electionske.com electionske.com

Privacy Policy

Last updated: 10 August 2026

electionske.com ("we", "us", "our") respects your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it under the Kenya Data Protection Act, 2019 ("the DPA"). It applies to account holders (candidates and agencies), site visitors, volunteers, and anyone who contacts a campaign through the Platform.

By using electionske.com, you agree to the collection and use of information as described in this Policy.

1. Who We Are

electionske.com is a campaign website builder for candidates seeking elected office in Kenya. For account holders' personal data, and for the general operation of the Platform, electionske.com acts as the data controller. For contact lists, volunteer sign-ups, and messages that a candidate or agency collects through their own campaign page, that campaign owner acts as the data controller for their audience's data, and electionske.com acts as a data processor on their instructions.

2. Data We Collect

2.1 Account data

When you register, we collect your name, phone number (verified by SMS one-time code), and, optionally, your email address and password (stored as a secure hash, never in plain text).

2.2 Campaign data

If you create a campaign page, we collect the information you choose to publish: candidate biography, photo, manifesto and pledges, past achievements, office sought, party affiliation, and event listings. This information may reveal your political opinions and affiliations, which the DPA treats as a special category of personal data — we process it only because you have chosen to make it public as part of running for office, and only for the purpose of operating your campaign page.

2.3 Donation display details

If you display M-Pesa Paybill/Till numbers or bank account details on your "how to donate" page, we store and display what you provide. We do not collect or process the donations themselves, or any donor's payment card or M-Pesa PIN — those transactions happen directly between a supporter and you via Safaricom's M-Pesa service.

2.4 Volunteer and contact data

If a site visitor signs up as a volunteer or sends a message through your campaign page's contact form, we collect what they submit — typically name, phone number, ward/location, and message content — and store it against your campaign account. This data belongs to your campaign; we process it on your behalf as described in Section 1.

2.5 SMS recipient data

If you upload contacts or a CSV of phone numbers to send bulk SMS, we store those numbers and the message content solely to deliver your messages and record delivery status. You are responsible for the lawful basis for messaging those numbers (see our Terms of Service).

2.6 Payment data

When you pay for a subscription or SMS credit via M-Pesa STK Push, we store the transaction reference, phone number used, amount, and payment status returned by Safaricom's M-Pesa Daraja API. We do not store your M-Pesa PIN or full financial account details.

2.7 Site usage data

We automatically record visits to public campaign pages — a hashed, non-reversible identifier derived from the visitor's IP address and the date (so we can count unique visitors without storing raw IP addresses long-term), the page visited, and, where available, the referring website. This powers the visitor statistics shown to campaign owners and platform administrators. We do not use third-party advertising trackers or cookies for cross-site tracking.

2.8 Communications

If you contact our support team, we keep a record of that correspondence to respond to you and improve our service.

3. How We Use Your Data

We use personal data to:

  • create and secure your account, including phone verification and password reset;
  • build, host, and serve your public campaign page;
  • process subscription and SMS credit payments via M-Pesa;
  • deliver SMS messages you send through the Platform, via our SMS gateway partner;
  • notify you of account activity (for example, a new contact message, a collaborator invitation, or a payment confirmation);
  • provide website visitor statistics to campaign owners and platform administrators;
  • respond to support requests; and
  • maintain the security, integrity, and lawful operation of the Platform, including preventing abuse.

We do not sell your personal data to third parties, and we do not use your data for advertising.

4. Who We Share Data With

We share personal data only where necessary to operate the Platform:

  • Safaricom (M-Pesa/Daraja API) — to process subscription and SMS credit payments.
  • Our SMS gateway provider — to deliver the bulk SMS messages you send.
  • Hosting and infrastructure providers — to store and serve the Platform and its data.
  • Law enforcement or regulators — where required by Kenyan law, a valid court order, or to protect the rights, property, or safety of electionske.com, our users, or the public.

We require these third parties to protect your data and use it only for the purpose we've engaged them for.

5. Data Retention

We retain account and campaign data for as long as your account is active, and for a reasonable period afterward for legal, tax, dispute-resolution, and record-keeping purposes. If you request deletion of your account, we will delete or anonymize personal data we are not otherwise required to keep, typically within 30 days.

Volunteer, contact, and SMS recipient data collected by a campaign is retained for as long as that campaign's account is active, or until the campaign owner deletes it.

6. Data Security

We take reasonable technical and organizational measures to protect your data, including password hashing, phone-based one-time-code verification for account access and password resets, and encrypted connections to the Platform. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights Under the Data Protection Act

As a data subject under Kenya's Data Protection Act, 2019, you have the right to:

  • be informed of how your data is used (as set out in this Policy);
  • access the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request deletion of your data, subject to our legal retention obligations;
  • object to or restrict certain processing of your data;
  • data portability, where technically feasible; and
  • lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated.

To exercise any of these rights, contact us using the details in Section 10. We will respond within the timeframes required by the DPA.

8. Children's Privacy

The Platform is not directed at, or intended for use by, children under 18. Candidates for elected office in Kenya must meet the minimum age requirements set by law, and we do not knowingly collect account data from minors. Volunteer and contact form submissions are expected to come from adults; if we become aware that a minor's personal data has been submitted without appropriate basis, we will take steps to remove it.

9. Cookies

We use essential session cookies to keep you logged in and to protect the Platform against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies.

10. Contact Us

For any question about this Privacy Policy, or to exercise your data protection rights, contact us:

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last updated" date above, and for material changes, take reasonable steps to notify active account holders.