Privacy Policy
Last updated: 9 October 2026 (version 2.0)
This Privacy Notice explains how Browncord Kenya collects, uses, shares and protects your personal data, as required by the Data Protection Act, 2019 of Kenya (the "Act") and the Data Protection (General) Regulations, 2021. It applies to everyone who visits the platform, creates an account, books or sells services, or contacts us. Browncord Kenya is intended for adults aged 18 and over.
1 Who is the data controller
The data controller is the operator of the Browncord Kenya platform. You can reach us through the details in the Contact section below.
Vendors and venue partners who receive your booking details from us handle that information for their own service delivery and are responsible for their own use of it.
2 What we collect, why, and our lawful basis
We collect personal data you give us, data created when you use the platform, and limited data from our service providers. The table sets out each purpose and the lawful basis we rely on under the Act.
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, phone, password (hashed), date of birth, gender, profile details, country and location | Create and secure your account, verify you, provide the marketplace | Performance of a contract |
| Bookings, quotes, messages, reviews, event details, vendor listings and media you upload | Connect customers and vendors, deliver bookings, resolve disputes | Performance of a contract; legitimate interests |
| Payment and payout details (transaction references, mobile-money or bank account details for payouts). We do not store full card numbers. | Take payments, pay vendors, prevent fraud, keep financial records | Performance of a contract; legal obligation |
| IP address, device and browser data, login and security events, pages viewed | Keep accounts secure, detect abuse, troubleshoot, understand platform use | Legitimate interests (security and service improvement) |
| Street addresses entered for venues, rentals or events | Show locations and search nearby, using a map and geocoding service | Performance of a contract; legitimate interests |
| Contact details, support requests, and text you submit to AI-assisted search or assistance features | Answer enquiries and provide those features | Legitimate interests; performance of a contract |
| Email address, phone or WhatsApp number and your notification preferences | Service messages about your account, bookings and payments (including by email and WhatsApp) | Performance of a contract; for WhatsApp, your opt-in |
| Email address and phone number | Marketing and promotional messages, newsletters | Your consent, given separately from accepting the Terms. You can withdraw it at any time using the unsubscribe link or your notification settings. |
| Cookie and analytics identifiers | Measure how the site is used | Your consent (see Cookies below) |
| Records we must keep (tax, accounting, anti-fraud, responses to lawful requests) | Comply with Kenyan law and handle legal claims | Legal obligation |
We do not sell your personal data. We do not intend to collect sensitive personal data; please do not include it in free-text fields or messages.
3 Who we share data with
We share personal data only as needed, with:
- Vendors, venues and partners you book or message, so they can deliver the service.
- Service providers (processors) that host or run parts of the platform on our instructions, listed in the next section.
- Authorities, courts and professional advisers where the law requires or to establish or defend legal claims.
- A successor business if the platform is merged, acquired or sold, with this notice continuing to apply to your data.
4 Cross-border transfers
Some of our service providers process data outside Kenya. Under sections 48 and 49 of the Act, we transfer personal data abroad only where appropriate safeguards are in place (for example a written data processing agreement with contractual protections), where you have consented, or where the transfer is necessary to perform a contract with you.
| Provider | What it does for us | Data involved |
|---|---|---|
| Amazon Web Services (S3) | File and image storage | Files and media you upload |
| Laravel Nightwatch | Application monitoring and error diagnostics | Technical and request data, which may include identifiers and IP addresses |
| Google (Gemini AI, geocoding) | AI features; converting addresses to map locations | Text you submit to AI features; street addresses |
| OpenAI | AI features | Text you submit to AI features |
| Meta (WhatsApp Business Platform) | WhatsApp notifications and conversations | Phone number and message content |
| Paystack, Flutterwave, Stripe | Payment processing and payouts | Name, contact details, transaction and payout details |
| Email delivery provider | Sending transactional and marketing emails | Email address, message content, delivery and open status |
| Google Analytics (only if you accept analytics cookies) | Site usage statistics | Cookie identifiers, pages viewed, device data |
These providers may process data in countries such as the United States and members of the European Economic Area. Which providers are active depends on the features and country you use. Contact us for details of the safeguards for a specific transfer.
5 How long we keep data
We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it. Records we must keep by law (for example financial records) are kept for the legally required period.
- Page views: 180 days
- Memorial qr downloads: 180 days
- Rental scans: 1 year(s)
- User login attempts: 90 days
- Sessions: 7 days
- Activity log: 2 year(s)
- Whatsapp conversations: 90 days
- Whatsapp sent messages: 90 days
When you delete your account, we remove or anonymise your personal data, except what we must keep by law or to handle disputes.
6 Your rights and how to use them
Under section 26 of the Act you have the right to:
- be informed about how your data is used (this notice);
- access your personal data;
- object to the processing of all or part of your data, including for direct marketing;
- correct false or misleading data;
- request deletion of false or misleading data about you, and erasure where we no longer have a lawful reason to keep it; and
- receive your data in a structured, commonly used format (data portability) where applicable.
You can also withdraw any consent you gave at any time; this does not affect processing done before withdrawal.
How to exercise them:
- Download your data: use Download my data in your account settings.
- Delete your account: use the account deletion option in your account settings, or contact us.
- Correct your details: edit your profile in your account settings.
- Marketing: use the unsubscribe link in any marketing email or change your notification preferences.
- Anything else: email info@browncord.co.ke or use the contact form. We may need to verify your identity first. We aim to respond within 30 days and will tell you if we cannot act on a request and why.
7 Complaints to the ODPC
If you think we have not handled your personal data properly, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.
9 Data security
We use technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, optional two-factor authentication and access controls. No system is completely secure, and you are responsible for keeping your credentials confidential. If a breach is likely to put your rights at risk, we will notify the Data Commissioner and affected people as the Act requires.
10 Children
Browncord Kenya is for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, contact us and we will delete it.
11 Third-party links
The platform may link to third-party websites. This notice does not apply to them, so please review their privacy notices before sharing personal data.
12 Changes to this notice
We may update this notice. The date and version at the top show the latest revision. For material changes we will notify you on the platform or by email.
13 Contact us
For questions about this notice or to exercise your rights: