Privacy Policy

Summary

Cape2Cairo is a property portal operated by Bowfell Software Ltd. We collect your contact details when you sign up or enquire about a property, and we use that data plus your interactions with the platform to match you with listings, connect you with agents and improve the service. When you send an enquiry to an agency, we share it with that agency, who handles your data under their own privacy policy. We use a mix of UK, EU, African and US service providers to deliver the service, including third-party AI providers. You can access, correct, delete or export your data by writing to privacy@cape2cairo.africa or using the controls in your account.

Who we are

Cape2Cairo is a trading name of Bowfell Software Ltd, a company registered in England and Wales under company number 15076300, whose registered office is at 128 City Road, London, EC1V 2NX. We are registered with the UK Information Commissioner's Office as a data controller.

Our current scale does not require us to appoint a formal Data Protection Officer under UK GDPR Article 37. Privacy is overseen at director level and privacy@cape2cairo.africa is the single point of contact.

What we collect

• Account details. Name, email, phone and preferred currency you provide when you register.
• Profile and activity. Searches, saved listings, enquiries, and for buyers the profile you maintain (current and target location, budget, property types, timeline, visibility).
• Enquiry content. Messages you send to agencies through the platform, including through WhatsApp and Telegram channels where available.
• Technical data. IP address, device, browser, and an approximate country derived from your IP.
• Payment references. When you pay us, payment is processed by Flutterwave or Paystack. They collect card details directly. We receive only a transaction reference, amount, currency and success or failure status. We do not store card numbers or CVVs.

Why we process your data

We process your data for the following purposes, on the following legal bases:

Who we share your data with

We do not sell your personal data. We share it with:

• Agencies you enquire to. Your contact details and message go to the agency for the listing you enquired about. From that point the agency becomes an independent controller of your data for their own follow-up and marketing. Their privacy policy governs that onward processing.
• Our service providers. Hosting, email, payments, analytics, AI, geocoding, storage and error monitoring providers. We update our list of service providers ahead of any material change.
• Law enforcement and regulators when we are legally required, or to protect users or the integrity of the service.
• Successor entities if we are acquired or merged, under the same protections.

International transfers

Cape2Cairo serves users across Africa and the diaspora. Your data may be transferred to and processed in countries outside the UK and EEA, including the United States (for AI and email providers) and Africa (for payment providers). Where we transfer personal data outside the UK or EEA to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (2021/914) combined with the UK International Data Transfer Addendum, the UK International Data Transfer Agreement, or a provider's own data processing agreement that incorporates those safeguards. You can request a copy of the specific safeguard by writing to privacy@cape2cairo.africa.

Automated decision-making and AI features

We use third-party AI providers to support various platform features, including listing management, search and content quality.

AI output is informational. It is not a valuation, a legal opinion or a surveyor report. Do not rely on AI-generated information as the sole basis for a financial, legal or investment decision.

Where an automated decision significantly affects you, you have the right under Article 22 UK GDPR to request human review. Email privacy@cape2cairo.africa and we will arrange a manual review of the decision in question.

How long we keep your data

Your rights

Under UK GDPR and, where applicable, the EU GDPR, POPIA, the Kenya Data Protection Act, the Nigeria Data Protection Act and the Ghana Data Protection Act, you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify data that is inaccurate or incomplete.
• Erase your data, subject to legal obligations.
• Restrict processing while a dispute is resolved.
• Object to processing based on legitimate interest, including direct marketing.
• Portability: receive a machine-readable copy of the data you gave us.
• Withdraw consent for any processing we perform on the basis of consent.
• Human review of automated decisions that significantly affect you.

To exercise any of these rights, email privacy@cape2cairo.africa. We acknowledge within 72 hours and respond within one calendar month. Where a request is complex we may extend by up to two months and will tell you why.

Messaging channels

If you contact an agency through WhatsApp from our platform, your phone number and message are routed through the Meta WhatsApp Business API. Meta processes that data under its own privacy policy.

If you are an agent who links a Telegram account, your Telegram user ID is stored against your agent record. Messages you send to our Telegram bot are processed under Telegram's own privacy policy. We store the content you provide for as long as needed to complete the listing flow, and up to 30 days after your last activity.

Multi-tenant context

When an agency uses Cape2Cairo, their agents and listings appear on a shared portal but the agency operates as a distinct tenant. If you interact with an agency through the platform, both Cape2Cairo and that agency are involved in processing your data. Cape2Cairo handles platform operation and routing; the agency is responsible for their own onward contact with you.

Cookies and similar technologies

We use strictly necessary cookies for login and security, and analytics cookies (PostHog, hosted in the European Union) for product improvement. Analytics cookies are off by default for users in the EU, UK, EEA and Switzerland until you accept the consent banner. Users elsewhere are opted in by default and can opt out from the footer. We do not currently use advertising, retargeting or third-party social-plugin cookies.

Security

We protect your data with TLS in transit, encryption at rest where supported, role-based access controls, short-lived session tokens with server-side revocation, honeypot fields, rate limiting and webhook signature validation. No system is perfectly secure. If you believe your account is compromised, change your password and contact us at privacy@cape2cairo.africa.

Breach notification

If we discover a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office within 72 hours of becoming aware of it, as required by UK GDPR Article 33. Where the risk to you is high under Article 34, we will also notify you directly without undue delay.

Children

Cape2Cairo is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, email privacy@cape2cairo.africa and we will delete it.

Complaints and supervisory authorities

You can complain to a data-protection authority as well as to us:

• United Kingdom: Information Commissioner's Office, ico.org.uk
• European Union: your national data-protection authority
• South Africa: Information Regulator, inforegulator.org.za
• Kenya: Office of the Data Protection Commissioner, odpc.go.ke
• Nigeria: Nigeria Data Protection Commission, ndpc.gov.ng
• Ghana: Data Protection Commission, dataprotection.org.gh

Changes to this policy

We may update this policy to reflect changes to the service, the law or industry practice. Material changes (for example, a new processing purpose or a new service provider in a new jurisdiction) will be notified to account holders by email at least 30 days before they take effect, and displayed on the website. Non-material changes take effect on posting.