PRIVACY POLICY

I

INTRODUCTION AND SCOPE

This Privacy Policy ("Policy") constitutes a binding agreement between AfriKrown ("AfriKrown," "we," "us," or "our") and any individual or entity ("User," "you," or "your") accessing or utilizing our website, digital platforms, services, or products — including our Voting, Ticketing, and Kitties services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. Your continued use of the Services following any modifications to this Policy shall constitute acceptance of such modifications.

II

DEFINITIONS AND INTERPRETATIONS

For purposes of this Policy, the following terms shall have the meanings ascribed herein:

"Personal Data" or "Personal Information" means any information relating to an identified or identifiable natural person, including but not limited to names, email addresses, phone numbers, IP addresses, device identifiers, payment details, and any other identifier that can be used to identify, contact, or locate a specific individual.

"Processing" encompasses any operation performed on Personal Data, whether automated or manual, including collection, recording, organization, storage, retrieval, use, disclosure, or destruction.

"Data Controller" means AfriKrown, the entity determining the purposes and means of Processing Personal Data.

"Data Processor" means any natural or legal person which Processes Personal Data on behalf of AfriKrown, such as our payment or hosting providers.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates — for example, a voter, ticket buyer, event creator, or Kitty contributor.

"Sensitive Personal Information" includes financial account credentials, national ID or passport numbers, and precise geolocation data.

III

INFORMATION WE COLLECT

A. Information You Provide Directly

We collect information that you voluntarily provide when you:

• Create an account or register as an event creator, group administrator, or user
• Cast a vote, purchase a ticket, or contribute to a Kitty
• Complete forms, surveys, or nominee/event submissions
• Communicate with us via email, chat, phone, or other channels
• Subscribe to updates or notifications
• Submit reviews, feedback, or reports of fraud or misuse

Such information may include: full name, phone number, email address, M-Pesa or payment details, national ID (where required for payouts), profile photographs, and any other information you choose to provide.

B. Information Collected Automatically

When you access our Services, we automatically collect certain technical information through cookies, log files, and similar technologies, including:

• Device Information: Hardware model, operating system, browser type and version, unique device identifiers
• Usage Data: Pages visited, time spent, clickstream data, referring/exit pages, interaction with features
• Location Data: IP address-derived approximate location
• Network Information: IP address, ISP, connection type
• Device Trust Data: Device fingerprints used to secure your account and detect unauthorized access

C. Information from Third-Party Sources

We may receive Personal Data from:

• Mobile money and payment providers (e.g. M-Pesa) processing your transaction
• Business partners and service providers
• Analytics providers
• Fraud prevention and identity verification services

D. Cookies and Tracking Technologies

We employ the following types of cookies:

• Strictly Necessary Cookies: Essential for website functionality, login sessions, and security
• Performance Cookies: Collect aggregate data on website usage
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how the platform is used so we can improve it

You may control cookie preferences through your browser settings. However, disabling certain cookies may limit functionality of the Services.

IV

LEGAL BASIS AND PURPOSE OF PROCESSING

We Process Personal Data only where we have a lawful basis, including:

A. Contractual Necessity

Processing necessary to deliver the Services you request, including:

• Account creation and authentication
• Recording and tallying votes
• Issuing and validating tickets
• Processing Kitties contributions and payouts
• Customer support

B. Legitimate Interests

Processing necessary for our legitimate business interests, balanced against your rights:

• Fraud detection and prevention (including device trust checks)
• Network and information security
• Internal analytics and product improvement

C. Legal Obligation

Processing required to comply with legal obligations, including:

• Tax reporting and financial record-keeping
• Compliance with lawful law enforcement requests
• Regulatory reporting under Kenyan law

D. Consent

Where required, we obtain your explicit consent for:

• Marketing communications
• Non-essential cookies and tracking technologies
• Sharing data with third parties for their own marketing purposes

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

V

DATA SHARING AND DISCLOSURE

A. Service Providers and Processors

We engage third-party service providers who Process Personal Data on our behalf under strict contractual obligations, including:

• Cloud hosting and infrastructure providers
• Mobile money and payment processors
• Email and SMS delivery services
• Analytics providers
• Cybersecurity and fraud prevention services

All Processors are bound by data processing agreements requiring compliance with applicable data protection laws.

B. Event Creators and Group Administrators

Where you vote for a nominee, buy a ticket, or contribute to a Kitty, certain information (such as your name, contact details, and transaction details) is shared with the relevant event creator or group administrator so they can operate their event or group, communicate with you, and process payouts or refunds.

C. Business Transfers

In connection with any merger, acquisition, asset sale, or reorganization, Personal Data may be transferred to successor entities. You will be notified via email and/or prominent notice on our website of any such change in ownership or control.

D. Legal Disclosures

We may disclose Personal Data when required by law or in good faith belief that such disclosure is necessary to:

• Comply with legal process (subpoenas, court orders, warrants)
• Enforce our Terms of Service or other agreements
• Investigate potential violations of law, including fraud on the platform
• Protect against fraud, security threats, or technical issues
• Protect the rights, property, or safety of AfriKrown, our users, or the public

E. Aggregate and De-identified Data

We may share aggregate statistical data and de-identified information that cannot reasonably be used to identify you, for research, analytics, and reporting purposes.

VI

INTERNATIONAL DATA TRANSFERS

AfriKrown primarily operates within Kenya, but may use service providers or infrastructure located outside Kenya. Where we transfer Personal Data outside Kenya, we ensure adequate protection through:

• Contractual Safeguards: Data processing agreements requiring providers to protect your data to a standard consistent with the Data Protection Act, 2019
• Adequacy Considerations: Preference for jurisdictions with recognized data protection standards
• Consent: Your explicit consent for specific transfers where required

VII

DATA RETENTION

We retain Personal Data only for as long as necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required by law. Retention periods are determined based on:

• The nature and sensitivity of the data
• Contractual obligations and legitimate business needs
• Legal, regulatory, tax, and reporting requirements
• The need to retain records for fraud investigations and dispute resolution

VIII

SECURITY MEASURES

AfriKrown implements technical and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including:

Technical Safeguards

• Encryption for data in transit (TLS)
• Encrypted storage for sensitive data
• Device fingerprint verification and trusted-device checks for account access
• Parameterized database queries to prevent injection attacks
• Regular security reviews of our systems

Organizational Safeguards

• Access controls based on least-privilege principles
• Staff confidentiality obligations
• Data processing agreements with all third-party processors
• Incident response procedures

IX

YOUR RIGHTS AND CHOICES

Depending on your jurisdiction, you may have the following rights regarding your Personal Data:

A. Right of Access

You have the right to obtain confirmation of whether we Process your Personal Data and to receive a copy of that data.

B. Right to Rectification

You may request correction of inaccurate Personal Data and completion of incomplete Personal Data.

C. Right to Erasure

You may request deletion of your Personal Data where:

• The data is no longer necessary for the purposes collected
• You withdraw consent and no other legal basis exists
• The data was unlawfully Processed
• Legal obligations require erasure

D. Right to Restriction of Processing

You may request limitation of Processing where accuracy is contested or Processing is unlawful.

E. Right to Data Portability

You have the right to receive Personal Data you provided in a structured, commonly used, machine-readable format.

F. Right to Object

You may object to Processing based on legitimate interests or for direct marketing purposes. We will cease Processing unless we demonstrate compelling legitimate grounds that override your interests.

G. Exercising Your Rights

To exercise any of these rights, please submit a request through:

• Email: africrowns80@gmail.com
• Contact form: afrikrown.com/contact

We will respond to verified requests within a reasonable timeframe, generally within 30 days as required under the Data Protection Act, 2019.

H. Right to Lodge a Complaint

You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya, or with the relevant supervisory authority in your jurisdiction.

X

CHILDREN'S PRIVACY

Our Services are not directed to children under the age of 18, and we do not knowingly collect Personal Data from children, including payment or voting information. If we learn that we have collected Personal Data from a child without valid parental or guardian consent, we will delete such information promptly.

If you believe we have inadvertently collected information from a child, please contact us immediately at africrowns80@gmail.com with details, and we will take appropriate remedial measures.

XI

THIRD-PARTY LINKS AND SERVICES

Our Services may contain links to third-party websites, applications, or payment providers not operated or controlled by AfriKrown. This Policy does not apply to such third-party properties. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies before providing any Personal Data.

The inclusion of any link does not imply endorsement by AfriKrown of the linked site, its operator, or its content.

XII

DATA BREACH NOTIFICATION

In the event of a data breach likely to result in a risk to your rights, we will:

• Notify affected individuals without undue delay upon discovery
• Report the breach to the ODPC and other relevant authorities as required by law
• Provide information about the nature of the breach, categories of data affected, and measures taken
• Offer appropriate mitigation guidance where relevant

We maintain an incident response process to ensure preparedness for potential security incidents.

XIII

CHANGES TO THIS POLICY

We reserve the right to modify this Policy at any time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated through:

• Notice on our website
• Email notification to registered users, where appropriate

The "Last Updated" date at the top of this Policy indicates when it was last revised. Your continued use of the Services after the effective date of changes constitutes acceptance of the modified Policy.

XIV

SPECIAL NOTICES

A. Marketing Communications

You may opt out of marketing communications by:

• Clicking the "unsubscribe" link in any marketing email
• Adjusting preferences in your account settings
• Contacting africrowns80@gmail.com

Please note that even after opting out of marketing communications, we may still send transactional or service-related messages (e.g. vote confirmations, ticket receipts, Kitties disbursement notices).

B. Payment Information

Payment details (such as M-Pesa numbers) are collected solely to process transactions and are handled in line with our payment providers' security standards. We do not sell or trade payment information.

XV

SEVERABILITY AND ENTIRE AGREEMENT

Severability: If any provision of this Policy is found to be invalid, illegal, or unenforceable, such provision shall be modified to the minimum extent necessary to make it valid and enforceable while preserving its intent. If such modification is not possible, the provision shall be severed from this Policy, and the remaining provisions shall continue in full force and effect.

Entire Agreement: This Policy, together with our Terms of Service and Refund & Cancellation Policy, constitutes the entire agreement between you and AfriKrown concerning the subject matter hereof.

Governing Law: This Policy shall be governed by and construed in accordance with the laws of Kenya, without regard to its conflict of law provisions.

Dispute Resolution: Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of Kenya, except where mandatory consumer protection laws require otherwise.

XVI

ACKNOWLEDGMENT AND CONSENT

This Privacy Policy represents our commitment to transparency, accountability, and respect for your privacy rights under applicable Kenyan and international data protection laws.