Skip to main content

Privacy Policy

Last Updated: February 16, 2025

1. Overview & Regulatory Compliance

Ogotto Holdings Limited ("Ogotto," "we," "our," or "us") operates as a registered Data Controller under the Kenya Data Protection Act, 2019 (DPA 2019) and the regulations of the Office of the Data Protection Commissioner (ODPC) Kenya. We are committed to protecting user privacy, upholding data processing principles (lawfulness, fairness, purpose specification, data minimization, accuracy, storage limitation, and data security), and providing complete transparency regarding how personal data is handled across our products.

2. Centralized Authentication via UtambuliSSO & Data Collected

All Ogotto applications, including OgottoPay, ineship, and all future platforms developed under the Ogotto ecosystem, utilize UtambuliSSO (our open-source single sign-on identity engine licensed under GNU AGPLv3) to provide unified, secure account authentication.

When you create an account or sign in to any Ogotto platform, our SSO directory collects and securely processes:

  • Profile & Identity Data: Full legal names, unique account usernames/handles, and profile display names.
  • Contact Information: Verified email addresses and primary mobile phone numbers.
  • Security Credentials: Salted password hashes, multi-factor authentication (MFA) factors, Passkeys/WebAuthn credentials, and session security tokens.

Usernames chosen across our platforms are ecosystem identifiers. In line with our trademark and brand protection policies, if a registered brand or trademark owner legitimately claims a username in the future, Ogotto reserves the right to reassign or reallocate the handle to the rightful brand.

3. Know Your Customer (KYC) & Identity Verification

To comply with anti-money laundering (AML) regulations, financial security standards, and community safety guidelines in Kenya, Ogotto collects and verifies official identity credentials when users access financial services (such as Chama savings on OgottoPay) or verified social profile tiers (on ineship):

  • Government Identity Cards & Documents: Kenyan National Identity Card (ID) number and photo copies, Passport number, or Alien ID cards.
  • Tax & Financial Identifiers: Kenya Revenue Authority (KRA) PIN and registered M-PESA / bank account numbers.
  • Biometric & Liveness Data: Live selfie photos or video liveness checks to prevent impersonation and verify genuine identity.
  • Contact & Address Verification: Mobile phone number verification via SMS OTP, email confirmations, and physical location declarations.

4. Product-Specific Data Processing

A. UtambuliSSO (Identity & SSO Engine)

Processes basic profile metadata, login timestamps, device user-agents, IP addresses, security tokens, and multi-factor authentication (2FA) states to manage cross-platform access.

B. OgottoPay (Chama Savings & Payment Orchestration)

Processes group membership records, chama role designations, rotating savings contributions, transaction ledger entries, payout schedules, mobile money (M-PESA) transaction references, and disbursement account records required for chama financial coordination and auditability.

C. ineship (Dating & Travel Companion Social Platform)

Processes social profile information (display name, bio, photos, age declaration), match preferences, upcoming travel itineraries, destination interests, in-app chat communications, consented location data (for companion proximity matching), and trust & safety moderation reports.

5. Your Rights Under the Kenya Data Protection Act (2019)

Under Section 26 of the Kenya DPA 2019, you hold the following statutory rights regarding your personal data:

  • Right to be Informed: To receive clear information on how your data is collected and processed.
  • Right of Access: To request a copy of all personal data held by Ogotto about you.
  • Right to Rectification: To request correction of inaccurate, outdated, or incomplete data.
  • Right to Erasure ('Right to be Forgotten'): To request deletion of your personal data, subject to legal retention obligations under Kenyan financial laws.
  • Right to Object & Restrict Processing: To object to data processing for marketing or direct automated decision-making.
  • Right to Data Portability: To receive your data in a structured, commonly used machine-readable format.

6. Data Security & Retention

We implement industry-leading technical measures including AES-256 encryption at rest, TLS 1.3 encryption in transit, strict database access controls, and regular vulnerability scanning. Personal data is retained only as long as necessary to fulfill service purposes or as required by applicable laws in Kenya (e.g., financial audit retention mandates).

7. Data Protection Officer (DPO) & Complaints

If you have questions, wish to exercise your data rights, or want to raise a concern regarding our data practices, please contact our Data Protection Officer:

Data Protection Officer (DPO)
Ogotto Holdings Limited
Email: [email protected] / [email protected]

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya (Website: www.odpc.go.ke).