The terms governing your use of the Secure Labs Systems platform and this website.
These Terms govern your use of the Platform only. They do not create any employment, tenancy, or other relationship between you and an Estate Operator, an Enterprise Tenant, or Secure Labs Limited beyond what is expressly set out here.
These Terms of Service govern your access to and use of the Platform. By creating an account, activating an account, or otherwise using the Platform, you confirm that you accept these Terms and the Privacy Policy. Your acceptance is recorded in our consent log together with the version of these Terms you accepted, the date and time of acceptance, your IP address, and your browser type and version (KDPA §32(4)).
By creating or activating an account, you confirm that you are at least eighteen (18) years old. This confirmation is recorded as part of your account identity data. If you are not at least eighteen, you must not use the Platform.
If you are using the Platform on behalf of another person or organisation, you represent that you are authorised to bind that person or organisation to these Terms and that you accept these Terms on their behalf.
The Platform provides visitor and access management services to Estate Operators. The features available to you depend on (i) your role on the Platform and (ii) the modules that the Estate Operator has enabled. We may add, modify, or remove features from time to time. Where a change materially reduces the functionality you previously had, we will notify you in advance.
Beta or experimental features may be made available from time to time. They are clearly marked as such and are provided without representation or warranty and without any service commitment.
Certain notifications — including visit confirmations, access alerts, account and security notices — are part of the Platform's core functionality and will continue while your account is active. You can only stop receiving these by closing your account. Optional marketing communications, if we introduce them, will require your prior consent and will include a clear opt-out.
The Platform supports access-control decisions made by Estate Operators and their staff, but it does not itself decide who may enter or remain on any premises. The final decision to admit or deny entry to a visitor always rests with the Estate Operator and its authorised personnel, not with Secure Labs Limited.
You are responsible for maintaining the confidentiality of your account credentials, including your password and any multi-factor authentication codes. You agree to notify us immediately of any unauthorised use of your account by contacting [email protected]. You may not share your account or transfer it to another person.
You may delete your account at any time via Account Settings. On deletion, the data we retain and the data we anonymise are described in §10 of the Privacy Policy.
We may suspend or terminate your account if you breach these Terms, if your use of the Platform creates a security risk for other users, if your Estate Operator instructs us to do so (in respect of accounts associated with that Estate Operator), or if we are required to do so by law. Where the suspension is not urgent we will give you reasonable notice and a chance to cure the breach. We may also suspend or restrict access to the Platform, or to particular features, where reasonably necessary for maintenance, security, or legal compliance.
You agree that you will not:
If we reasonably believe that your use of the Platform breaches this section or creates a risk to other users, to an Estate Operator, or to the security or integrity of the Platform, we may investigate and take appropriate action, including suspension or termination of your account.
When you invite a visitor or add a contact to your address book, you confirm that you have a lawful basis to share that person's contact details with the Platform — typically because you have asked them and they have consented. Where the visitor is your invitee, you are the data controller for the personal data of that visitor that you submit, and we act as your data processor in respect of that submission.
Where your visitor pre-registers by replying to an SMS with their invitation code, we process the reply against the phone number already associated with the invitation; that processing is described in §15 of the Privacy Policy and relies on the same lawful-basis allocation set out in this section. Where you are the inviting resident, you should ensure that the visitor is aware that their personal data will be shared with the Platform for access-management purposes.
Where an Estate Operator or Enterprise Tenant uses the Platform, that organisation is an independent data controller for its own employment, tenancy, and visitor-management purposes. It is responsible for having a lawful basis to process personal data through the Platform and for providing its own privacy notice and obtaining any required consents.
The visitor has rights under the KDPA — including access, rectification, and erasure — that they can exercise by contacting the Estate Operator they visited or by emailing us at [email protected]. You agree to cooperate with any reasonable request from us to enable a visitor to exercise those rights.
Where you submit data relating to a child, you are responsible for ensuring that doing so is lawful and, where required, that appropriate consent from a parent or guardian has been obtained in accordance with the KDPA and the Children Act 2022. We process such data only for access-control and security-incident purposes and do not use children's data for marketing or profiling.
We also process certain data about your use of the Platform — such as access logs, security events, and rate-limit records — as an independent data controller for the purposes described in the Privacy Policy.
Where you are a resident, employee, or visitor of an Estate Operator, the Estate Operator is the data controller for the access-control purposes carried out at its premises and we act as the Estate Operator's data processor. Our processing in that capacity is governed by a Data Processing Agreement between us and the Estate Operator. Data relating to one Estate Operator or Enterprise Tenant is not accessible to another through the Platform.
You should be aware that the Estate Operator's property manager and (where applicable) security supervisor can view records of your visitors and access events on the Platform. The Estate Operator's own privacy notice governs its use of that visitor and access data; the Secure Labs Systems Privacy Policy does not cover processing carried out by the Estate Operator in its capacity as an independent data controller.
Where you are an employee or contractor of an Enterprise Tenant, your employer is the data controller for visitor and access data within its zone, and we act as the company's data processor. Your employer's own privacy notice governs the employment aspects of your data use on the Platform. Your employer is responsible for having a lawful basis to onboard you as a Platform user.
The allocation of data-controller responsibilities between us, the Estate Operator, and any Enterprise Tenant is further described in the Privacy Policy.
We target high availability and take reasonable steps to minimise downtime. We do not guarantee uninterrupted service. Where the Platform is temporarily unavailable, our gate-side guard application is designed to operate offline for a defined trust window so that physical access at the gate is not blocked.
We may schedule planned maintenance windows in advance and will give Estate Operators reasonable notice of any maintenance that is likely to affect Platform availability.
From time to time, the Platform may be unavailable due to factors outside our reasonable control (including those described in §18). To the fullest extent permitted by law and subject to §11, we are not liable for any loss or damage arising solely from temporary unavailability of the Platform.
Subject to §11, the Platform is provided "as is" and "as available". We make no express or implied warranty, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement, to the fullest extent permitted by applicable Kenyan law.
The Platform, including its software, design, branding, and content, is the intellectual property of Secure Labs Limited or its licensors. You receive a limited, non-exclusive, non-transferable, revocable licence to use the Platform for its intended purpose. No other rights are granted.
You retain ownership of any content you submit to the Platform (for example, visitor names you enter when issuing an invitation). By submitting that content, you grant us a worldwide, royalty-free, non-exclusive licence to host, store, transmit, and display the content for the limited purpose of operating the Platform on your behalf and providing the service to you and to the Estate Operator.
If you choose to send us feedback or suggestions, you agree that we may use that feedback without obligation to you.
You may delete your account at any time via Account Settings. We may suspend or terminate your access if you breach these Terms or if we are required to do so by law. Upon termination, the rights granted to you under these Terms cease immediately.
Where an Estate Operator cancels its subscription to the Platform, accounts associated with that Estate Operator will be deactivated. We will use reasonable efforts to give users associated with that Estate Operator at least fourteen (14) days' notice of deactivation, except where the cancellation is immediate as a result of non-payment, breach of contract, or an instruction from a regulatory or law-enforcement authority. Data retained after deactivation is handled in accordance with §10 of the Privacy Policy.
The following sections survive termination: §1, §6, §7, §9, §11, §12, §14, §15, §16, §17, §18, §19, §20, §21, §22, and §23, together with the data-retention obligations described in §10 of the Privacy Policy.
Your statutory rights under the KDPA in respect of personal data we continue to hold after termination are described in the Privacy Policy and survive termination of these Terms.
We are not obliged to refund any sum paid, if any, in respect of any period before termination.
Subject to the carve-outs below, our total aggregate liability to you in connection with the Platform — whether in contract, tort (including negligence), or otherwise — is limited to the greater of (a) the total fees paid by you (if any) in the twelve (12) months preceding the event giving rise to the claim, or (b) Kenya Shillings One Million (KES 1,000,000).
We are not liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for loss of profits, revenue, data, or business opportunity, even if we have been advised of the possibility of such damages, and even if any limited remedy fails of its essential purpose, to the extent that such exclusion is permitted under applicable law.
Nothing in these Terms limits or excludes our liability for (i) death or personal injury caused by our negligence, (ii) fraud or fraudulent misrepresentation, (iii) wilful misconduct, (iv) any liability that cannot be limited or excluded under applicable Kenyan law, or (v) any award of damages made under section 56 of the Kenya Data Protection Act 2019, which we acknowledge is non-waivable.
You agree to indemnify Secure Labs Limited against direct losses, damages, costs, and expenses (including reasonable legal fees) to the extent arising out of (i) your unlawful submission of a third party's personal data to the Platform, (ii) your breach of these Terms, or (iii) your wilful violation of any applicable law in connection with your use of the Platform. Your aggregate indemnification liability under this section is subject to the same cap set out in §11. This indemnity does not apply to indirect or consequential losses.
This indemnity applies only where you are using the Platform in a commercial or professional capacity, including as an Estate Operator administrator or Enterprise Tenant administrator; it does not apply to individual residential users of the Platform. Nothing in this section limits or affects any rights you have as a data subject under the KDPA or any other non-waivable applicable law.
We may update these Terms from time to time. Where the change is material, we will give you not less than thirty (30) days' advance notice by email and by an in-app banner, and we will require your re-acceptance on next sign-in after the new Terms take effect. If you do not accept the new Terms, you may delete your account at any time before they take effect; continued use of the Platform after the effective date constitutes acceptance.
These Terms are governed by the laws of Kenya. Nothing in these Terms limits any rights you may have as a consumer under the Kenya Consumer Protection Act 2012 or any other applicable consumer protection law.
The parties shall first attempt to resolve any dispute by good-faith negotiation. If the dispute is not resolved within thirty (30) days of written notice from one party to the other, either party may refer the dispute to mediation in Nairobi under the mediation rules of the Nairobi Centre for International Arbitration (NCIA). If mediation fails to resolve the dispute within sixty (60) days of the appointment of the mediator, the courts of Kenya shall have exclusive jurisdiction. Nothing in this section prevents either party from seeking urgent injunctive relief from a court.
Notwithstanding the above, an individual user who is not using the Platform in a commercial or professional capacity may refer any dispute directly to the courts of Kenya without first completing the negotiation or mediation steps set out above.
If any provision of these Terms is held by a court of competent jurisdiction to be invalid, illegal, or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force. The parties shall in good faith negotiate a replacement provision that achieves, to the maximum extent possible, the original commercial intent.
These Terms, together with the Privacy Policy and any agreement between us and your Estate Operator that applies to your use of the Platform, constitute the entire agreement between you and us in respect of the Platform. They supersede any prior or contemporaneous understandings, communications, or agreements, whether oral or written.
If there is any conflict between these Terms and a separate written agreement between us and an Estate Operator or Enterprise Tenant, that separate agreement will govern our relationship with that Estate Operator or Enterprise Tenant to the extent of the conflict, and these Terms will govern our relationship with you as a user.
In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach where required by KDPA §43, and we will notify affected data subjects without undue delay.
Neither party is liable for any failure or delay in performance to the extent that the failure or delay is caused by an event beyond that party's reasonable control, including (without limitation) acts of God, natural disaster, civil unrest, war, terrorism, government action, sustained nationwide internet outage lasting more than twenty-four (24) hours, sustained power-grid failure, or epidemic. The affected party shall notify the other promptly and use reasonable efforts to mitigate the effect of the event.
Notices to us must be sent by email to [email protected]. Notices to you may be sent by email to the address associated with your account, by in-app banner, or by any other means we reasonably determine to be likely to reach you. A notice is deemed received on the day it is sent if sent on a business day before 17:00 EAT, and otherwise on the next business day.
You may not assign or transfer your rights or obligations under these Terms without our prior written consent. We may assign or transfer our rights and obligations to an affiliate, to a successor in interest in connection with a merger, acquisition, or sale of all or substantially all of our assets, or to any party that we engage to operate the Platform on our behalf, in each case without your consent. Where we assign these Terms to a new entity in a merger, acquisition, or similar transaction, we will notify you in advance and you may delete your account before the transfer takes effect if you do not wish your data to transfer to the new entity.
These Terms are for the benefit of the parties only. No third party has any right to enforce any provision of these Terms. In particular, a visitor whose data you submit to the Platform is not a party to these Terms and may not enforce them against us, although the visitor retains all rights under the KDPA and the Privacy Policy.
Our failure to enforce any right or provision of these Terms is not a waiver of that right or provision. A waiver of any right or provision is effective only if in writing and signed by an authorised representative of Secure Labs Limited.
You agree that you will not, in connection with these Terms or your use of the Platform, offer, promise, give, request, agree to receive, or accept any financial or other advantage that is intended to induce or reward improper performance, in violation of the Anti-Corruption and Economic Crimes Act 2003 of Kenya, the Bribery Act 2016 of Kenya, or any other applicable anti-corruption law. You will promptly notify us if you become aware of any breach of this section.
Secure Labs Limited
P.O. Box 8456-00100, Tom Mboya Street, Nairobi, Kenya
Telephone: +254 745 424 949
Email: [email protected]
For data protection matters, including data subject access requests and complaints, see the contact details set out in the Privacy Policy. You may also file a complaint directly with the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
| Version | Effective date | Summary of changes |
|---|---|---|
| 1.0 | 5 May 2026 | First public version. |