Pongezi Privacy Notice
DRAFT for legal review. Not yet in force. Publish only after Mafichoni Limited's registration with the Office of the Data Protection Commissioner (ODPC) is confirmed, and fill in the registration number below.
Last updated: [date]
Who we are. Pongezi is operated by Mafichoni Limited, [address], Kenya. ODPC registration no. [number]. Contact for privacy matters: [email / phone].
What we collect
| From | Data | Why |
|---|---|---|
| Guests who leave a wish | Name, message, time posted; a scrambled (hashed) version of your internet address | To show your wish on the page; to stop spam (the scrambled address can't be turned back into your address) |
| Guests who contribute | Name, M-Pesa phone number, amount, M-Pesa receipt, optional message | To process your payment, to show your wish with a Supporter badge, and so the Host can thank you |
| Hosts | Name, ID name for verification, phone, payout M-Pesa number, event details, photos | To build the page, verify payouts and pay you |
Not shown publicly, ever: phone numbers and contribution amounts.
Who can see it
- The Host sees each guest's name, phone number, amount and message in their dashboard, to send
thank-you notes. Hosts agree to use this only to thank guests for this event.
- Mafichoni Limited staff, for support, payouts and fraud checks.
- Our service providers:
- Safaricom M-Pesa, through the Mafichoni Limited payment gateway (payments);
- Supabase (database; servers outside Kenya);
- Vercel (hosting; servers outside Kenya).
We use providers with appropriate safeguards for cross-border transfers under the Data Protection Act 2019.
- Authorities, only where the law requires it.
How long we keep it
- Page content (wishes and photos): until 30 days after the page expires, unless the Host extends the page.
- Payment records: as long as tax and financial law requires (currently up to 7 years).
Your rights
Under the Data Protection Act 2019 you can ask to access, correct or delete your data, or object to its use. Contact [email / phone]. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Children
Pages about children are created by a parent or guardian and are hidden from search engines by default.