Privacy Policy

Who We Are

CryptoBitPesa ("we", "us", "our") is a cryptocurrency trading and investment platform registered and operating in Kenya. We are the data controller responsible for your personal information collected through our website and mobile platform at cryptobitpesa.com.

We are committed to protecting your privacy and handling your personal data in accordance with the Kenya Data Protection Act, 2019 and all applicable regulations.

Information We Collect

We collect the following categories of personal information:

• Identity Information: Full name, date of birth, nationality, and government-issued ID (National Identity Card or Passport).
• Contact Information: Email address, phone number, and physical address.
• Financial Information: M-Pesa phone number, transaction history, deposit and withdrawal records, and account balances.
• KYC Documents: Scanned copies or photographs of your National ID, and where required, proof of address documents.
• Device & Technical Data: IP address, browser type, device identifiers, and access logs.
• Usage Data: Pages visited, features used, time spent on platform, and referral information.
• Communications: Support ticket contents, messages sent through our platform, and correspondence with our team.

How We Use Your Information

We use your personal information for the following purposes:

• To create and manage your account on our platform.
• To process deposits, withdrawals, and investment transactions.
• To verify your identity and comply with KYC requirements.
• To comply with Anti-Money Laundering (AML) obligations under Kenyan law.
• To communicate with you about your account, transactions, and platform updates.
• To detect, prevent, and investigate fraud, security breaches, and illegal activity.
• To calculate and credit referral commissions.
• To improve our services and user experience.
• To comply with legal obligations and respond to lawful requests from authorities.

Legal Basis for Processing

Under the Kenya Data Protection Act 2019, we process your personal data on the following legal grounds:

• Contract Performance: Processing necessary to provide our services and execute transactions.
• Legal Obligation: Processing required to comply with AML laws, tax regulations, and regulatory requirements.
• Consent: Where you have provided explicit consent, such as for marketing communications.
• Legitimate Interests: For fraud prevention, platform security, and service improvement.

KYC & Identity Verification

As a financial services platform operating in Kenya, we are required by law to verify the identity of all users before processing transactions above regulatory thresholds. This process is known as Know Your Customer (KYC).

We collect and process the following KYC documents:

• Kenya National Identity Card (front and back)
• Passport (for non-Kenyan nationals)
• Proof of address where required
• Selfie or photograph for identity matching

Failure to complete KYC verification may result in transaction limits or account restrictions in accordance with our AML Policy.

Data Sharing & Disclosure

We do not sell your personal data. We may share your information with:

• Safaricom / M-Pesa: For processing M-Pesa payment transactions (phone number and transaction amounts only).
• Supabase: Our cloud database and authentication provider, which stores your data on secure servers.
• Regulatory Authorities: The Financial Reporting Centre (FRC), Kenya Revenue Authority (KRA), or other competent authorities when required by law.
• Law Enforcement: Where required by a court order, legal process, or to prevent fraud and criminal activity.
• Service Providers: Third-party service providers who assist in platform operations, under strict confidentiality agreements.

All third parties with whom we share data are required to handle it in accordance with applicable data protection laws.

Data Retention

We retain your personal data for the following periods:

• Account Data: For the duration of your account and for 7 years after account closure, in compliance with Kenya's AML regulations.
• Transaction Records: Minimum 7 years as required by the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA).
• KYC Documents: Minimum 7 years after the business relationship ends.
• Communications: 3 years from the date of communication.

After the applicable retention period, your data will be securely deleted or anonymised.

Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data where no legal obligation requires us to retain it.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at the details provided in Section 13. We will respond within 30 days. Note that some rights may be limited where we have legal obligations to retain data.

Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using TLS/SSL protocols.
• Encrypted storage of sensitive data including passwords and KYC documents.
• Row-level security on our database to ensure users can only access their own data.
• Regular security reviews and access controls.
• Two-factor authentication options for account access.

Despite these measures, no internet transmission is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the Office of the Data Protection Commissioner (ODPC) as required by law.

Cookies & Tracking

We use session cookies and local storage to maintain your login session and platform preferences. We do not use third-party advertising cookies or tracking pixels.

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

Children's Privacy

CryptoBitPesa is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has registered on our platform, please contact us immediately and we will delete the account and associated data.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of material changes by email or through a notice on the platform. The updated policy will be effective from the date stated at the top of this page.

Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy.

Contact Us

For any privacy-related queries, requests, or complaints, contact our Data Protection Officer:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke if you believe your data protection rights have been violated.