Privacy policy

1. Who is responsible

The data controller is [Registered business or company name], [Business address, town, Kenya], registered with the Office of the Data Protection Commissioner (ODPC) under number [ODPC registration number]. For anything about your personal data, write to [support email address].

2. What we collect

If you have an account:

• your name, phone number and/or email address, and whether you advertise or publish;
• your password, stored only in scrambled form (a one-way hash), so nobody, including us, can read it;
• payments: the M-Pesa number, amount and M-Pesa code of each top-up or withdrawal (we never see your M-Pesa PIN);
• what you add to the site: campaigns, banners, websites and ad slots, and the decisions on them;
• sign-in records: a sign-in cookie, the kind of browser used, and failed sign-in attempts;
• the emails we send you, for 90 days, and when you agreed to our terms.

If you see one of our ads on a publisher’s site: our ad code keeps a random number in your browser (not linked to your name), and we look at your internet address and the kind of browser you use. We don’t store your internet address: we mix it with a secret into a code that changes every day. We record which ad was shown, on which site, and whether it was seen or clicked.

3. Why we use it, and on what basis

• To provide the service you signed up for (performing our contract with you): your account, ads, payments, earnings and withdrawals, and messages about them, such as “your ad is approved” or password resets.
• To keep the service safe and fair (our legitimate interests): counting real views and clicks, detecting fraud, limiting repeated sign-in attempts, and keeping backups.
• To meet our legal duties: for example keeping financial records for the Kenya Revenue Authority, and answering lawful requests from authorities.

We don’t sell personal data, and we don’t send marketing messages without asking you first.

4. Who we share it with

• Safaricom, to process M-Pesa payments and withdrawals;
• our hosting provider, Contabo GmbH, whose servers keep the site and its data ([server location, e.g. Germany]);
• our email service, [name of the email provider], to deliver our emails;
• professional advisers (lawyers, accountants) and authorities when the law requires it.

Advertisers and publishers only see totals (views, clicks, money), never who the visitors were. Where data is kept outside Kenya, we make sure it is protected as the Data Protection Act requires. [Safeguards for transfers to be confirmed with your advocate.]

5. How long we keep it

• account details: while your account is open, then as long as the law requires;
• payment and earnings records: [5] years, as tax law requires;
• views and clicks: [period to decide, e.g. 2 years], for reports and fraud checks;
• sign-in sessions: 30 days; codes used to limit repeated attempts: 1 day; copies of emails: 90 days; backups: 14 days.

6. How we protect it

Connections to the site are encrypted (https). Passwords are stored as one-way hashes. Only people who need it can reach the data, the site checks who is allowed to see every page, and the database is backed up every day.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your personal data is used (this page);
• see the personal data we hold about you, and get a copy you can take elsewhere;
• have wrong or misleading data corrected, and have data deleted when we no longer need it;
• object to our using your data.

Write to [support email address] and we will answer within [7] days. If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Cookies and similar

Our website uses one cookie, to keep you signed in. On publishers’ sites, our ad code keeps one random number in the browser to count views and stop fraud. We use no tracking or advertising cookies from other companies.

9. Children, and changes

Accounts are for adults (18 and over), and our ads are not aimed at children. If this policy changes, we will say so on this page, and by email for important changes.