Privacy Policy

We collect personal data that you voluntarily provide when using our website, products, or services. This may include:

• Identity & Contact Data: name, email address, phone number, company name, and job title.
• Account Data: username, password, and profile preferences for platforms like Jaza Kiti.
• Transaction Data: payment details, billing address, and purchase history when buying tickets or services.
• Technical Data: IP address, browser type, device information, and cookies (see our Cookie Policy).
• Usage Data: interactions with our AI agents Fundi Sensei and Kiti Sensei, including chat logs and query history.
• Marketing & Communication Data: your preferences in receiving promotional materials.

We process your personal data for the following lawful purposes:

• To provide and manage our services, including event ticketing via Jaza Kiti and AI-assisted interactions via Fundi Sensei and Kiti Sensei.
• To process payments and issue tickets or invoices.
• To communicate with you regarding your account, transactions, or customer support requests.
• To improve our products, train our AI models (using anonymised data), and conduct analytics.
• To send marketing communications where you have given consent or where permitted by law.
• To comply with legal and regulatory obligations.

Lawful Basis: Under the Kenya Data Protection Act 2019 and GDPR, we rely on consent, contract performance, legal obligation, and legitimate interests as lawful bases for processing.

We do not sell your personal data. We may share it with trusted third parties strictly where necessary:

• Service Providers: payment processors (e.g., M-Pesa integrations), cloud hosting providers, email delivery services, and analytics platforms.
• Event Organizers: when you purchase tickets via Jaza Kiti, your booking details are shared with the event organizer to facilitate entry.
• Legal Authorities: when required by law, court order, or to protect our rights and safety.
• Business Transfers: in the event of a merger, acquisition, or sale of assets.

All third-party processors are bound by data protection agreements that meet Kenya DPA and GDPR standards.

Volcha Enterprises is based in Kenya. Some of our service providers may process data outside Kenya or the EEA. When this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the EU Commission.
• Adequacy decisions where applicable.
• Compliance with the Kenya Data Protection (General) Regulations, 2021 regarding cross-border transfers.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include:

• SSL/TLS encryption for data in transit.
• Secure server infrastructure with regular security audits.
• Access controls and role-based permissions.
• Regular staff training on data protection.
• Incident response and breach notification procedures.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Account Data: retained while your account is active and for up to 2 years after closure for legal and audit purposes.
• Transaction Data: retained for 7 years in compliance with Kenyan tax and financial regulations.
• Chat & Usage Data: retained for up to 12 months, then anonymised for analytics.
• Marketing Data: retained until you withdraw consent or opt out.

Under the Kenya Data Protection Act 2019 and GDPR, you have the following rights:

• Right to Access: request copies of your personal data.
• Right to Rectification: request correction of inaccurate or incomplete data.
• Right to Erasure: request deletion of your data under certain conditions.
• Right to Restrict Processing: limit how we use your data.
• Right to Data Portability: receive your data in a structured, machine-readable format.
• Right to Object: object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details below. We will respond within 30 days.

We use cookies and similar technologies to enhance your browsing experience, analyse traffic, and personalise content. For detailed information, including how to manage your preferences, please see our Cookie Policy.

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya or, if you are in the EU, with your local Data Protection Authority.