1. Introduction

At eServices Kenya ("we," "our," "us"), your privacy is of utmost importance. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. Please read this policy carefully. By accessing or using our services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

We are committed to protecting your personal data and complying with the Data Protection Act of 2019 of the Republic of Kenya.

2. Information We Collect

We collect several types of information from and about users of our services:

2.1 Personal Information You Provide

2.2 Automatically Collected Information

• Usage Data: Pages visited, time spent on site, features used
• Device Data: IP address, browser type, operating system, device identifiers
• Location Data: Approximate location based on IP address
• Cookies: Small data files stored on your device to enhance user experience

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To process your service requests, submit applications to government portals, and provide assistance.
• Communication: To contact you via WhatsApp regarding your requests, provide updates, and respond to inquiries.
• Membership Management: To manage your membership benefits, track free service usage, and send renewal reminders.
• Payment Processing: To facilitate payments through Paystack and manage billing.
• Customer Support: To assist with issues, answer questions, and resolve complaints.
• Improvement: To analyze usage patterns and improve our services.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Security: To detect, prevent, and address fraud, security, or technical issues.

4. Legal Basis for Processing

Under Kenyan law (Data Protection Act, 2019), we process your personal data based on the following legal grounds:

• Consent: You have given explicit consent for us to process your data for specific purposes.
• Contract Performance: Processing is necessary for the performance of a contract with you (service delivery).
• Legal Obligation: Processing is necessary for compliance with legal obligations.
• Legitimate Interests: Processing is necessary for our legitimate business interests (improving services, fraud prevention).

5. How We Share Your Information

We may share your information in the following circumstances:

• Government Portals: Your information is submitted to government websites (e-Citizen, KRA, NTSA, etc.) as necessary to complete your service requests.
• Service Providers: Third-party vendors who assist with payment processing (Paystack), file storage (File.io), and analytics.
• Legal Requirements: When required by law, court order, or government regulation.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• Protection of Rights: To protect our rights, privacy, safety, or property.

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: Data transmitted between your browser and our servers is encrypted using SSL/TLS technology.
• Secure Storage: Personal data is stored in secure databases with access controls.
• Document Handling: Uploaded documents are stored temporarily and deleted after 30 days or when no longer needed.
• Access Control: Only authorized personnel have access to your information.
• Regular Audits: We conduct regular security assessments to identify and address vulnerabilities.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Service Records: Retained for 2 years after the last service request for audit and legal purposes.
• Membership Data: Retained for 1 year after membership expiration or until renewal.
• Communication Logs: Retained for 1 year for customer support and dispute resolution.
• Uploaded Documents: Automatically deleted 30 days after service completion.
• Payment Records: Retained for 5 years for financial audit and tax compliance.

After the retention period, your data will be securely deleted or anonymized.

8. Your Rights

Under the Kenyan Data Protection Act (2019), you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data ("right to be forgotten").
• Right to Restrict Processing: Request that we limit processing of your data.
• Right to Data Portability: Request transfer of your data to another service provider.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise any of these rights, please contact us at privacy@eserviceskenya.co.ke or via WhatsApp at +254 745 358 457.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website:

• Essential Cookies: Necessary for the website to function properly (e.g., session management).
• Preference Cookies: Remember your preferences and settings.
• Analytics Cookies: Help us understand how visitors interact with our website (Google Analytics).

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our website.

10. Third-Party Links

Our website may contain links to third-party websites (government portals, payment gateways, etc.). We are not responsible for the privacy practices or content of these third-party sites. We encourage you to read their privacy policies before providing any personal information.

11. Children's Privacy

Our services are intended for adults aged 18 years and above. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

12. International Data Transfers

Your information may be transferred to and processed in countries outside Kenya. We ensure that appropriate safeguards are in place to protect your data, including standard contractual clauses approved by the ODPC.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be effective immediately upon posting on this page. We will notify you of significant changes via:

• A notice on our website
• WhatsApp message to active customers
• Email notification (if provided)

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our services after changes are posted constitutes your acceptance of the revised policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Data Protection Officer: dpo@eserviceskenya.co.ke
• General Inquiries: privacy@eserviceskenya.co.ke
• WhatsApp: +254 745 358 457
• Phone: +254 712 345 678
• Address: Nairobi, Kenya