Privacy Policy

Bidbox handles two kinds of personal data, in two different roles under the Data Protection Act, 2019 (the “Act”):

• Data about the people our clients check — ID numbers, names, phone numbers, vehicle owners, company directors. Here the client is the data controller: it decides why the check is run. Bidbox is its data processor, acting only on the client’s instructions. The government agency remains the source of the record.
• Data about our clients’ own staff and contacts — names, phone numbers and emails of the people who use the dashboard, plus billing details. Here Bidbox is the data controller.

Bidbox is registering with the Office of the Data Protection Commissioner (ODPC) as both a data controller and a data processor. The registration number will be published here once issued.

• Check inputs: what the client submits — an ID and serial number, a phone number, a number plate, a business name or number — together with the declared purpose and the consent confirmation.
• Check results: what the agency returns, such as a name, gender, date of birth, place of issue, vehicle details or business standing.
• Request records: who ran the check, when, from which key and IP address, the outcome and the charge.
• Account data: team members’ names, phone numbers and emails; organisation registration details and KRA PIN; wallet top ups and M-Pesa references.

We run a check only when a client asks for one, states a purpose, and confirms it has the data subject’s consent or another lawful basis under section 30 of the Act (for example, a contract with the person, or a legal obligation such as anti-money-laundering rules). Each purpose must match what the agency approved for that client.

We use account data to run the service, bill for it, keep it secure, and meet our own legal duties. We do not sell personal data, use check data for marketing, or build profiles from it.

• We pass to the agency only the fields the check needs, and return only what the agency sends back.
• For an ID search, the serial number must match before any personal details are returned.
• Dashboard history and logs show masked ID and phone numbers (for example 12****78). Full results are shown once, to the person who ran the check.
• Webhook events carry ids and outcomes only, never the personal details from a result.

• Full check results: held only long enough to deliver them to the client — no longer than 30 days — then deleted, unless the client’s agreement sets a shorter period.
• Request records (who, when, purpose, masked input, outcome, charge): kept for 7 years, so clients and regulators can audit how data was used and to meet tax and anti-money-laundering record-keeping rules.
• Account data: for as long as the account is open, then up to 7 years for financial records.

These periods are draft and will be confirmed against each agency’s terms before launch.

Data is encrypted in transit (TLS 1.2 or higher) and at rest. Access inside Bidbox is limited to named staff who need it, protected by multi-factor sign-in and logged. API keys are stored as one-way fingerprints, never in readable form. The service is tested by an independent security firm before launch and regularly after. If a breach affects personal data, we tell affected clients without delay and help them notify the ODPC within 72 hours as the Act requires.

• The agencies, through Gava Connect, to run the checks clients request.
• Service providers who host, secure or support Bidbox (cloud hosting, SMS delivery, M-Pesa payments), under contracts that bind them to the same standards.
• Authorities, when Kenyan law requires it.

Where a provider stores data outside Kenya, we transfer it only as section 48 to 50 of the Act allow, with appropriate safeguards, and we will list those providers and locations here before launch.

Under the Act you have the right to be informed, to access your data, to object, to have inaccurate data corrected and to have data deleted, among others.

• If you were the subject of a check, the organisation that ran it is your first contact. Tell us if you can’t reach them and we will pass your request on and help them answer. To correct an official record, contact the agency that holds it — Bidbox can’t change agency records.
• If you use the Bidbox dashboard, write to us and we’ll answer within the time the Act allows.

You can also complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Data protection questions go to our data protection officer at info@bidbox.com, +254 728 314 988, Two Rivers Mall, Nairobi, Kenya. We’ll post changes to this policy here and tell clients by email at least 30 days before a material change takes effect.