Privacy Policy
This policy explains how [Company legal name] (“Authstamp”, “we”, “us”) collects, uses, shares and protects personal data when you use authstamp.io, app.authstamp.io, verify.authstamp.io and related services (the “Services”). We process personal data in line with the Constitution of Kenya, the Data Protection Act, 2019 (the “Act”) and its regulations.
1. Our role: controller or processor
Authstamp plays two roles, depending on whose data it is.
| Data | Our role | Who decides how it is used |
|---|---|---|
| Issuer accounts, billing, website visitors, contact form messages, verifier activity logs | Data controller | Authstamp |
| Holders and members added by an issuer, and the documents and memberships an issuer creates | Data processor | The issuer (for example the bank, firm or association), acting as data controller |
If an organisation issued you a document or membership through Authstamp, that organisation is responsible for why your data was collected. You can contact them directly, or contact us and we will pass your request on and help them respond.
2. What we collect
Issuers and their team members
- Name, work email, phone number, role and login details.
- Organisation details: name, type, registration number, address, logo and issuer code.
- Billing details: plan, invoices and payment references (for example M-Pesa receipt numbers). We do not store full card numbers.
- Activity records: what was issued, signed or revoked, by whom and when.
Holders and members
- Name, email address and, where provided, phone number.
- Member number, membership type, join date, expiry and status.
- Documents issued to you and the information they contain, as provided by the issuer.
Verifiers
- The code or member number checked, the time of the check, and technical data such as IP address and browser type.
- Where an issuer requires it, your name and email address before you can see a result.
Website visitors and enquiries
- Details you send through the contact form: name, email, phone, organisation and message.
- Basic usage and device data needed to run and secure the website.
3. How we use it and why
| Purpose | Lawful basis under the Act |
|---|---|
| Provide the Services: issuing, storing and verifying documents and memberships | Performance of a contract with the issuer; the issuer’s own lawful basis for holder data |
| Create and secure accounts, and prevent fraud and abuse | Contract; legitimate interests in keeping the Services secure |
| Billing, invoicing and tax records | Contract; legal obligation |
| Reply to enquiries and demo requests | Legitimate interests; your request |
| Service messages (for example “a document was issued to you”) | Contract; legitimate interests |
| Marketing emails about Authstamp | Consent, which you can withdraw at any time |
| Improve the Services using aggregated, non-identifying statistics | Legitimate interests |
We do not sell personal data, and we do not use holders’ or members’ data for advertising.
4. Verification and what verifiers see
Each issuer sets a view policy for its documents. Depending on that policy, a verifier may see only whether a document is genuine, or also the issuer’s name, the holder’s name (in full, masked or hidden), part of the document, or the full document. An issuer may require a verifier to enter matching details, identify themselves, or get the holder’s approval first.
Issuers can see when and how often their documents were checked, and the verifier details they asked for.
5. In-house installations
Some institutions run Authstamp on their own servers. In that case, documents, holder data and records stay with the institution, which is the data controller. Authstamp receives only cryptographic signatures needed to confirm a document is genuine and unchanged. These signatures do not contain the document’s contents or personal details.
6. Who we share it with
- Issuers, for the holders, members and verification activity linked to their own documents.
- Verifiers, limited to what the issuer’s view policy allows.
- Service providers who help us run the Services, such as cloud hosting, file storage, email delivery and payment processing (including mobile money). They may use the data only to provide their service to us, under written agreements.
- Authorities, where the law requires it or to protect rights, safety and the integrity of the Services.
- A buyer or successor, if Authstamp is involved in a merger or sale, under the same protections as this policy.
7. Transfers outside Kenya
Some of our service providers may store or process data outside Kenya. Where this happens, we transfer data only as permitted by the Act, with appropriate safeguards such as contractual protections, and we can provide details on request. Institutions that need data to remain in-house can use an in-house installation.
8. How long we keep it
- Issued documents and memberships: for as long as the issuer keeps its account, so they can still be verified. Issuers can revoke or delete records.
- Account data: for the life of the account, then deleted or anonymised within a reasonable period, except where we must keep it longer.
- Billing and tax records: for the period required by Kenyan law.
- Verification logs: for up to [24] months, then deleted or anonymised.
- Contact messages: for up to [24] months after our last exchange.
9. Security and breaches
We protect data with measures including encryption in transit, access controls, role-based permissions, activity logging and cryptographic signing of issued documents. No system is perfectly secure, but we work to keep risks low.
If a personal data breach is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell affected people without undue delay. Where we act as a processor, we will notify the issuer promptly so they can meet their own obligations.
10. Your rights
Under the Act you have the right to:
- be told how your personal data is used;
- access the personal data we hold about you;
- object to processing of all or part of your data;
- have inaccurate or misleading data corrected;
- have false or misleading data deleted;
- receive your data in a portable format, where applicable;
- withdraw consent at any time, where we rely on consent.
To use these rights, contact us at the address below. We may need to confirm your identity. For documents and memberships issued by an organisation, we will work with that issuer to respond. Some requests may be limited where an issuer has a legal reason to keep a record, for example to show that a document was revoked.
11. Children
The Services are designed for organisations and adults. Where an issuer, such as a school or university, issues documents to a person under 18, the issuer is responsible for having a lawful basis and any required parental consent.
12. Cookies
We use cookies and similar storage that are needed to sign in, keep sessions secure and remember basic preferences. If we add analytics or marketing cookies, we will update this policy and, where required, ask for your consent first.
13. Changes to this policy
We may update this policy as the Services or the law change. We will post the new version here with a new “Last updated” date, and notify issuers by email of significant changes.
14. Contact and complaints
[Company legal name]
[Registered address], Kenya
Email: eric@authstamp.io
If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke.