Privacy Policy

1. INTRODUCTION

Welcome to this page!

Below is our Privacy Policy also known as "Privacy Notice." We appreciate you taking the time to read this Policy. Millennials Speak is referred to in this Privacy Policy as "the Company", "We", "Our" or "Us". We are committed to ensuring that your personal data is collected and used lawfully and transparently. This Privacy Policy may also be obtained as a hard copy when you submit personal data at our offices.

We process your personal data according to the provisions of the Data Protection Act, 2019 ('the Act'), The Data Protection General Regulations 2021, The Data Protection (Registration of Data Controllers and Data Processors) 2021, The Data Protection (Complaints Handling and Enforcement Procedures) Regulations 2021 as may be amended from time to time, and any other regulations made thereunder (collectively, "the Data Protection Legislation").

We understand that your privacy is important to you and we care about how your personal data is used. We respect and value the privacy of all our users and visitors and we will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the Data Protection legislation (as defined hereinbelow).

2. INFORMATION ABOUT US

We are Millennials Speak Limited. A social enterprise located in Nairobi. We have developed an App known as Badilico that is based on a gamified version of politics we call Fantasy Politics. At Millennials Speak Limited, we are catalysts for change, a passionate youth-centric team driven by the belief that the youth have the power to shape the future of our nation. We are committed to fostering a generation of informed, engaged, and empowered youth who are active participants in Kenya's civic growth and development.

The Company is a "DATA CONTROLLER" in relation to the processing activities described below. This means that we determine the purpose and means of Processing your personal data (or personal data you provide). The Company is registered as a "DATA CONTROLLER" with the Office of the Data Protection Commissioner. To contact us, you can visit our offices in Karen, connect with us through any of our social media platforms, or contact us via: Email; ngatia@millennialsspeak.co.ke or Mobile: +254718707539.

3. WHAT IS THE PURPOSE OF THIS PRIVACY POLICY?

To perform our functions, we need to collect certain types of personal information from various people including users of our app, Badilico, website visitors or any other relevant individuals (referred to as "you" or "your" in this Privacy Policy).

Therefore, this Privacy Policy:

1. sets out the types of personal data that we collect about you;
2. explains how and why we collect and use your personal data;
3. explains how long we keep your personal data;
4. explains when, why, and with whom we will share your personal data;
5. sets out the legal basis we have for processing your personal data;
6. explains the effect of refusing to provide the personal data collected;
7. explains the different rights and choices you have when it comes to your personal data; and
8. explains how we may contact you and how you can contact us about your personal data or any other related subject.

4. WHO DOES THIS PRIVACY POLICY APPLY TO?

This Privacy Policy applies to the personal data of:

• Users of Badilico App; and
• Website visitors.

To be clear, our employees' or third-party vendors/collaborators' personal details are handled in line with the terms of the employment agreement or contractual relationships, or our separate policies that we provide, as relevant, independent of this Privacy Notice. Further, it is important to point out that we may amend this Privacy Notice from time to time. Please visit our website to stay updated.

5. TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU

Personal data refers to any information about you that enables you to be identified as an individual such as your name, contact details, and identification numbers but it also covers less obvious information such as electronic location data, and other online identifiers.

We collect Personal Data directly from you as well as from other available sources to the extent permitted by law. We endeavour to only collect Personal Data that is necessary for the purpose(s) for which it is collected and to retain such data for no longer than necessary for such purpose(s). Subject to applicable law and practice, the categories of Personal Data that we process are: -

This list is not exhaustive but indicative of the information recorded. We do not collect any sensitive personal data about you.

6. HOW AND FOR WHAT PURPOSE DO WE COLLECT YOUR PERSONAL DATA?

a. App Users: - we collect personal data directly from you when you login/ register to use our app Badilico. We may also collect data indirectly such as cookies and other online identifiers.

b. Website Visitors – we collect data directly from you when you visit our website, and input contact information on the website. We may also collect data indirectly such as cookies and other online identifiers.

Where we collect indirectly from you, we will endeavour to inform you within fourteen (14) days of such collection.

We use your personal information in the following ways: -

7. OUR LAWFUL BASIS FOR PROCESSING YOUR PERSON DATA

The Company processes your personal data on the following lawful basis;

1. Consent; where you consent to processing for one or more specified purposes. When we rely on consent, we do so to the extent that it is permissible in law, and when processing is based on consent, you have the right to withdraw the consent at any time;
2. Performance of a contract; where the processing is necessary for the performance of a contract to which you are a party or to take certain steps at your request before entering a contract;
3. Compliance with a legal obligation; where processing is necessary for compliance with any legal obligation to which the Company is subject;
4. Vital Interest; where the processing is necessary to protect your vital interests or another person/individual;
5. Public Interest; where the processing is necessary to enable us to perform a task carried on in public interest;
6. Legitimate Interest; where processing is necessary in meeting the legitimate interests pursued by the Company or by a third party to whom the data is disclosed, except if the processing is unwarranted having regard to the harm and prejudice to your rights and freedoms or legitimate interests; and
7. For purposes of historical, statistical, journalistic, literature, and art or scientific research.

8. SHARING & INTERNATIONAL DATA TRANSFER

All data sharing will be undertaken in line with the Data Protection Legislation and any other relevant law. Where appropriate, we may share your personal data in various ways and for various reasons with:

1. Third-party service providers who perform functions on our behalf including IT systems providers.

Where we share your data, we ensure that there are appropriate data processing or data sharing agreements (or similar protections) in place.

We DO NOT transfer your data outside Kenya. However, should need arise, we will only transfer your personal data outside Kenya where such transfer is compliant with the provisions of the Data Protection Legislation.

9. HOW DO WE SAFEGUARD YOUR PERSONAL DATA?

The Company has taken appropriate technical, administrative, and procedural security measures to protect the personal data from misuse, unauthorized access or disclosure, loss, alteration, or destruction. These measures include:

a) Technological safeguards such as; use of anti-virus and firewall, passwords, secure API authentication, email authentication protocols (SPF, DKM, DMARC) intrusion detection systems (IDS), data encryption, role based access control (RBAC) mechanisms, AI-based phishing detection, zero trust architecture, regular cloud security audits, AI-based email filtering, browser security extensions, CAPTCHA verification, ransomware detection software, network segmentation, automated threat detection, data access logs, anomaly detection, and mobile app sandboxing; and

b) Organizational safeguards such as; training and awareness programs on security and privacy, to ensure employees understand the importance and means by which they must protect personal data, as well as through data protection and security policies and Notice standards that govern how the Company treats personal data.

10. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?

We will only keep your personal data for as long is necessary to achieve the purposes for which it was required unless the retention is required or authorized by law, reasonably necessary for a lawful purpose, you have consented to longer retention periods or if the personal data is required for statistical, journalistic, literature and art or research purposes. We maintain an up-to-date retention schedule. Where the information is past the retention period, we use secure methods to dispose/delete the personal data.

11. WHAT HAPPENS IF YOU DO NOT PROVIDE US WITH THE PERSONAL DATA WE REQUEST OR ASK THAT WE STOP PROCESSING YOUR PERSONAL DATA?

Our ability to perform our obligations derived from your business relationship with us and our ability to comply with our legal and contractual obligations sometimes depends on Us accessing and being able to use certain personal data. Therefore, and depending on the circumstances, if you do not provide Us with the personal data we request or if you ask that we stop processing your personal data, we may not be able to perform our contractual obligations, we may be in breach of one or more legal obligations applicable to Us. In some cases, if we are not allowed to process your personal data, this may result in Us being required to terminate our business relationship with you.

12. WHAT RIGHTS DO YOU HAVE OVER YOUR DATA?

The Data Protection Act accords you with several rights over your personal data.

1. The right to data portability: you have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format and to transmit the data to another data controller without hindrance. You also have the right, where technically possible, to have personal data transmitted directly from us to another data controller or data processor;
2. The right to be informed about our collection and use of your personal data - this Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
3. The right to access the personal data we hold about you.
4. The right to have your personal data corrected if any of your personal data held by us is false, erroneous, or misleading.
5. The right to ask us to delete or otherwise dispose of any of your personal data that we hold.
6. The right to restrict (i.e. prevent) the processing of your personal data;
7. The right to object to us to our use of your personal data for a particular purpose or purposes;
8. The right to withdraw consent - meaning if we are relying on your consent as the lawful basis for using your personal data, you are free to withdraw that consent at any time;
9. Rights relating to automated decision-making and profiling - we do not use your personal data for automated decision-making or profiling.

You can raise a complaint about our processing with the Regulator i.e., the Office of the Data Protection Commissioner (ODPC) in Kenya. You may also contact us via our provided contacts above for any concern that you may have about the processing of your personal data.

13. HOW TO EXERCISE YOUR RIGHTS

If you wish to exercise any of the rights outlined above, please write an email to the Data Protection Officer (DPO) on kiiruadvocates@gmail.com.

1. We will endeavor to answer all questions via email within the timelines stipulated in law.
2. If the provision of the data involves the data of third parties, these third parties can be asked in advance whether they have objections to the provisions.
3. We may ask for identification, because we need to know for certain whether we are issuing the data to the right person.
4. In some cases, we will not be able to comply with your request. If this happens, you will be duly notified.

14. HOW DO WE USE THE COOKIES?

We use them to track your activity on our website/app to help ensure you get the smoothest possible experience when visiting our website/app. We can use the information from cookies to ensure we present you with options tailored to your preferences on your next visit. We can also use cookies to analyze traffic and for advertising purposes.

If you want to check or change what types of cookies you accept, this can usually be altered within your browser settings. When you first visit our website(s) you will be asked to choose what kind of cookies you want to receive. We ask for your prior consent for some cookies through our Cookies Preference Center while strictly necessary cookies will be set within our legitimate interests. You may also set your cookie preferences on your browser's privacy settings. However, rejecting all cookies through your browser's privacy settings means that you may not be able to take full advantage of all our app/website's features. Each browser is different, so check the "Help" menu of your browser to learn how to change your cookie preferences.

You can update your given consent at any time by visiting our Cookie Preference Center which can be found by clicking on the "Cookie Preferences" link either on the top or bottom of our website. Instead of using our Cookie Preference Center you may choose to opt-out to cookies which are not strictly necessary to perform basic features of our site by changing your browser settings. If you use our Cookie Preference Center to update your choice of cookies, please note that this does not result in deletion of already placed cookies on your device. So, if you want to delete such cookies you may delete them in your browser's privacy settings.

15. HOW DO YOU CONTACT US?

If you suspect any misuse or loss of or unauthorized access to your personal data, please let us know immediately by sending us email; ngatia@millennialsspeak.co.ke or Mobile: +254718707539. Alternatively, or similarly, you can contact our Data Protection Officer (DPO) on; kiiruadvocates@gmail.com.