Privacy Policy

1. Who this Policy applies to

This Policy applies to personal information relating to:

• Customers and prospective customers.
• Location owners and administrators.
• Staff, guards, receptionists and other authorised users.
• Visitors and persons with appointments.
• People who contact our support team or join our waitlist.
• People who use the Bawabo website or platform.

2. Our role when handling information

Bawabo may handle personal information in two different roles.

Information controlled by our customers

When a customer uses Bawabo to register visitors, appointments, vehicles or entry and exit records, the customer normally decides:

• Why the information is collected.
• What information should be collected.
• Who may access it.
• How long it should be retained.

The customer is normally the data controller for this information. Bawabo processes it on the customer’s behalf to provide and secure the service.

Questions from visitors about a specific visit or location should normally be directed first to the organisation, estate, office or other location that collected the information.

Information controlled by Bawabo

Bawabo normally acts as the data controller for information used to:

• Create and administer accounts.
• Manage trials and subscriptions.
• Process and record payments.
• Provide customer support.
• Operate and secure the platform.
• Prevent misuse and fraud.
• Communicate with customers and users.
• Meet our legal obligations.

3. Information we may collect

Depending on how the service is used, we may collect the following information.

Account and contact information

This may include:

• Name.
• Email address.
• Telephone number.
• Organisation or business name.
• Location details.
• Account role and permissions.
• Invitation and account-status information.

Visitor and appointment information

Information entered by a customer may include:

• Visitor name.
• Telephone number.
• Company or organisation.
• The last four digits of a national identity number, where the customer has enabled this field.
• Vehicle registration details.
• Driver name and telephone number, vehicle type, passenger count or service name.
• Person or destination being visited.
• Appointment details.
• Purpose of the visit.
• Arrival and departure times.
• Visit, checkout, flag, cancellation or other notes reasonably connected to the visit.

The customer determines which available fields are used, whether they are optional or required, and why the information is collected. If a customer makes information mandatory, it may refuse or limit access to its premises when that information is not provided. The customer is responsible for explaining its collection requirements before collecting the information.

Bawabo does not request or use national identity information for its own purposes. Where a customer enables the identity field, Bawabo receives and stores only the last four digits on the customer’s behalf. The service is not designed to store full identity numbers or copies or photographs of identity documents.

Free-text fields may contain other information entered by a customer or its authorised users. Customers should enter only information that is necessary and reasonably connected to visitor management and must not use these fields for full identity documents, sensitive personal information or unrelated private information unless Bawabo has expressly agreed to support that processing and the collection is lawful.

Subscription and payment information

This may include:

• Selected plan.
• Billing period.
• Amount paid.
• Transaction reference.
• Payment status.
• Billing contact details, legal name, tax information and receipt or invoice information.

Payments may be processed by an external payment provider. Bawabo does not normally receive or store full card details, mobile-money credentials or payment-account passwords.

Technical and usage information

We may collect:

• IP address.
• Browser and device type.
• Login and activity records.
• Error and diagnostic information.
• Security and audit logs.
• Security-verification and anti-abuse information.
• Cookies or similar session information.

Communications

We may retain information that you provide when you:

• Contact customer support.
• Request a demonstration.
• Join a waitlist.
• Report a problem.
• Respond to an email, message or survey.

How information is collected

We may receive information:

• Directly from you when you use or contact Bawabo.
• From a customer, its staff or other authorised users when they create accounts, appointments or visitor records.
• Automatically from browsers, devices and activity on the service.
• From payment, communications, security and other service providers that help us operate Bawabo.

4. How we use personal information

We may use personal information to:

• Create and manage accounts.
• Provide visitor-management services.
• Record appointments, arrivals and departures.
• Manage locations, staff and permissions.
• Send authentication codes and service notifications.
• Process subscriptions and payments.
• Provide receipts and billing records.
• Respond to support requests.
• Detect fraud, abuse and security incidents.
• Maintain audit and activity records.
• Troubleshoot and improve the service using account or technical information, or aggregated or de-identified information.
• Comply with legal, regulatory and contractual obligations.
• Establish, exercise or defend legal claims.

We may send important administrative or security messages even where a user has chosen not to receive optional marketing communications.

We do not use identifiable customer visitor records for unrelated advertising or product-development purposes.

5. Legal grounds for processing

The ground on which we rely depends on the information and the purpose for which it is used:

• Contract: to create accounts, provide requested services, administer subscriptions and payments, and provide support.
• Legal obligation: to maintain records or make disclosures required by applicable law.
• Legitimate interests: to secure and operate Bawabo, prevent fraud and misuse, troubleshoot problems, protect legal rights and improve the service in ways that do not override the rights of affected people.
• Consent: where consent is required for a specific optional communication or other stated purpose.

For customer-controlled visitor and appointment records, the customer is responsible for identifying and documenting an appropriate lawful basis. Bawabo processes those records only on the customer’s instructions, as needed to provide and secure the service, or where applicable law requires otherwise.

We do not sell personal information.

6. Who we may share information with

We may share limited information with trusted service providers that help us operate Bawabo, such as providers of:

• Cloud hosting and databases.
• Email and communications.
• Payment processing.
• Application security and monitoring.
• Technical support.
• Data backup and recovery.

These providers may process information only for the services they provide to us and must apply suitable confidentiality and security protections.

We may also disclose information:

• When required by law, a court or a lawful authority.
• To investigate fraud, abuse or a security incident.
• To protect the rights, safety or property of Bawabo, our customers or other people.
• As part of a business restructuring, merger or transfer, subject to appropriate safeguards.
• When the affected person has authorised the disclosure.

Customer administrators and authorised staff may access information belonging to the locations for which they have been given permission.

7. Processing outside Kenya

Some of our technology or service providers may store or process information outside Kenya.

Where personal information is transferred internationally, we will take reasonable steps to ensure that the transfer is lawful and that suitable contractual, organisational or technical safeguards are in place.

8. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Retention periods may depend on:

• The customer’s instructions and settings.
• The type of information.
• The length of the customer relationship.
• Security, audit and dispute-resolution requirements.
• Tax, accounting and other legal obligations.
• Backup and disaster-recovery procedures.

Visitor information is normally retained according to the instructions or retention practices of the customer that collected it.

New locations currently start with a one-year retention setting for eligible visitor and appointment records. An authorised customer administrator may select a different available period or disable automatic retention-based anonymisation. When the selected period expires, eligible personal details are anonymised during a retention run and related guest profiles may be removed when they are no longer linked to another record.

Account and billing information may be retained after an account is closed where necessary for legal, accounting, security or dispute-resolution purposes.

When information is no longer required, it may be deleted, securely destroyed or anonymised. Deleted information may remain temporarily in protected backups until those backups are replaced or expire.

9. Security

We use reasonable technical and organisational safeguards to protect personal information.

Our safeguards include encryption during transmission, access controls and permissions, authentication controls, restricted production access, security logging and monitoring, backup and recovery procedures, security updates, and confidentiality requirements for authorised personnel and service providers.

No internet-based service can guarantee complete security. Customers and users must also protect their accounts and devices and notify us promptly of suspected unauthorised access.

Where a personal-data breach occurs, we will investigate and make any notifications required by applicable law.

10. Your privacy rights

Subject to applicable law, you may have the right to:

• Be informed about how your personal information is used.
• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Object to certain processing.
• Request restriction of certain processing.
• Request deletion of information that is no longer required or is being processed unlawfully.
• Request a portable copy of certain information.
• Withdraw consent where processing is based on consent.
• Submit a complaint to the Office of the Data Protection Commissioner.

Some rights may be limited where information must be retained for legal, security, contractual or legitimate operational reasons.

For visitor information collected at a particular location, requests should normally be submitted to that location or organisation. Bawabo will assist its customers in responding where appropriate.

A request should identify the person making it, the relevant Bawabo account, customer or location where possible, and the right being exercised. We will acknowledge and respond to valid requests within the period required by applicable law. We may ask only for information reasonably needed to confirm identity and authority before acting on a request.

11. Cookies and local storage

Bawabo may use cookies, browser storage or similar technologies that are necessary to:

• Keep users signed in.
• Maintain secure sessions.
• Remember preferences.
• Protect the service from misuse.
• Understand and resolve technical problems.

Disabling necessary cookies or browser storage may prevent parts of the service from working correctly.

12. Children’s information

Bawabo accounts are intended for adults and authorised personnel acting on behalf of customers.

Bawabo does not knowingly solicit children to create accounts. Customers must not use Bawabo to collect information about a child unless the collection is necessary and lawful for managing access to their premises, Bawabo supports the intended use, and the customer has applied all notices, permissions and additional safeguards required by law.

13. Changes to this Policy

We may update this Privacy Policy when our services, business practices or legal obligations change.

The latest version will be published on our website or platform with an updated effective date. Where a change is significant, we may also notify registered customers or users.

14. Contact us

Questions, complaints or requests concerning personal information may be sent to:

You may also lodge a complaint with the Office of the Data Protection Commissioner in Kenya if you believe that your personal information has been handled unlawfully.