Privacy Policy

1.1Who we are

Papohapo Events & Experiences ("Papohapo", "we", "us", "our") is an event planning platform and event services marketplace operated by Ericsoft Technologies, Old Namanga Road, Kitengela, Kajiado County, Kenya (P.O. Box 1211 - 00241). We connect event organisers and professional planners with event service providers, and provide tools for event plans, budgets, requests for quotation (RFQs), quotations, agreements, payments, contributions, event pages, guest management, ticketing, seating, door check-in and event-day coordination.

1.2Our role under the Data Protection Act, 2019

• Data controller: for personal data about our users (accounts, profiles, service-provider verification, transactions, communications, analytics and security), we decide why and how it is processed.
• Data processor: for personal data that an organiser or planner enters or collects about other people for their event (for example guest lists, RSVPs, seating, contributors, committee members and responsible people), we process it on their behalf and on their instructions. The organiser is the controller of that data.
• Separate controllers: service providers, planners and organisers who receive personal data through Papohapo (for example an organiser's contact details in an RFQ) use it as independent controllers for their own business and must comply with the law themselves.

1.3Laws we follow

We process personal data in line with the Constitution of Kenya (Article 31, the right to privacy), the Data Protection Act, 2019 (the "DPA") and its regulations, including the Data Protection (General) Regulations, 2021, and other applicable laws. Where users or events are outside Kenya, we also respect mandatory local data protection rules that apply to us.

2.1People this policy applies to

2.2What this policy does not cover

It does not cover how organisers, planners, service providers or partners handle personal data outside Papohapo, or third-party websites and services you reach through links. Their own privacy notices apply.

3.1Definitions

4.1Categories of personal data

4.2Data we do not want

We do not intentionally collect sensitive personal data, such as health or biometric data, and ask you not to enter it into free-text fields unless it is genuinely needed for an event (see Section 25). We never ask for your full card number, M-Pesa PIN or online banking passwords, and you should never share them with anyone claiming to be Papohapo.

5.1Sources

• Directly from you when you register, complete your profile, plan an event, send or answer an RFQ, sign an agreement, RSVP, contribute, contact us or take part in the Partner Programme.
• From other users: organisers and planners may add guests, contributors, committee members and responsible people. Partners' codes link you to the partner who referred you.
• From payment providers such as mobile money operators and banks, which confirm transactions and payouts.
• From public sources, such as business registries or a provider's own website, when we verify a service provider.
• Automatically through cookies and similar technologies, server logs and platform activity records (see Section 16 and our Cookie Policy).

5.2Providing data is generally voluntary

You do not have to give us your personal data, but some features cannot work without it. For example, we need a phone number to process M-Pesa payouts, and verification documents to show the Papohapo Verified badge. We tell you when information is required.

6.1Purposes and lawful bases

6.2Legitimate interests

Where we rely on legitimate interests, we have balanced our interests (such as running a safe, trusted and improving marketplace) against your rights and expectations. You can object to processing based on legitimate interests (see Section 22).

6.3Consent

Where we rely on consent, you can withdraw it at any time, for example by unsubscribing from marketing or changing your cookie preferences. Withdrawal does not affect processing that happened before.

7.1Organisers and planners as controllers

• If you add other people's details, such as guest lists, contributors, committee members, planning-team members or responsible people with phone numbers, you confirm you have a lawful basis to do so and, where required, their consent. You should tell them that their details will be used on Papohapo for your event.
• Responsible people's names and phone numbers are saved to your event contacts and shown in the Event Day Centre so your team can coordinate. Only add people who have agreed to be contacted for your event.
• Planners who manage events for clients must have their client's authority to share the client's and guests' data with us.

7.2What Papohapo does with this data

We process it only to provide the features you use, such as invitations, RSVPs, seating, check-in, gift registries, contributions and event-day contacts. We do not use guests' or contributors' data for our own marketing unless they have a direct relationship with us, such as their own Papohapo account and marketing consent.

7.3If you are a guest or contributor

You can ask the organiser of the event to correct or remove your data, or contact us and we will help, including by passing your request to the organiser.

8.1What is public

A service provider's business name, logo, services, packages, prices, coverage areas, portfolio, availability where shown, verification status and, where available, ratings and reviews are published on the marketplace and may appear in search engines.

8.2What stays private

Identity documents, business registration and tax documents, payout details and our verification notes are never published. They are seen only by authorised Papohapo staff and, where required, our verification and payment partners or authorities.

8.3How we verify

1. 1
   You submit details and documents

   Identity, business registration, tax and location information, plus evidence of your services.

2. 2
   We check them

   Authorised staff review the documents for authenticity and consistency, and may check public registries or contact you.

3. 3
   We record the outcome

   We record whether verification succeeded and show the Papohapo Verified badge if it did.

4. 4
   We review over time

   We may re-check when documents expire, details change or concerns are raised.

9.1Public event pages

Information the organiser publishes, such as the event story, programme, venue, photos, gift registry and contribution details, is visible to anyone with the link and may be indexed by search engines. Organisers should only publish personal information, including photos of people, with permission.

9.2RSVPs, tickets and entry passes

When you RSVP or register, your details (and those of anyone you register with you) go to the organiser. Entry passes may carry a QR code linked to your registration. When you are checked in, the time of arrival is recorded and visible to the event-day team.

9.3Seating and event-day tools

Organisers may assign you to a table or seat, and the event-day team may see your name, seat and arrival status on their devices. Event-day issues, checklists and updates may mention guests or team members by name.

10.1How payment data is handled

• Payments, such as funding an event, contributing, buying tickets or paying service providers, are processed by licensed third-party payment providers, including mobile money operators and banks, and card processors where offered.
• We receive and store transaction references, amounts, dates, statuses and the phone number or account used, to maintain Event Wallet records, milestone approvals, payouts, Commission invoices and payment history.
• We do not store full card numbers or mobile money PINs. Payment providers process your data under their own privacy policies.
• Where Papohapo manages payments, payout details (for example a provider's M-Pesa number) are used only to pay the amounts approved for them.

10.2Payment confirmation messages

Organisers can paste payment confirmation messages (for example M-Pesa SMS) into Papohapo to fill in a contribution automatically. These messages contain the sender's name, phone number, amount and reference. We extract only what is needed for the contribution record. Organisers should paste only messages that relate to their event.

10.3Fraud and compliance checks

We may review transactions for fraud, misuse or money laundering, and may be required to keep records or report suspicious transactions to the authorities under the Proceeds of Crime and Anti-Money Laundering Act and related laws.

11.1What partners can see

A partner's Partner Hub shows the names of the providers and partners who joined with their code, their stage (for example registered, verified or booked) and the earnings that resulted. It does not show your contact details, documents, prices or the details of your bookings.

11.2What we keep

We keep referral relationships, partner codes, earnings calculations, withdrawal requests and M-Pesa payout numbers for as long as needed to run the programme, pay earnings and meet tax and accounting obligations.

12.1Where we use AI

• Service content and questionnaires: AI helps us draft service descriptions and the questions in RFQ questionnaires.
• Quotation evaluation: to help organisers compare offers, the details of a request and the quotations received may be processed by AI services to suggest questions and summaries.
• These AI services are provided through workflow and AI providers acting as our processors (see Section 15). We send only the information needed for the task and do not allow providers to use it to train their own models where we can control this.

12.2Other automated processing

We use automated rules to match RFQs with relevant service providers for request alerts, to calculate budget statuses and Commission, to flag possible fraud, and to send reminders.

12.3Your protection

13.1Who we share with

14.1Main processors

14.2Safeguards

Processors act only on our documented instructions, must keep data confidential and secure, may not use it for their own purposes, and must help us meet our obligations, including notifying us of breaches. We review providers before engaging them and update this list as it changes.

15.1Summary

• Strictly necessary and functional cookies and browser storage keep you signed in, protect forms, remember your language, time zone and display preferences, and keep live chat working.
• Analytics: Google Analytics sets cookies only if you accept them. Plausible Analytics counts visits without cookies.
• Marketing: we do not use advertising, retargeting or social-media tracking cookies.
• Our pages include Facebook sharing information so that links shared on Facebook show a proper preview. This does not place Facebook cookies on Papohapo.

See our Cookie Policy for every cookie we use, how long it lasts, and the preference centre to change your choices.

16.1Service messages

We send messages needed to run your account and events, such as new quotations, request alerts, agreement and signature notices, payment approvals and reminders, RSVP confirmations and security alerts. These are not marketing and continue while you use Papohapo.

16.2Marketing

• We send marketing about Papohapo features, events and offers only in line with section 37 of the DPA: with your consent, or to existing users about similar services with a clear, free way to opt out in every message.
• You can opt out at any time using the unsubscribe link, replying STOP where offered, or contacting us at info@papohapo.com.
• We do not share your details with third parties for their marketing.

16.3Social media

If you interact with Papohapo on Facebook, Instagram, LinkedIn or other platforms, those platforms process your data under their own policies. We may see your public profile and messages you send us.

17.1When data leaves Kenya

Our platform is hosted on Odoo's cloud infrastructure, and some providers (such as analytics, email and AI services) process data in data centres outside Kenya, including in the European Union and the United States.

17.2Safeguards

In line with sections 48 to 50 of the DPA, we transfer personal data outside Kenya only where there are appropriate safeguards for its security and protection, such as contractual commitments from the recipient, transfers to countries with adequate data protection laws, or other conditions permitted by the Act, such as where the transfer is necessary to perform a contract with you. You can ask us for more information about these safeguards.

18.1Our safeguards

18.2Your part

Use a strong password, never share your login, one-time codes or M-Pesa PIN, sign out on shared devices and tell us immediately if you suspect misuse. No system is completely secure, but we work to protect your data and respond quickly if something goes wrong.

19.1How we respond

1. 1
   Contain and assess

   We act immediately to stop the incident, secure systems and assess what data and which people are affected.

2. 2
   Notify the Data Commissioner

   Where there is a real risk of harm, we notify the Data Commissioner within 72 hours of becoming aware of it, as required by section 43 of the DPA.

3. 3
   Tell affected people

   We inform affected people within a reasonable time, explaining what happened, the likely consequences and the steps they can take, unless the law allows otherwise.

4. 4
   Learn and improve

   We record every incident, its effects and the remedial action taken, and improve our safeguards.

19.2Processors and users

Our processors must notify us of breaches without delay (within 48 hours under section 43(2) of the DPA). If you notice something suspicious, such as unexpected messages or account activity, contact us at info@papohapo.com straight away.

20.1Retention periods

20.2After retention

When data is no longer needed, we delete it or irreversibly anonymise it so it can no longer identify you. Anonymised statistics may be kept.

21.1Your rights under sections 26 and 38 of the DPA

21.2Limits

Some rights have limits. For example, we may need to keep financial records required by law, or decline a request that would reveal another person's data. If we cannot fully meet a request, we will explain why.

22.1Making a request

1. 1
   Contact us

   Email info@papohapo.com with the subject "Data protection request", or use our contact form. Tell us which right you want to use and, if possible, which account, event or transaction it concerns.

2. 2
   We verify your identity

   To protect your data, we may ask you to confirm details or provide identification before we act.

3. 3
   We respond

   We acknowledge your request promptly and respond within the timelines set by the DPA and the Data Protection (General) Regulations, 2021. If we need more time for a complex request, we will tell you.

4. 4
   If you are not satisfied

   You can ask us to review our response, and you can complain to the ODPC (see Section 28).

22.2Good to know

• Requests are free. We may decline or charge a reasonable fee only where a request is manifestly unfounded or excessive, as the law allows.
• You can update most of your profile, event and business information yourself after signing in.
• If your request concerns data an organiser controls (such as a guest list), we will pass it to the organiser and help them respond.
• Someone may make a request on your behalf if they have your written authority, or as your parent or guardian if you are under 18.

23.1Accounts

Papohapo accounts are intended for people aged 18 and over. We do not knowingly create accounts for children.

23.2Children in events

Organisers may add children as guests, for example for birthdays, school events or family celebrations. Under section 33 of the DPA, a child's data may be processed only with the consent of a parent or guardian, and in the child's best interests. Organisers must obtain that consent, avoid publishing children's photos or details on public event pages without it, and add only the data needed.

23.3If you are concerned

If you believe a child's data has been shared on Papohapo without appropriate consent, contact us and we will act promptly, including removing it.

24.1Sensitive data in events

Event information can sometimes reveal sensitive personal data, for example dietary or accessibility needs in an RSVP, a religious ceremony, a funeral or family details. Organisers should only ask for such information where genuinely needed for the event, and guests share it voluntarily. We process it only to provide the event features, protect it with extra care, and do not use it for marketing or profiling.

25.1External sites and services

Papohapo may link to service providers' websites, payment pages, social networks, maps or other services, and organisers may add their own links. We are not responsible for their privacy practices. Please read their privacy notices before sharing data with them.

26.1Updates

We review this policy regularly. If we make material changes, we will notify you by email, in-app notice or on this page before they take effect, and where required by law, ask for your consent. The "Last updated" date shows the current version.

26.2Version history

27.1Data protection contact

27.2Complaints

1. 1
   Tell us

   Send your complaint to info@papohapo.com with as much detail as you can.

2. 2
   We investigate

   We acknowledge your complaint, investigate it and respond with the outcome and any action taken.

3. 3
   Escalate to the regulator

   If you are not satisfied, you may lodge a complaint with the Office of the Data Protection Commissioner, www.odpc.go.ke. You can also complain to the ODPC directly at any time.