Legal
Privacy Policy
Last updated: 23 June 2026
1. Introduction
Hackhouse Africa Limited (“Hackhouse”, “we”, “us”) operates the Hackhouse platform at community.hackhouse.africa(the “Platform”). This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use the Platform, in accordance with the Kenya Data Protection Act, 2019(the “Act”) and the regulations issued by the Office of the Data Protection Commissioner (ODPC).
By using the Platform you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Platform.
2. Data Controller
The data controller for the Platform is:
Hackhouse Africa Limited
124 Manyani East Road, Nairobi, Kenya
Email: privacy@hackhouseafrica.com
Phone: +254 722 717 770
Hackhouse Africa Limited is registered as a data controller with the Office of the Data Protection Commissioner (ODPC) as required by Section 18 of the Act.
Where an event organizer collects additional data through the Platform (e.g. via community follows or ticket purchases), the organizer acts as an independent data controller for that data and is responsible for their own compliance with the Act.
3. Personal Data We Collect
We collect the following categories of personal data:
| Category | Data Points | Purpose |
|---|---|---|
| Account | Full name, email address | Authentication, account management |
| Community Follow | Name, email, phone number (optional) | Event notifications, community updates managed by the community organizer |
| Registration | Name, email, phone number, ticket type selected | Event registration, ticket issuance, check-in, communication |
| Shop Order | Name, email, phone number, delivery address, order details | Order fulfilment, delivery, customer support |
| Payment | Transaction reference, amount, payment method (card/M-Pesa), Paystack reference | Payment processing, refunds, financial records |
| Technical | IP address, browser type, device information, access timestamps | Security, analytics, platform improvement |
| CCTV | Video footage from venue cameras | Venue security, incident investigation, safety of persons and property. Retained for minimum 30 days. Lawful basis: legitimate interest (Section 30(1)(f) of the Act). |
We do not collect sensitive personal data such as biometric data, health information, or national identification numbers.
4. Lawful Basis for Processing
Under Section 30 of the Act, we process your personal data on the following lawful bases:
- Consent - when you create an account, follow a community, or register for an event.
- Performance of a contract - to process ticket purchases and deliver services.
- Legitimate interest - for platform security, fraud prevention, and service improvement.
- Legal obligation - to comply with tax, financial, or regulatory requirements.
5. Community Follow & Data Sharing with Organizers
When you follow a community, your name, email address, and phone number (if provided) are shared with the community organizer. The organizer may use this data to:
- Notify you of new events published under the community.
- Send community-specific updates and newsletters relevant to the community’s purpose.
Each organizer is an independent data controller for the follower data they receive. You may unfollow a community at any time, which will stop future notifications. To request deletion of data already held by an organizer, contact the organizer directly or email us at privacy@hackhouseafrica.com and we will facilitate the request.
6. Payment Data
We do not store credit card numbers, M-Pesa PINs, or other payment credentials. All payments are processed by Paystack (a PCI-DSS Level 1 certified processor). Each event organizer connects their own Paystack account, meaning payments flow directly to the organizer. Hackhouse does not intermediate or hold funds.
We store only the Paystack transaction reference and payment status for the purpose of ticket confirmation, refund processing, and record-keeping.
7. Your Rights Under the Data Protection Act, 2019
Under Part IV of the Act, you have the right to:
- Access - request a copy of the personal data we hold about you.
- Rectification - request correction of inaccurate or incomplete data.
- Erasure - request deletion of your personal data, subject to legal retention requirements.
- Restriction - request that we limit the processing of your data.
- Data portability - receive your data in a structured, machine-readable format.
- Object - object to processing based on legitimate interest or direct marketing.
- Withdraw consent - withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email privacy@hackhouseafrica.com. We will respond within 30 days as required by the Act.
8. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy:
- Account data - until you delete your account.
- Event registration data - for 2 years after the event date, for record-keeping and dispute resolution.
- Payment records - for 7 years, as required by Kenya Revenue Authority tax regulations.
- Shop order data - for 2 years after the order date, for fulfilment, disputes, and record-keeping.
- Community follow data - until you unfollow the community or delete your account.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption in transit (TLS) and at rest.
- Row-level security on all database tables limiting access to authorized users.
- Organizer Paystack API keys encrypted at rest and accessible only server-side.
- Regular access reviews and audit logging.
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, as required by Section 43 of the Act. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
11. Cross-Border Data Transfers
Our hosting infrastructure (Vercel) and database services (Supabase) may process data outside Kenya. In accordance with Section 48 of the Act, we ensure that any cross-border transfer is to a jurisdiction with adequate data protection safeguards or is covered by appropriate contractual clauses.
13. Minors’ Data
Hackhouse hosts a variety of events, some of which may be open to persons under 18. It is the responsibility of the event organizer to determine and enforce any age requirements for their events and to obtain parental or guardian consent where required under the Kenya Data Protection Act, 2019 (Section 33). Where an organizer collects personal data from minors, the organizer is solely responsible for compliance with the Act, including obtaining verifiable consent from a parent or guardian.
14. Complaints
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the:
Office of the Data Protection Commissioner (ODPC)
Britam Centre, 7th Floor, Nairobi
Website: www.odpc.go.ke
15. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email. Continued use of the Platform after changes constitutes acceptance.