Privacy Policy
Effective Date: September 10, 2026
Data Controller: Odivora
Registered Location: Mombasa, Kenya
Company Email: support@odivora.com
Contact Persons (Data Protection Enquiries):
• Solomon Omondi — Email: omosh2195@gmail.com — Phone: +254 706 237 832
Applicable Data Protection Laws: This policy explains how Odivora processes personal data in accordance with applicable Kenyan data protection law and, where applicable, other data protection laws that may apply to our processing activities.
Odivora ("we", "us", "our") values your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what personal data we collect, why we collect it, the legal bases we rely on, how long we keep it, and the rights you have over it when you use our website, services, and applications (the "Services"). By using the Services you acknowledge this policy. Where we rely on consent for a specific processing activity, we will ask for it separately and clearly.
1. Information We Collect
a. Information You Provide to Us
- Account data: name, username, email address, and a securely hashed password.
- Profile data you choose to add: bio, profile picture, location, website, and social links.
- Communication data: messages, subject lines, and contact details submitted through our forms (e.g. contact and support requests).
- Transaction data: payment and subscription records needed to provide paid products. Card details are handled directly by our payment processors and are never stored by us.
- Affiliate data: data you submit when joining or using the affiliate programme.
- User Content: Depending on the Service you use, you may submit files, documents, images, text, data, or other content for processing. We process such content as necessary to provide the requested Service, maintain security, prevent misuse, resolve technical issues, and comply with applicable legal obligations.
b. Information Collected Automatically
- Technical data: browser type and version, device type, operating system, language preferences, and your IP address and the general region you connect from — so we can keep the platform secure and improve it.
- Usage data: which pages you visit, how you use our services, and dates/times of visits — so we can understand what works and make the experience better.
- API and Service Usage Data: Where you use Odivora APIs or other technical services, we may collect API identifiers, request metadata, usage volumes, timestamps, authentication and security information, rate-limit information, and related logs for authentication, service delivery, abuse prevention, security, troubleshooting, billing where applicable, and service improvement.
- Cookie and similar technologies data — see our Cookie Policy for the full inventory.
2. How We Use Your Information and the Legal Bases We Rely On
In line with Article 6(1) of the GDPR, we only process personal data where we have a lawful basis to do so. The table below sets out our purposes and the corresponding basis:
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and manage your account, provide access to our services | Account data | Performance of a contract (Art. 6(1)(b)) |
| Process payments, subscriptions, and purchases | Transaction data | Performance of a contract (Art. 6(1)(b)) |
| Deliver the email verification, password reset and essential security notices you asked us for | Account data, contact details | Performance of a contract / legal obligation (Art. 6(1)(b), (c)) |
| Send marketing and product-update emails (only if you consented) | Contact details, communication preferences | Consent (Art. 6(1)(a)) |
| Improve our website and services through analytics and usage statistics (only if you consented) | Technical data, usage data, analytics cookies | Consent (Art. 6(1)(a)) |
| Prevent fraud and abuse, ensure security of our platform | Technical data, account data | Legitimate interest (Art. 6(1)(f)) |
| Operate the affiliate programme, including attribution of referrals and commissions | Affiliate data, session/tracking identifiers | Contract / legitimate interest (Art. 6(1)(b), (f)) |
| Comply with legal and accounting obligations | Transaction data, account data | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you may withdraw it at any time with effect for the future — for example by changing your cookie settings, updating your email preferences in Account Settings, or contacting us at the address below. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
3. Cookies and Similar Technologies
We use strictly necessary cookies to operate the Services (session security, login persistence, and CSRF protection). All other cookies — such as those used for analytics — are only set or used after you give your consent through the cookie consent banner. You can change your preferences at any time using the "Cookie Settings" link in our footer.
For a complete list of the cookies we use, their purpose, type, and duration, please see our Cookie Policy.
4. How We Share Your Information
We do not sell or rent your personal data to third parties. We share data only with the following categories of recipients, and only for the purposes described in this policy:
- Service providers and processors: providers that host or operate our platform, process payments (e.g. PayPal, M-Pesa), send emails on our behalf, and provide analytics (e.g. Google Analytics — only with your consent). These parties process data on our instructions.
- Professional advisers and authorities: where necessary to comply with legal obligations, enforce our terms, or protect rights and safety (Art. 6(1)(c), (f)).
- Business transferees: in connection with a merger, acquisition, or sale of assets.
5. International Data Transfers
Our services are operated from Kenya and your data may be processed by us and by our service providers in countries outside the European Economic Area (EEA) and the UK. Where we transfer personal data to recipients outside the EEA/UK, we take appropriate safeguards, including the European Commission's Standard Contractual Clauses where required, so that your data enjoys an equivalent level of protection. Where Kenyan law applies, we also use appropriate safeguards and lawful transfer mechanisms required by the Kenya Data Protection Act, 2019 and applicable regulations. These may include contractual protections, security measures, consent where legally required, or another lawful mechanism appropriate to the transfer. You may request information about the relevant safeguards by contacting us.
6. Data Retention
We retain personal data only for as long as necessary for the purposes set out above:
- Account data: for the lifetime of your account, and up to 30 days after you delete it.
- Transaction and billing records: as required by tax and accounting law (typically 5–10 years).
- Communication data: up to 24 months after the last contact.
- Behavioural/usage logs: generally 180 days, after which they are removed or anonymised.
- Uploaded and processed content: retained only for as long as reasonably necessary to provide the requested Service, maintain security, resolve disputes, or meet legal obligations, after which it may be deleted or anonymised where appropriate.
- Consent records: for as long as the processing based on that consent continues, plus a reasonable evidence period.
7. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), secure password hashing, signed and secure session cookies, and access controls. While no online service can be guaranteed risk-free, we use industry-standard safeguards to protect your data. If you believe your data has been compromised, please contact us immediately.
8. Your Rights
If you are located in the EEA, the UK, or other jurisdictions that grant the following rights, you have the right to:
- See what we hold: get a copy of the personal data we have about you.
- Correct your information: fix anything inaccurate — you can update most of it yourself in Account Settings.
- Delete your information: ask us to remove your personal data. You can delete your account yourself from your Profile page, or ask us to do it.
- Limit how we use it: ask us to restrict processing in certain situations.
- Take it with you: receive your data in a portable, machine-readable format, or have it transferred to another service.
- Object to certain uses: object to processing based on legitimate interests, including analytics and marketing.
- Opt out of automatic decisions: we do not make decisions with legal effects based solely on automated processing.
- Withdraw consent: change your mind about any consent you gave, at any time.
To exercise any of these rights, contact us at the details below. We will respond to requests within the period required by applicable law. If you are in the EEA/UK and are not satisfied with our response, you may lodge a complaint with your local data protection authority.
9. Consent and How to Withdraw It
- Analytics and cookies: change your preferences at any time using the "Cookie Settings" link in our footer or via our Cookie Policy.
- Marketing emails: use the unsubscribe link in any marketing email, or update your notification preferences in Account Settings.
- All consent-based processing: email us at the address below.
10. Children's Privacy
Our Services are primarily intended for adults and general users of technology services. We do not knowingly collect personal data from children without a lawful basis and the safeguards required by applicable law. Where we process a child's data, we consider the child's best interests and obtain parental or guardian involvement or consent where required. If you believe a child has provided us with personal data without the required lawful basis or consent, please contact us so we can verify the circumstances and take reasonable steps to delete it where required. We do not knowingly use children's personal data for targeted advertising or profiling.
11. Kenya Data Protection and Your Rights
Where Odivora processes personal data in Kenya, we comply with the applicable requirements of the Kenya Data Protection Act, 2019, and applicable regulations and guidance issued by the Office of the Data Protection Commissioner (ODPC).
Under applicable Kenyan law, data subjects may have the right to:
- be informed about the use of their personal data;
- access personal data held about them;
- object to the processing of their personal data;
- request correction of false or misleading personal data; and
- request deletion of false or misleading personal data, subject to applicable legal exceptions.
Some requests may be subject to verification, legal requirements, or other lawful limitations. To exercise an applicable right, contact us at support@odivora.com.
12. Data Protection Complaints
If you believe that your personal data has been handled unlawfully or that your data protection rights have not been adequately addressed by Odivora, please contact us first at support@odivora.com. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, through its applicable complaints process.
13. Personal Data Breaches
Odivora maintains reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. If a personal data breach occurs, we will assess it and take appropriate steps to contain, investigate, and mitigate its effects.
Where Kenyan law requires notification, Odivora will notify the ODPC within the applicable statutory period and communicate with affected data subjects where required by law. Where Odivora uses a data processor and that processor becomes aware of a breach, the processor is expected to notify Odivora without undue delay in accordance with applicable law and contractual requirements. Information about the ODPC breach-reporting process is available at ODPC breach reporting.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date, and where required we will notify you (e.g. by email for accounts). We encourage you to review this policy periodically.
15. Data Protection Contact
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a data-protection concern, please contact:
Odivora (Data Controller)
Mombasa, Kenya
Data Protection Contact:
• Solomon Omondi — Email: omosh2195@gmail.com — Phone: +254 706 237 832
Company Email: support@odivora.com