Privacy Policy

1. Who is responsible for your data

Twende Tribe is the data controller for personal data processed through the Service, except where a clearly identified third party acts as a separate controller. In this policy, "personal data" has the meaning given by the Kenya Data Protection Act, 2019.

You can contact our privacy team at privacy@twendetribe.africa. We process personal data in accordance with the Constitution of Kenya, the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and other applicable privacy laws.

2. Data we collect

We collect information you provide, information created when you use the Service, and limited information from providers that help deliver the Service.

• Account data: name, email address, phone number, password hash, verification status, profile photo, biography, and home town.
• Trip and group data: memberships, invitations, itineraries, budgets, contribution expectations, messages or notes, preferences, and content you upload.
• Transaction data: amount, currency, provider, reference, status, timestamps, and reconciliation information. We do not intentionally store your mobile-money PIN or full bank authentication credentials.
• Device and usage data: IP address, device and app identifiers, operating system, app version, language, crash data, security events, and interactions with features.
• Communications: support requests, survey responses, reports, and other messages you send us.
• Approximate location or precise location only when a feature requires it and you grant the relevant device permission. We do not collect precise location in the background unless clearly disclosed and permitted.

3. Why we use personal data

We use personal data only for specified, explicit, and legitimate purposes, and we limit processing to what is necessary.

• Provide the contract: create and secure accounts, run groups and trips, display records, support payments, send essential notifications, and respond to requests.
• Legitimate interests: prevent fraud, protect users, diagnose faults, improve accessibility and performance, understand feature use, and defend legal claims, after balancing those interests against your rights.
• Legal obligations: maintain required records, respond to lawful requests, protect rights, and comply with tax, consumer, financial-crime, sanctions, and data-protection requirements where applicable.
• Consent: send optional marketing, access device permissions, or process data where consent is the appropriate legal basis. You may withdraw consent at any time without affecting earlier lawful processing.
• Vital interests or public interest: respond to a serious safety emergency or another situation recognised by applicable law.

4. Contributions and payment information

When you initiate or record a contribution, we may exchange identifiers, amount, phone number, reference, and status with the relevant organiser, bank, mobile-money operator, or payment provider. Those providers may process data under their own privacy policies.

We use payment data to initiate requested transactions, show status, reconcile records, prevent fraud, handle support, and meet legal obligations. Twende Tribe does not ask for or store your payment PIN or bank authentication credentials.

5. When we share data

We do not sell personal data. We share only what is reasonably necessary with:

• group organisers and members, according to your role, the trip’s visibility, and the information needed to coordinate the trip;
• cloud hosting, communications, analytics, security, customer-support, identity-verification, and payment providers acting under contract or as separately identified controllers;
• professional advisers, auditors, insurers, and transaction counterparties subject to confidentiality duties;
• courts, regulators, law-enforcement bodies, or other persons where disclosure is legally required or necessary to protect rights and safety; and
• a successor in a merger, financing, reorganisation, or sale, subject to appropriate confidentiality and notice requirements.

6. Group visibility and other users

Information you share in a group may be visible to its organiser and members. Public trips or profiles may be visible more broadly where you choose a public setting. Review the audience before posting personal or sensitive information.

Other users may independently save or share information they can view. Their handling of that data may fall outside our control, but they must still comply with these Terms and applicable law.

7. International transfers

Our providers may process data outside Kenya. Before transferring personal data internationally, we use a lawful transfer mechanism and appropriate safeguards, such as an adequacy decision, contractual protections, consent where valid, or another mechanism permitted by the Data Protection Act and applicable foreign law.

Where the EU or UK GDPR applies, safeguards may include approved Standard Contractual Clauses and a transfer-risk assessment. You may request information about relevant safeguards by emailing privacy@twendetribe.africa.

8. How long we keep data

We retain personal data only as long as necessary for the purposes described in this policy, including service delivery, security, disputes, and legal obligations. Retention varies by data type.

• Account and profile data: while your account is active and for a limited period after deletion where needed for recovery, safety, or legal claims.
• Trip and group records: for the life of the group or trip and a reasonable archive period so members can access records.
• Transaction and compliance records: for the period required by tax, accounting, anti-fraud, payment, or other applicable laws, which may extend for several years.
• Security logs and backups: for short, risk-based periods, after which they are deleted or de-identified through scheduled processes.

9. Security

We use administrative, technical, and organisational measures designed to protect personal data, including access controls, authentication, encrypted transport, secure storage practices, monitoring, provider reviews, and incident-response procedures.

No system is completely secure. Protect your password and verification codes, keep your device updated, and report suspected compromise to support@twendetribe.africa. If a personal-data breach is likely to create a real risk of harm, we will notify the Office of the Data Protection Commissioner and affected people as required by law.

10. Your rights in Kenya

Subject to lawful limits and verification of your identity, Kenyan data-protection law gives you rights to:

• be informed about how your personal data is used;
• access personal data we hold about you;
• object to processing, including certain direct marketing;
• correct false or misleading data;
• request deletion of false or misleading data and, where applicable, other data no longer lawfully needed;
• request restriction, data portability, or review of a decision based solely on automated processing where those rights apply; and
• withdraw consent where processing relies on consent.

11. Rights in other regions

Depending on where you live, you may have additional rights. Residents covered by the EU or UK GDPR may have rights to erasure, restriction, portability, objection, and complaint to their local supervisory authority. Residents of certain US states may have rights to know, correct, delete, or obtain a copy of personal information, and to opt out of sale, sharing, or targeted advertising.

We do not discriminate against you for exercising a privacy right. Twende Tribe does not sell personal data and does not knowingly share it for cross-context behavioural advertising. Rights vary by jurisdiction and may be subject to exemptions.

12. Exercising your rights

Send a request to privacy@twendetribe.africa from the email associated with your account and describe the right you wish to exercise. We may ask for proportionate information to verify your identity and authority.

We will respond within the period required by applicable law. In Kenya, you may complain to the Office of the Data Protection Commissioner at odpc.go.ke if you believe your data-protection rights have been infringed. We encourage you to contact us first so we can try to resolve the concern.

13. Children

The Service is intended for adults aged 18 and over. We do not knowingly create accounts for children or intentionally collect their personal data. If you believe a child has provided personal data, contact privacy@twendetribe.africa so we can investigate and take appropriate action.

14. Automated decisions and marketing

We may use automated signals to detect spam, fraud, account compromise, or prohibited activity. We do not currently make decisions producing legal or similarly significant effects solely by automated means without safeguards required by law.

Service messages needed for your account are not marketing. Where we send optional marketing, you can unsubscribe through the message or account settings. We will honour applicable consent and opt-out rules.

15. Updates and contact

We may update this policy as our Service or legal obligations change. We will publish the new version and revise the date above. We will provide prominent notice, and request consent where required, before a material change takes effect.

For privacy questions, rights requests, or complaints, email privacy@twendetribe.africa. For general account support, email support@twendetribe.africa.