Privacy Policy

1. Who We Are

Royal Icon Events Limited ("we", "us", "Platform") is a Kenyan company registered under the Companies Act, 2015. We operate the website www.royaliconevents.co.ke and associated mobile applications. We are the data controller for personal information collected through the Platform.

We comply with the Kenya Data Protection Act, 2019 (DPA) and are registered with the Office of the Data Protection Commissioner (ODPC). Our ODPC Registration Number is available upon request.

2. Information We Collect

Account Information: Name, email address, phone number, password (hashed), and role (user, organizer, admin).

KYC Documents: National ID / passport / driving license number, full name as shown on ID, M-Pesa number, selfie photo, and document images. These are collected for identity verification of organizers and contestants.

Payment Information: M-Pesa phone number, bank account number, bank name, and SWIFT code. Card details are processed by IntaSend and never stored on our servers.

Usage Data: IP address, browser type, device information, pages visited, time spent on pages, and referral source. Collected via analytics tools (Google Analytics, Ahrefs) only with your consent.

Communications: Messages sent through the Platform, support requests, and email correspondence.

3. Legal Basis for Processing

We process your data under the following legal bases:

• Contract performance — to provide the Platform services you signed up for (ticketing, voting, event management).
• Legal obligation — to comply with KRA tax reporting, anti-money laundering requirements, and court orders.
• Legitimate interest — to prevent fraud, secure the Platform, and improve our services.
• Consent — for analytics cookies, marketing emails, and non-essential data collection. You may withdraw consent at any time.

4. How We Use Your Information

• Process ticket purchases and M-Pesa payments via IntaSend.
• Process voting transactions and distribute competition prizes.
• Verify organizer identity (KYC) and prevent fraud.
• Send transactional emails (tickets, receipts, account verification) via Brevo.
• Send marketing communications (only with your consent).
• Display organizer profiles and event information publicly.
• Comply with legal and regulatory obligations.
• Analyze Platform usage to improve our services.

5. Third-Party Processors

We share data with the following processors solely for the purposes described:

• IntaSend (payment processing) — M-Pesa STK Push and card payments. Based in Kenya. Privacy Policy.
• Brevo (email delivery) — Transactional and marketing emails. Based in France (EU). GDPR-compliant.
• Cloudflare (CDN & file storage) — KYC document storage, website CDN. Based in the US (EU-approved jurisdiction).
• Turso (database hosting) — Encrypted database. Based in the US.
• Firebase / Google (hosting & analytics) — App hosting and optional analytics. Based in the US.
• Google OAuth — Social login. Based in the US.
• Apple Sign In — Social login. Based in the US.

All third-party processors are bound by Data Processing Agreements (DPAs) and are required to protect your data to standards no less than our own.

6. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• KYC documents: Retained for 7 years as required by Kenyan anti-money laundering regulations.
• Payment records: Retained for 7 years for KRA tax compliance.
• Usage/analytics data: Anonymized after 26 months.
• Marketing consent records: Retained for the duration of consent plus 2 years for proof of consent.

7. Your Rights (DPA 2019)

Under the Kenya Data Protection Act, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal retention requirements).
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — withdraw consent at any time (does not affect the lawfulness of processing before withdrawal).
• Lodge a complaint — file a complaint with the ODPC if you believe your rights have been violated.

To exercise any of these rights, email us at privacy@royaliconevents.co.ke or use the data export/delete tools in your account settings. We will respond within 30 days.

8. Data Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Sensitive fields (KYC documents, bank details, payment numbers) are encrypted at the application level using AES-256-GCM.
• Passwords are hashed with bcrypt (12 rounds) and are never stored in plaintext.
• Access to personal data is restricted to authorized personnel on a need-to-know basis.
• We conduct regular security audits and penetration testing.

9. International Data Transfers

Some of our third-party processors (Turso, Cloudflare, Google, Brevo) may transfer data outside Kenya. We ensure that such transfers are protected by appropriate safeguards including Standard Contractual Clauses (SCCs) and adequacy determinations where applicable. By using the Platform, you consent to such transfers where necessary for the services described.

10. Children's Privacy

The Platform is not intended for children under 18. We do not knowingly collect personal information from children. If we discover that a child under 18 has provided us with personal information, we will delete it immediately. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@royaliconevents.co.ke.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and a prominent notice on the Platform at least 30 days before they take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related inquiries or to exercise your data rights:
Email: privacy@royaliconevents.co.ke
Data Protection Officer: dpo@royaliconevents.co.ke
Phone: +254 102 737 672
Address: Nairobi, Kenya
ODPC Complaints: complaints@odpc.go.ke