in a merger, acquisition or sale of assets, subject to this policy.

8. Third-party services

We rely on trusted providers to deliver parts of the Service. Each processes only the data needed for its function:

These providers may process data outside Malawi. We take steps to ensure your information remains protected wherever it is processed (see “International data transfers”).

9. Fraud prevention & automated decisions

Property fraud is a real risk in Malawi's rental market, so protecting our community is a core part of Kwathu. To do this we:

• Use a device identifier to spot accounts that try to evade bans or run scams;
• Run an automated risk-scoring engine that analyses new listings and accounts for known scam patterns;
• Scan in-app chat messages for scam indicators (for example requests to pay off-platform or to send money before viewing) and may flag or restrict suspicious activity; and
• Allow our moderators to review, approve, reject or ban flagged content and accounts.

Some of these checks are automated. Where an automated decision significantly affects you — for example if your listing is rejected or your account is restricted — you may contact us to have the decision reviewed by a person and to give your side.

10. Data retention

We keep your personal information for as long as your account is active and as long as needed to provide the Service. After you delete your account, we remove or anonymise your personal data, except where we must retain certain information for a limited period to:

• Comply with legal, tax or accounting obligations (for example payment records);
• Prevent fraud and abuse (for example retaining a device identifier or ban record to stop a banned user returning); or
• Resolve disputes and enforce our agreements.

Identity-verification documents are retained only as long as necessary for verification and compliance, and are then deleted or securely archived.

11. How we protect your data

We use technical and organisational measures to protect your information, including encryption of data in transit, hashing of passwords, access controls, and restricted administrative access. No system is completely secure, but we work continually to safeguard your data and will notify you and the relevant authority of a data breach where the law requires.

12. Your rights & choices

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (see “Account & data deletion”);
• Object to or restrict certain processing, including for fraud-prevention profiling;
• Withdraw consent where we rely on it, without affecting prior processing; and
• Lodge a complaint with the Malawi data-protection authority.

You can exercise many of these rights directly in the app (for example editing your profile or removing listings and alerts), or by contacting us using the details below. We will respond within the timeframe required by law.

13. Account & data deletion

You can request deletion of your Kwathu account and associated personal data at any time. See our dedicated Account & Data Deletion page for how to do this and what happens to your information. Some records may be retained for a limited time as described in “Data retention”.

14. Children

Kwathu is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. International data transfers

Some of our service providers store or process data on servers located outside Malawi. Where we transfer personal data across borders, we take reasonable steps to ensure it receives a level of protection consistent with this policy and the Data Protection Act, 2024.

16. Changes to this policy

We may update this policy from time to time to reflect changes to the Service or the law. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of Kwathu after an update means you accept the revised policy.

17. Contact us

If you have questions about this policy or wish to exercise your rights, contact us: