Draft for legal review — not yet approved by counsel. Version 0.1-draft · 2026-10-23. Text in [square brackets] is a placeholder the owner must fill in.
Who is responsible for your data
The data controller is VenueScout, a joint venture of Crowlective Studio Limited and Conferencing In A Box, Nairobi. Registration number: [Company registration number — to be confirmed]. Address: Le'Mac, Church Road (off Waiyaki Way), Westlands, Nairobi, Kenya. Data Protection Officer: [DPO name and contact — to be confirmed]. ODPC registration number: [ODPC registration number — to be confirmed].
What we collect and why
- Account data: name, e-mail, phone, organisation and role, to run your account and contact you about your requests.
- Bookings and requests: event details, quotes, messages and payment status, to carry out the booking you ask for.
- Payment references: M-Pesa and similar references. We do not store card numbers or M-Pesa PINs.
- Verification documents: business and ownership documents that venues and vendors upload, to verify listings.
- Reviews: the text and ratings you submit, shown publicly with your name and organisation.
- Technical data: IP address and security logs, to keep the service safe and limit abuse.
Our lawful bases are performing a contract with you, our legitimate interest in running and securing the marketplace, legal obligations, and your consent where we ask for it (for example optional marketing messages).
Who processes data for us
We use these kinds of processors. The provider named for each is the one we plan to use at launch and is to be confirmed.
- Hosting: [Hosting provider — to be confirmed]
- Database: [Database provider — to be confirmed]
- File storage: [Storage provider, e.g. Cloudflare R2 or AWS S3 — to be confirmed]
- E-mail: [E-mail provider, e.g. Resend or Postmark — to be confirmed]
- SMS and WhatsApp: [Africa's Talking and/or Meta WhatsApp Business — to be confirmed]
- Payments: [Safaricom M-Pesa, Airtel Money, card provider — to be confirmed]
Some of these are outside Kenya. Where data leaves Kenya we rely on the cross-border transfer safeguards the Data Protection Act requires. [Cross-border transfer grounds — for counsel]
How long we keep data
[Retention periods per category — to be confirmed. See the retention table in the compliance checklist.]
Your rights
You can ask to see, correct, export or delete your data, object to processing, or withdraw consent. See how to make a data request. You can complain to the Office of the Data Protection Commissioner (ODPC).
Security and breaches
We limit access, hash passwords and log administrative actions. If a breach puts your rights at risk we will notify the ODPC within 72 hours and tell you without undue delay.
Cookies
See the cookie notice.