Privacy notice
QIKAO Africa runs QIKAO FUND and is the data controller for the personal data described here. We process it under the Kenya Data Protection Act, 2019.
What we collect and why
- Account details (name, email or phone, country, password hash, authenticator secret for staff and anyone who turns it on): to sign you in and keep your account safe.
- Gift details (amount, project, payment method, provider reference, the name and message you choose to show): to take your gift, send a receipt, keep the ledger and prevent fraud. Card numbers never reach us; they stay with the payment provider.
- Organization and officer details and documents (registration papers, identity documents of officers, payout accounts): to verify organizations before they raise money and to pay them safely.
- Security records (sign-in attempts, IP address, device, audit log): to detect abuse and to show who did what.
Our lawful bases are your consent where you give it (for example to this notice), performing the service you asked for, our legal duties (tax, anti-money-laundering, record keeping) and our legitimate interest in keeping the platform secure.
What other people see
A project page shows gifts with the name you chose, or "Anonymous" if you ask. Your email, phone and payment details are never shown publicly. The organization you give to sees the gift amount and the name you chose to show, not your contact details.
Who we share it with
- Payment providers and banks, to move money.
- Email and SMS providers, to send codes, receipts and notices.
- Regulators, courts and law enforcement, where the law requires it.
We do not sell personal data.
How long we keep it
Financial and ledger records are kept for at least seven years as the law requires. Verification documents are kept while the organization is active and for the legal retention period after. Sign-in and security records are kept for up to two years. After that we delete or anonymise the data.
Your rights
You can ask to see your data, correct it, delete it where the law allows, object to or restrict how we use it, and move it to another service. We answer within the time the law sets. Financial records we must keep cannot be deleted early, but we will explain what we hold and why.
Security
Data is encrypted in transit. Access to money and personal data follows least privilege and every staff action on money is recorded in a tamper-evident audit log. Staff approve sensitive actions with an authenticator code.
Complaints
If we have not resolved a concern, you may complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
Contact
QIKAO Africa, Nairobi, Kenya. Write to us through the contact details published on the home page.