1. Introduction, Explicit Consent, and Lawful Basis for Processing
Flow Africa ("we", "us", "our", "Data Controller") respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, use, and protect your information when you use our website and platform to book appointments. This policy complies strictly with the Kenya Data Protection Act, 2019 (DPA).
- Explicit Consent (Mandatory Checkbox): By actively checking the designated consent box during registration or checkout ("I have read and agree to the Privacy Policy and Terms & Conditions"), you provide explicit opt-in consent for Flow Africa to process your personal data.
- Performance of a Contract: Processing strictly necessary to facilitate your bookings and M-Pesa payments.
- Legal Obligation: Maintaining transaction records for compliance with the Kenya Revenue Authority (KRA).
2. Information We Collect (Data Minimization)
We follow the principle of data minimization and only collect information strictly necessary to facilitate your booking and process payments. We collect:
- Full Name
- Mobile Phone Number (MSISDN) used for M-Pesa
- Details of the requested service
- Date and time of the appointment
🛡️ Data Minimization: We do not collect or store sensitive personal data, such as medical records or financial histories.
3. How We Use Your Information
We use your data solely to:
- Confirm and manage your appointment.
- Facilitate the M-Pesa payment process.
- Send you SMS confirmations, reminders, and updates regarding your booking.
- Allow the service provider to prepare for your appointment.
4. Data Storage and Security
In strict adherence to Kenyan data localization laws, all personal data collected by Flow Africa is hosted, processed, and securely stored on servers located directly within the Republic of Kenya. We implement robust technical measures to prevent unauthorized access, alteration, or disclosure of your data.
5. Data Retention Policy (7-Year Standard)
In accordance with the Kenya Data Protection Act (2019) principle of storage limitation, and the Kenya Tax Procedures Act, Flow Africa applies the following retention periods:
- Financial and Transactional Data: Retained for a mandatory period of seven (7) years to comply with Kenya Revenue Authority (KRA) audit requirements.
- Account Data: Retained for as long as your account is active. Upon account deletion, personal identifiers are permanently destroyed within 30 days, unless legally required otherwise.
6. Mandatory Data Breach Notification
In the event of a data security breach that poses a real risk of harm to the fundamental rights and freedoms of data subjects, Flow Africa shall formally notify the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of becoming aware of the breach, strictly adhering to Section 43 of the DPA. Affected users will also be notified promptly.
🚨 72-Hour Notification: Flow Africa is committed to notifying the ODPC within 72 hours of any security breach, in compliance with Section 43 of the Kenya DPA.
7. Sharing of Information
- Service Providers: Your name, phone number, and appointment details are shared with the specific Provider you booked with, so they can deliver the service. They act as Data Processors and are bound by strict confidentiality.
- Third-Party Services: We share your phone number with our authorized SMS gateway providers solely for the purpose of sending transactional notifications.
- No Sale of Data: Flow Africa will never sell, rent, or trade your personal data to third parties.
🔒 No Sale of Data: Flow Africa will never sell, rent, or trade your personal data to third parties.
8. Direct Marketing and SMS
Service Providers may use your contact information to send you promotional SMS messages related to their services only if you have consented. You have the absolute right to opt-out of these promotional messages at any time by following the "STOP" instructions included in the SMS.
9. Your Data Protection Rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data (Right to be forgotten), subject to our 7-year KRA retention obligation for financial records.
- Object to the processing of your data for direct marketing.
10. Contact Our Data Protection Officer
If you wish to exercise any of your rights or have concerns about how your data is handled, please contact our Data Protection Officer at:
