This policy explains what personal data Koiva Events handles, why, who sees it, how long we keep it, and how to use your rights. We have tried to write it in plain language.
Last updated: [CONFIRM: date of publication]
Koiva Events is a product of Koiva Technologies Ltd, [CONFIRM: registered address], Nairobi, Kenya ("Koiva", "we"). You can reach our privacy contact at privacy@koiva.events.
[CONFIRM: registration with the Office of the Data Protection Commissioner (ODPC) of Kenya, registration number, and the name of the data protection officer if one is appointed.]
Koiva Events is a platform used by event organisers, venues and other organisations ("organisers"). We act in two different roles:
When you use our privacy request page, we find every organiser holding data for your email address and pass your request to each of them, and we handle our own data ourselves.
Your name, email address and telephone number, the ticket you chose, answers to any questions the organiser asks, your badge code, whether and when you were checked in at the door or at other points the organiser set up, and payment details (see below).
The organiser chooses the questions for each event. Typical ones are your company, job title and country, and the answers you give are kept with your registration. Some questions are about you personally, such as your gender, age range, dietary needs or access needs. These are always optional, they always include a “Prefer not to say” answer, and each says what it is used for next to the question. Only organiser staff who have been given that access can read them, they are never printed on your badge, and charts made from them leave out any group of fewer than three people. Answers are deleted with the rest of your registration details when you ask us to erase your data. [CONFIRM: retention period for registration answers after an event.]
Your email address, optionally your first name, the exact wording you agreed to, the time you agreed, a one-way hash of your network address and your browser's description. These are kept as proof of your consent. You can also agree while registering, by ticking a separate box that is never ticked for you.
For M-Pesa, we receive the phone number paying, the amount, the reference and the result from Safaricom. We never see your M-Pesa PIN. [CONFIRM: list any other payment methods enabled.]
The business and contact details you give, the quotes and documents you upload, and records of when messages were sent, opened and answered.
An organiser may keep a pool of the people it asks to work at its events, such as gate officers, ushers, drivers and other casual workers, volunteers and agency staff. For each person the organiser holds their name, phone numbers and email, the type and number of their identity document and a picture of it, a photo of their face, where they live, a next of kin if they give one, their skills and languages, and their confirmation that they are 18 or older. We do not collect a date of birth. The person is invited by a private link to fill in their own details, and sees the wording they agree to before they do. The identity document number is stored encrypted and is shown in full only to the few people the organiser has given that access, and each time it is looked at that is recorded. The organiser is the controller of this data and we process it on its instructions; the organiser uses it to check who a person is, decide whether to ask them to work, place them at an event and contact them about work, and for the safety and security of events. Only organiser staff who manage staffing can see it. You can ask for a copy or for deletion on our privacy request page (you can add the phone number you registered with if you have no email on file): on deletion your name, contacts, identity details, address, next of kin, photos and ID images are erased and what remains is a record that someone worked, without who they were. [CONFIRM: whether details may be passed to venues, police or county authorities for event safety or accreditation, and on what basis.] [CONFIRM: retention period for people who work at events after they last work.] When the organiser puts a person on an event we also hold where and when they work, the pass they scan with (when it was opened and from how many devices, not where they were), the badges they scanned in the course of that work, and what they were paid: the amount, the M-Pesa number it was paid to and the M-Pesa reference. Pay records are financial records: if you ask for deletion, the organiser keeps them, with your name and M-Pesa number, for the period it has set (7 years unless it chooses otherwise; the period is a setting of the organiser), and removes your name and number from them once that period has passed and you ask again. Everything else about you is erased straight away. [CONFIRM: that a 7 year default for pay records is the right period under Kenyan tax and employment record rules, whether it may be set shorter than that, and whether pay records may be kept with the name once someone has asked for deletion.]
Your name, email address, role and permissions, sign-in records (time, address, device), and security events such as password changes.
Standard technical data our servers record to run and protect the service: network address, browser, pages requested and times. [CONFIRM: whether any analytics or advertising cookies are used. Today the product sets only the cookies needed to sign you in. If that changes, this section and a cookie notice must change first.]
| Purpose | Basis |
|---|---|
| Checking who a casual worker is, deciding whether to ask them to work, placing them at an event | Your consent (given on your own page) and, once you work for the organiser, performing that agreement [CONFIRM with counsel] |
| Registering you, issuing your badge and ticket, checking you in, taking payment | Performing the contract with you (the organiser's registration) |
| Sending event updates you asked for | Your consent, which you can withdraw at any time |
| Running organiser accounts, support, billing | Performing our contract with the organiser |
| Keeping the service secure, preventing fraud and abuse, fixing faults | Our legitimate interests |
| Keeping financial records and answering lawful requests | Legal obligation |
We do not use your data for automated decisions that significantly affect you.
We do not sell personal data and we do not share it for cross-context behavioural advertising. We keep the "Do not sell or share my personal data" option on our request page so that residents of places with such laws (for example California) can record the choice and receive written confirmation.
[CONFIRM: where servers and providers are located.] Where data is stored or processed outside Kenya, we rely on safeguards that the Kenya Data Protection Act, 2019 allows, such as contracts with the provider that require equivalent protection. Ask us at privacy@koiva.events for details.
[CONFIRM every period below with counsel and your accountant.]
| Data | Kept for |
|---|---|
| Registration and check-in records | [CONFIRM: for example 24 months after the event, as the organiser chooses] |
| Update-list subscriptions | Until you unsubscribe, then your address is kept only to remember not to email you [CONFIRM: period] |
| Payment and invoice records, and records of what casual workers were paid | [CONFIRM: for example 7 years, the usual tax record period; for pay records the organiser sets the period, 84 months by default] |
| People who work at events (details, ID images, photo) | [CONFIRM: for example 24 months after they last worked, as the organiser chooses; deleted or anonymised on request] |
| Sign-in and security logs | [CONFIRM: for example 12 months] |
| Unfinished privacy requests' verification links | 7 days |
| Data exports made for you | 30 days, then deleted |
When we delete your data at your request, records we must keep by law (such as a paid order) are kept without your name, email or phone: they are anonymised.
Under the Kenya Data Protection Act, 2019, and laws in other places that apply to you, you can:
Use the privacy request page. We confirm it is you by emailing a link to the address you give, so we do not hand your data to someone else. After you have made a request, you can see its progress on the same page: we email you a six-digit code to prove you control the inbox.
We aim to reply within [CONFIRM: 30 days] of verifying your email, and tell you if we need longer and why. A request is free unless it is clearly unfounded or excessive. We may refuse part of a request where the law allows, and we will say which part and why.
Each organiser's data is separated from every other organiser's at the database level. Connections use encryption. Passwords are stored as one-way hashes. Access to personal data inside Koiva is limited by role and logged. Verification and one-time codes are stored only in hashed form and expire quickly. No system is perfectly secure: if a breach is likely to harm you we will tell you and the regulator within the time the law requires.
Koiva Events is for organisers and attendees who are adults. If an organiser runs an event for children, they must get a parent's or guardian's consent as the law requires. We do not knowingly create accounts for children. If you think a child's data was given to us without proper consent, write to privacy@koiva.events.
We use only the cookies needed to keep you signed in and secure. We do not use advertising cookies. [CONFIRM before adding analytics.]
You are the controller of the attendees', subscribers' and suppliers' data you collect with Koiva Events, and we process it on your instructions. You are responsible for having a lawful reason to collect it, for telling people what you do with it (we provide a short policy template that links to this page), for registering with the ODPC where the law requires, and for answering requests forwarded to you within the time allowed. The privacy requests queue in your admin shows what is due. A data processing agreement is available on request at privacy@koiva.events. [CONFIRM: whether it is part of the terms.]
When we change this policy in a way that matters, we will say so on this page and, where we hold your email for a relevant purpose, by email. Older versions are available on request.
privacy@koiva.events
Koiva Technologies Ltd, [CONFIRM: address], Nairobi, Kenya