Privacy Policy

1. Data controller

DataFly is the data controller for VotePulse platform data. Registered office: Nairobi, Kenya. Contact: privacy@votepulse.co.ke.

2. Data we collect

• Campaign contact data: phone number (E.164 format), name, ward/constituency/county, language preference, supporter score, and opt-in status.
• Account data: name, email, organisation, billing details for campaign managers.
• Agent data: agent ID, PIN (stored hashed), assigned polling station, device metadata.
• Usage data: message delivery logs, campaign analytics, audit logs for admin actions.
• Demo requests: name, phone, campaign type, and challenge description submitted via our website form.

3. Lawful basis

We process voter contact data on the basis of consent. Contacts must opt in via VOTE, JOIN, or equivalent keywords before receiving marketing messages. Campaign managers process data under contract with DataFly.

4. How we use data

• Deliver SMS, WhatsApp, voice, and social campaign messages on behalf of tenants.
• Coordinate polling agents and ingest Form 34A tally reports.
• Generate AI-assisted message drafts with compliance notes.
• Process M-Pesa donations where the donation module is enabled.
• Provide analytics, billing, and platform support.

5. Data minimisation

We do not collect national ID numbers, biometric data, or other special-category data unless explicitly required by law and agreed with the tenant. We collect only what is necessary for campaign communication and election-day coordination.

6. Retention

Contact records are retained for the duration of the tenant subscription plus 90 days, unless deletion is requested earlier. Audit logs are retained for 24 months. Demo request data is retained for 12 months.

7. Your rights

• Right of access — request a copy of your personal data.
• Right to rectification — correct inaccurate data.
• Right to erasure — opt out via STOP or ONDOKA keywords; request deletion from your campaign or from us at privacy@votepulse.co.ke.
• Right to object — object to processing for direct marketing.
• Right to lodge a complaint with the ODPC.

8. International transfers

Primary infrastructure is hosted on Hetzner EU data centres. Where personal data is transferred outside Kenya, we rely on Standard Contractual Clauses and appropriate safeguards as required by the Data Protection Act.

9. Security

• TLS 1.2+ encryption in transit; encrypted storage at rest.
• Role-based access control and tenant isolation on all database queries.
• bcrypt password hashing; agent PINs hashed at rest.
• 72-hour data breach notification procedure to ODPC and affected tenants.

10. Changes

We may update this policy. Material changes will be posted on this page with an updated date. Continued use of VotePulse after changes constitutes acceptance.