Subprocessors and Data Retention

Effective Date: 31 July 2026

Last Updated: 31 July 2026

Legal Entity: Makao Hive

1. Purpose

Makao Hive ("Makao Hive", "we", "our", or "us") engages carefully selected third-party service providers ("Subprocessors") to help operate, secure and improve the Platform.

This document provides transparency regarding:

• the categories of Subprocessors we use;
• the purposes for which they process personal information;
• the categories of information involved;
• our approach to international data transfers; and
• our data retention practices.

This document supplements our Privacy Policy and should be read together with it.

2. What Is a Subprocessor?

A Subprocessor is an organisation that processes personal information on behalf of Makao Hive in support of our services.

Subprocessors may assist with:

• cloud infrastructure;
• email delivery;
• payment processing;
• AI services;
• mapping services;
• communication services;
• analytics;
• media storage;
• security;
• application monitoring.

Makao Hive remains responsible for ensuring that personal information is processed in accordance with applicable law.

3. Principles for Selecting Subprocessors

Before engaging a Subprocessor, we consider factors including:

• security standards;
• reliability;
• regulatory compliance;
• privacy practices;
• contractual safeguards;
• operational necessity.

Where appropriate, Subprocessors are required to:

• process personal information only on our documented instructions;
• implement appropriate technical and organisational security measures;
• maintain confidentiality;
• notify us of relevant security incidents where legally required;
• assist us in meeting applicable legal obligations;
• use additional subprocessors only where contractually permitted.

4. Current Categories of Subprocessors

The list below represents the categories of Subprocessors used by Makao Hive as of the Effective Date of this document.

Our service providers may change over time as the Platform evolves.

4.1 Payment Processing

Examples may include:

• KCB Buni
• M-Pesa and related payment infrastructure
• Approved payment gateway providers

Purpose:

• processing Platform fees;
• payment confirmation;
• refund processing;
• fraud prevention.

Information processed may include:

• name;
• phone number;
• transaction reference;
• payment amount;
• payment status;
• payment timestamps.

Makao Hive does not use these providers to process rent or tenancy security deposits unless expressly stated otherwise.

4.2 Email Delivery

Examples may include:

• Resend
• other approved transactional email providers

Purpose:

• account verification;
• password reset emails;
• viewing notifications;
• tenancy communications;
• lease notifications;
• Platform alerts;
• customer support communications.

Information processed may include:

• email address;
• recipient name;
• email content;
• delivery status.

4.3 SMS and Messaging Services

Examples may include:

• Celcom
• Advanta
• WhatsApp Business Platform providers
• other approved communication providers

Purpose:

• one-time passwords (OTP);
• viewing reminders;
• operational notifications;
• account verification;
• customer communications.

Information processed may include:

• phone number;
• message metadata;
• delivery status;
• limited message content where operationally required.

4.4 Artificial Intelligence Services

Examples may include:

• OpenAI
• other approved AI providers

Purpose:

• property description generation;
• neighbourhood guides;
• blog content generation;
• social media drafting;
• customer support assistance;
• internal productivity tools.

Information processed may include:

• prompts;
• property information;
• non-sensitive operational context;
• generated responses.

Makao Hive seeks to minimise personal information included in AI prompts wherever reasonably practicable.

Unless otherwise disclosed, customer information submitted through approved API services is not intentionally provided for public model training.

4.5 Mapping and Location Services

Examples may include:

• Google Maps Platform
• Mapbox

Purpose:

• address lookup;
• geocoding;
• map rendering;
• nearby places;
• route planning.

Information processed may include:

• addresses;
• coordinates;
• map requests;
• location search queries.

4.6 Cloud Storage

Examples may include:

• Cloudflare R2
• Cloudinary (where applicable)

Purpose:

• property photographs;
• walkthrough videos;
• verification media;
• generated documents;
• uploaded files.

Information processed may include media uploaded by authorised Platform users.

4.7 Push Notification Services

Examples may include:

• Firebase Cloud Messaging (FCM)

Purpose:

• account notifications;
• viewing reminders;
• Platform updates;
• operational alerts.

Information processed may include device notification identifiers and message delivery information.

4.8 Infrastructure and Hosting

Examples may include:

• PostgreSQL hosting providers;
• Redis hosting providers;
• Cloudflare;
• Vercel;
• Ubuntu-based cloud servers;
• Traefik infrastructure;
• other approved cloud infrastructure providers.

Purpose:

• hosting Platform services;
• data storage;
• application delivery;
• security;
• performance optimisation.

Information processed may include information required to operate Platform infrastructure securely.

4.9 Error Monitoring and Application Security

Examples may include:

• Sentry
• approved monitoring platforms

Purpose:

• diagnosing software errors;
• improving reliability;
• monitoring application health;
• identifying operational issues.

Information processed may include technical diagnostic information necessary to investigate application errors.

Sensitive personal information is not intentionally collected for monitoring purposes.

4.10 Social Media Publishing

Examples may include:

• Buffer

Purpose:

• scheduling educational content;
• publishing Platform announcements;
• managing social media workflows.

Personal information is generally not processed through these services except where necessary to administer authorised social media accounts.

5. International Data Transfers

Some Subprocessors operate infrastructure outside the Republic of Kenya.

Where personal information is transferred internationally, Makao Hive seeks to ensure that appropriate safeguards are implemented, including where applicable:

• contractual protections;
• recognised security standards;
• appropriate technical safeguards;
• vendor due diligence;
• compliance with applicable Kenyan data protection requirements.

International transfers are limited to those reasonably necessary to provide Platform services.

6. Data Retention Principles

Makao Hive retains personal information only for as long as reasonably necessary to:

• provide Platform services;
• comply with legal obligations;
• resolve disputes;
• prevent fraud;
• maintain security;
• enforce agreements;
• improve Platform operations.

Where information is no longer required, it may be:

• permanently deleted;
• anonymised;
• aggregated;
• archived where legally required.

7. Retention Categories

7.1 Account Information

Account information is retained while an account remains active and for a reasonable period thereafter to meet legal, security and operational obligations.

7.2 Authentication Records

Authentication logs may be retained for security investigations, fraud prevention and account protection before secure deletion or anonymisation.

7.3 Property Listings

Property information is retained while listings remain active and for an appropriate period thereafter to support legal compliance, operational records and dispute resolution.

7.4 Verification Reports

Verification reports may be retained to maintain Platform integrity, demonstrate verification history and respond to future enquiries or disputes.

7.5 Viewing Tour Records

Viewing requests, scheduling records and operational logs may be retained to administer services, investigate complaints and improve operations.

7.6 Rental Applications

Rental applications may be retained for reasonable operational, legal and compliance purposes, after which they may be deleted or anonymised where appropriate.

7.7 Lease Documentation

Electronic lease records may be retained for the duration required to support contractual obligations, legal compliance and dispute resolution.

7.8 Payment Metadata

Payment confirmations, transaction references and related records may be retained to support accounting, fraud prevention, refunds and legal compliance.

Makao Hive does not retain payment card information unless expressly handled by an authorised payment provider.

7.9 Customer Support

Customer support communications may be retained to resolve enquiries, improve service quality and respond to future issues.

7.10 Blog Engagement Metrics

Aggregated first-party engagement metrics may be retained to improve educational content and understand overall Platform usage.

These metrics are not intended to create advertising profiles.

7.11 AI Service Logs

Operational AI logs may be retained where necessary to:

• improve service reliability;
• investigate operational issues;
• prevent abuse;
• maintain security.

Where reasonably practicable, personal information included in AI logs is minimised.

7.12 Audit Logs

Administrative and security audit logs may be retained to demonstrate compliance, investigate incidents and protect Platform integrity.

7.13 Uploaded Media

Photographs, walkthrough videos, verification images and related media remain available while associated listings remain active, unless removed earlier by authorised users or required by law.

8. Security Measures

Makao Hive implements reasonable technical and organisational measures designed to protect personal information.

These measures may include:

• encryption in transit where appropriate;
• encryption at rest where reasonably practicable;
• role-based access controls;
• least-privilege access principles;
• authentication controls;
• security monitoring;
• audit logging;
• regular software updates;
• infrastructure security practices.

No security measure can guarantee absolute protection, but we continually seek to improve our security posture.

9. Updates to this Document

Makao Hive may update this document from time to time to reflect:

• new service providers;
• changes to existing providers;
• Platform improvements;
• legal developments;
• operational changes.

Material updates will be reflected by updating the "Last Updated" date at the beginning of this document.

10. Contact Us

Makao Hive

Public website:

https://rentals.makaohomes.co.ke

Admin console:

https://management.makaohomes.co.ke

General Support

info@makaohomes.co.ke

Legal & Privacy

legal@makaohomes.co.ke

Questions relating to subprocessors, data retention or international transfers may be directed to the contacts above.

Version History

```

```