Privacy Policy

Last updated: [date of publication]

This policy is written to align with Kenya's Data Protection Act, 2019 (Act No. 24 of 2019) and its implementing regulations, enforced by the Office of the Data Protection Commissioner (ODPC). Text in italics like this marks a placeholder that needs your specific business details filled in before publishing.

1. Who we are

[Legal entity name, e.g. "Novacom Limited, trading as 1report"], a company registered in Kenya (registration no. [company registration number]), is the data controller responsible for your personal data when you use 1report. Our registered address is [physical/registered address]. Our Data Protection Officer can be reached at [dpo@yourdomain.co.ke].

We are [registered / in the process of registering] as a data controller and data processor with the ODPC, registration certificate no. [ODPC registration number].

2. What personal data we collect

Account and registration data

Full name, work email address, and phone number
Property/hotel name, country, and preferred currency
Password (stored as a one-way cryptographic hash — we never store or can see your actual password)
Two-factor authentication setup (if you enable it)

Billing data

Subscription plan, billing cycle, and invoice/payment history
Payment method used (we do not store full card or mobile money account numbers)

Usage and security data

Login timestamps, IP address, and authentication outcomes (for account security and audit purposes)
Actions taken within the platform by your organisation's users

3. Why we process your data, and our legal basis

Purpose	Legal basis (DPA 2019)
Creating and administering your account	Performance of a contract with you
Billing and invoicing	Performance of a contract; legal obligation (tax records)
Account security, fraud prevention, audit logging	Legitimate interest in keeping the platform secure
Sending service and account-related emails	Performance of a contract
Marketing communications (if any)	Your consent, given freely and revocable at any time

4. Who we share data with

We do not sell your personal data. We share data only with:

Service providers who process data on our behalf under contract (e.g. email delivery, hosting), acting as data processors as defined under the Act
Payment service providers, to the extent needed to process a payment you initiate
Regulators or law enforcement, where required by Kenyan law

5. International data transfers

1report serves hotel groups across multiple countries. Where personal data is transferred outside Kenya, we do so consistent with the safeguards required under the Data Protection (General) Regulations, 2021 — including verifying the recipient jurisdiction provides adequate protection, or putting contractual safeguards in place, before any such transfer.

6. How long we keep your data

We retain account and transaction data for as long as your account is active, and for [1 year / your stated retention period] afterward for legal, audit, and tax purposes, consistent with our advertised data retention terms. You can request earlier deletion — see Section 7.

7. Your rights under the Data Protection Act, 2019

As a data subject, you have the right to:

Be informed of how your personal data is used (this policy)
Access the personal data we hold about you
Request correction of inaccurate or outdated data
Request deletion of your data, where there is no overriding legal reason to keep it
Object to processing of your data, including for direct marketing
Data portability — receive your data in a structured, commonly-used format
Restrict processing in certain circumstances
Lodge a complaint with the Office of the Data Protection Commissioner if you believe we have not handled your data lawfully

To exercise any of these rights, contact us at [privacy@yourdomain.co.ke]. We will respond within the statutory timeframe.

You may also contact the ODPC directly: www.odpc.go.ke.

8. Security measures

We protect your data using industry-standard measures, including encrypted password storage, optional two-factor authentication, role-based access controls, and audit logging of account activity.

9. Children's data

1report is a business-to-business platform intended for use by adults acting on behalf of their employer. We do not knowingly collect personal data from children.

10. Cookies

See our Cookie Policy for details on the cookies we use.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified to registered users by email or an in-app notice.

12. Contact us

Questions about this policy or your data: [privacy@yourdomain.co.ke]
Data Protection Officer: [name / contact]
Registered address: [address]