Skip to main content

Privacy Policy

Last Updated: February 16, 2025

1. Overview & Regulatory Compliance

Ogotto Holdings Limited ("Ogotto," "we," "our," or "us") operates as a registered Data Controller under the Kenya Data Protection Act, 2019 (DPA 2019) and the regulations of the Office of the Data Protection Commissioner (ODPC) Kenya. We are committed to protecting user privacy, upholding data processing principles (lawfulness, fairness, purpose specification, data minimization, accuracy, storage limitation, and data security), and providing complete transparency regarding how personal data is handled across our products.

2. Authentication via UtambuliSSO

All Ogotto applications utilize UtambuliSSO—our open-source single sign-on (SSO) identity engine licensed under GNU AGPLv3—to provide unified, secure account authentication. When you create an account or sign in to any Ogotto service, your primary identity credentials (email address, phone number, multi-factor authentication factors, and salted password hashes) are securely processed through UtambuliSSO.

3. Know Your Customer (KYC) & Identity Verification

To comply with anti-money laundering (AML) regulations, financial security standards, and community safety guidelines in Kenya, Ogotto collects and verifies user identity information when accessing financial services or verified profile tiers:

  • Government Identity Documents: Kenyan National Identity Card (ID) number, Passport number, or Alien ID card copies.
  • Tax & Financial Identifiers: Kenya Revenue Authority (KRA) PIN and registered M-PESA / bank account numbers.
  • Biometric & Liveness Data: Selfie photos or video liveness verification for identity validation.
  • Contact & Address Verification: Phone number verification via OTP, email confirmation, and physical location declarations.

4. Product-Specific Data Processing

A. UtambuliSSO (Identity & SSO Engine)

Processes basic profile metadata, login timestamps, device user-agents, IP addresses, security tokens, and multi-factor authentication (2FA) states to manage cross-platform access.

B. Tusonge Pamoja / Ogotto Pay (Chama Savings & Group Funds)

Processes group membership records, chama role designations, rotating savings contributions, transaction ledger entries, payout schedules, mobile money (M-PESA) transaction references, and disbursement account records required for chama financial coordination and auditability.

C. Rohotrek (Dating & Travel Companion Social Platform)

Processes social profile information (display name, bio, photos, age declaration), match preferences, upcoming travel itineraries, destination interests, in-app chat communications, consented location data (for companion proximity matching), and trust & safety moderation reports.

5. Your Rights Under the Kenya Data Protection Act (2019)

Under Section 26 of the Kenya DPA 2019, you hold the following statutory rights regarding your personal data:

  • Right to be Informed: To receive clear information on how your data is collected and processed.
  • Right of Access: To request a copy of all personal data held by Ogotto about you.
  • Right to Rectification: To request correction of inaccurate, outdated, or incomplete data.
  • Right to Erasure ('Right to be Forgotten'): To request deletion of your personal data, subject to legal retention obligations under Kenyan financial laws.
  • Right to Object & Restrict Processing: To object to data processing for marketing or direct automated decision-making.
  • Right to Data Portability: To receive your data in a structured, commonly used machine-readable format.

6. Data Security & Retention

We implement industry-leading technical measures including AES-256 encryption at rest, TLS 1.3 encryption in transit, strict database access controls, and regular vulnerability scanning. Personal data is retained only as long as necessary to fulfill service purposes or as required by applicable laws in Kenya (e.g., financial audit retention mandates).

7. Data Protection Officer (DPO) & Complaints

If you have questions, wish to exercise your data rights, or want to raise a concern regarding our data practices, please contact our Data Protection Officer:

Data Protection Officer (DPO)
Ogotto Holdings Limited
Email: [email protected] / [email protected]

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya (Website: www.odpc.go.ke).