Privacy Policy

Kiimbu — student accommodation marketplaceLast updated: 5 October 2026 · Effective from: effective date

Text in double square brackets, like this, is a blank the company must fill in before publishing (legal name, address, officer names, dates). See the checklist at the end of the covering note.

1. About this policy

This Privacy Policy explains how Company legal name ("Kiimbu", "we", "us", "our"), a company incorporated in India with its registered office at registered address, collects, uses, stores, shares and protects personal data when you use the Kiimbu website at kiimbu.com and any related pages, features and services (together, the "Platform").

Kiimbu is a marketplace that helps students find and request student accommodation, and helps landlords and property managers list it. Kiimbu staff ("Kiimbu Team") review listings, coordinate booking requests and answer questions. This policy applies to everyone who uses the Platform:

• Students and prospective tenants ("Students"),
• Landlords, property owners and property managers and the people who work for them ("Landlords"),
• Visitors who only browse public pages,
• Kiimbu staff (administrators and support personnel), for the data we hold about them as staff.

It should be read together with our Terms and Conditions. If you do not agree with this policy, please do not use the Platform.

Who is responsible for your data. For the personal data described in this policy, Kiimbu decides why and how the data is processed. In data protection language we are the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the "body corporate" under the Information Technology Act, 2000 ("IT Act") and the rules made under it.

2. The short version

3. Personal data we collect

We collect only what we need to run the Platform. The tables below list what we collect, from whom, and why.

3.1 Data you give us

3.2 Data created when you use the Platform

3.3 Data we receive from others

• From Landlords: information about a property you request, such as availability and price, and the identity of the organisation that manages it.
• From the Kiimbu Team: notes entered while reviewing listings, verifying documents and handling requests. These are internal.
• From your device or browser: standard technical data sent with every request.

We do not buy data from data brokers and we do not combine your data with data from advertisers.

3.4 What we do not collect

We do not collect your Aadhaar number, PAN, bank account, card or UPI details, health information, caste, religion or biometrics through the Platform. Please do not upload such information in messages or attachments. If a landlord verification document contains such details (for example, an ID proof), upload only what the document type requires and cover anything that is not needed.

3.5 Staff data

For Kiimbu staff accounts we also keep work email, name, employee code, department, roles and permissions, assignments, authenticator (MFA) settings, and a record of administrative actions. Staff data is kept for as long as the person is staff and then for the audit period in section 10.

4. Why we use your data (purposes) and our legal basis

We use personal data only for the purposes below and not for anything incompatible with them.

"Legitimate use" refers to the lawful grounds for processing without specific consent that the DPDP Act recognises, such as compliance with law, responding to emergencies, and acting for purposes the person has voluntarily provided data for.

Consent. When we rely on consent, we ask for it in clear language at the point of collection (for example, when you create an account) and you may withdraw it at any time (section 12). Withdrawing consent will not affect what we did before, but we may not be able to continue providing features that need that data.

No automated decisions with legal effect. Search results are ordered by published rules (for example distance, price and freshness). We do not make decisions about you using automated profiling that has legal or similarly significant effects, and we do not build advertising profiles.

5. Who can see your data inside Kiimbu

• Access is limited by role. Kiimbu staff see only what their role and assignments allow. Staff with narrower roles cannot open data outside their assigned queue.
• Sensitive actions are logged. Opening a private document, changing a role or exporting data creates an audit record.
• Two-step verification. Staff accounts are protected with an authenticator app code in addition to a password and an email code.
• Database-level protection. The database itself enforces row-level rules so that one user's records are not returned to another user even if the application had a fault.

6. What Landlords and Students see of each other

• A Landlord sees a student who has made a booking request for their property by first name and the request details (dates, room type, occupants, relevant message). A Landlord does not receive the student's email address or phone number from the Platform.
• A Student sees the property and landlord-provided listing information, not the landlord's private documents or personal details.
• Students and Landlords cannot message each other directly. The Kiimbu Team relays information where needed.
• If, after a booking is confirmed, the Kiimbu Team must share contact details so you can move in, we will tell you first and share only what is needed for that purpose.

7. Who we share data with (our service providers)

We do not sell or rent personal data. We share it only with the following kinds of recipients, and only as needed.

7.1 Service providers ("Data Processors")

We choose providers that offer contractual or published security and confidentiality commitments, and we give them only what they need. They may process data only on our instructions for the purposes above.

7.2 Other recipients

• Landlords — as described in section 6.
• Professional advisers — lawyers, auditors and insurers, under confidentiality.
• Authorities — where we are required by law, court order or a lawful request from a government agency, or where it is necessary to protect the rights, safety or property of users, Kiimbu or the public. We review such requests and share only what is legally required.
• A successor business — if Kiimbu is involved in a merger, acquisition or sale of assets, personal data may be transferred under the same protections, and we will tell you if the owner or the purposes change materially.

We will not share your personal data with advertisers or data brokers.

8. Transfers outside India

Our database and server are located in India. Some providers, such as Cloudflare and Google Fonts, operate global networks, so limited technical data (for example your IP address) may be handled outside India as part of delivering the website. The DPDP Act permits transfers outside India except to countries the Government of India restricts by notification. We will comply with any such restriction, and we use providers that apply contractual security commitments.

9. Cookies and similar technologies

We use only the cookies and browser storage that the Platform needs to work and to keep you secure. We do not use advertising or cross-site tracking cookies.

Because these items are strictly necessary, they are set without a cookie banner. You can block cookies in your browser, but the Platform will not work without the essential ones.

10. How long we keep data (retention)

We keep personal data only as long as needed for the purposes in section 4, then delete or irreversibly anonymise it. The periods below are the current defaults; they may be adjusted, and legal requirements can require longer retention.

Legal holds. If data is needed for a legal claim, a complaint, a fraud or security investigation or a lawful order, we may keep the relevant data for longer and will remove it when the reason ends.

11. How we protect your data

We use technical and organisational measures that are appropriate to the risk, including:

• encryption of connections (HTTPS/TLS) and encryption of stored data by our storage and database providers;
• passwords stored only as salted one-way hashes; sign-in sessions stored only as hashed tokens;
• email one-time codes with short expiry, attempt limits and rate limiting; protection against repeated wrong-password attempts;
• mandatory authenticator-app verification for staff;
• role-based access and database row-level security, so each person sees only the records they should;
• private file storage with short-lived, logged download links; uploaded files are checked for type, size and basic safety markers before use;
• rate limiting, firewall and bot protection at the network edge;
• append-only audit logs, monitoring, and encrypted backups;
• staff access on a need-to-know basis and confidentiality obligations.

No system is completely secure. You can help by using a strong, unique password, not sharing your sign-in codes, signing out on shared devices, and telling us at once if you suspect misuse.

If there is a data breach. If a personal data breach affects you, we will inform you and the Data Protection Board of India as required by law, describing what happened, what data is involved, what we are doing and what you can do. We also report cyber-security incidents to CERT-In within the time required.

12. Your rights and how to use them

Under the DPDP Act, and as we commit regardless, you have the right to:

1. Access — get a summary of the personal data we process about you, the processing activities, and the other parties we have shared it with.
2. Correction and completion — have inaccurate or incomplete data corrected or completed.
3. Erasure — ask us to erase personal data that is no longer needed for the purpose you gave it, unless we must keep it by law.
4. Withdraw consent — at any time, as easily as you gave it.
5. Grievance redressal — have a complaint answered quickly (see section 14).
6. Nominate — nominate another person to exercise your rights if you die or become unable to act.
7. Download your data — you can request a copy of your data in a common format from Account → Privacy once signed in.

How: the easiest way is Account → Privacy inside the Platform, where you can download your data or close your account. You can also email privacy email, e.g. [email protected] from the email address on your account. We may need to verify your identity before acting, to protect you from someone else asking for your data.

Closing your account. When you close your account you lose access immediately. After the 30-day grace period the account is anonymised as described in section 10. Some records may remain in de-identified form where the law requires us to keep them.

Time frame. We acknowledge requests within 48 hours and aim to complete them within 15 days; if a request is complex or we must wait for verification, we will tell you why and complete it within the period allowed by law.

Your duties under the DPDP Act include providing accurate information, not impersonating anyone, and not filing false or frivolous complaints.

13. Children and minors

The Platform is for people who are 18 years or older. We do not knowingly collect personal data from anyone under 18, and we do not allow accounts to be created by them. If a parent or guardian believes a child has given us data, please contact us and we will delete it. Under the DPDP Act, processing a child's data requires the verifiable consent of a parent or lawful guardian, and we do not track or target children or show them advertising. If we later add support for students under 18, we will first add verified parental consent and update this policy.

14. Grievances and contact

If you have a question, a complaint or a privacy request, please contact our Grievance Officer:

• Name: Grievance Officer name
• Designation: designation
• Email: grievance email, e.g. [email protected]
• Address: registered address
• Hours: days and hours

We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied, or have not received a reply, you may complain to the Data Protection Board of India once the Board is operational and you have first used our grievance process.

For Data Protection matters you may also write to our Data Protection contact: name, email.

15. Links to other sites

The Platform may link to websites we do not operate, such as map directions. We do not control them. Read their privacy policies before you share information.

16. Changes to this policy

We may update this policy when our practices, providers or the law change. We will post the new version here with a new "last updated" date. For material changes, such as new purposes or new categories of recipients, we will notify you by email or in the Platform before they take effect and, where the law requires, ask for your consent again. Earlier versions are available on request.

17. Laws that apply

This policy is governed by the laws of India, including the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (as they come into force in phases, with the main obligations of data fiduciaries taking effect by May 2027); the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; and directions issued by CERT-In. Where a law gives you a right that is broader than this policy, the law applies.

Questions? Email privacy email or write to the Grievance Officer above.