Privacy Policy

1. Who We Are

Kolekta is a tax compliance and record-keeping platform being developed for Kenya's independent workers, creatives, and small production businesses.

The platform is operated by Kolekta Limited, a company incorporated in Kenya under the Companies Act 2015. Our contact address is:

For the purposes of Kenya's Data Protection Act 2019 (DPA 2019), Kolekta Limited is the data controller for personal data collected through this website.

2. Legal Framework

This policy is written in compliance with:

• Kenya Data Protection Act 2019 (No. 24 of 2019) and the Data Protection (General) Regulations 2021 — our primary legal framework
• Kenya Computer Misuse and Cybercrimes Act 2018 — governing unlawful access to and misuse of computer data
• Kenya Consumer Protection Act 2012 — your rights as a consumer of digital services
• EU General Data Protection Regulation (GDPR) — applied where visitors from the European Economic Area (EEA) access this website, to the extent it is applicable to our processing activities

Where there is a conflict between Kenyan law and any other framework, Kenyan law prevails.

3. What Data We Collect — and What We Don't

What we collect at this stage

This website is an information and education resource. The only personal data we actively collect is through our research questionnaire, which may ask for:

• Your name (optional)
• Your email address (optional, if you wish to be contacted)
• General information about your work as a creative professional — for example, the types of income you earn, whether you currently file tax returns, and what challenges you face

The questionnaire does not ask for your KRA PIN, your iTax password, income figures, client names, or any financial data. It is a product research instrument only.

What we do not collect at this stage

• KRA PIN or iTax credentials of any kind
• Tax returns, income data, or financial records
• Bank account details or payment information
• Identification documents
• Biometric data

Tax estimator

Our free tax estimator tool processes the income figures you enter to produce an estimated tax liability. This data is not stored, transmitted to any server, or associated with your identity. The calculation runs in your browser session only. When you close or refresh the page, the data is gone.

Website analytics

We may collect standard website analytics data — pages visited, time on page, device type, and approximate geographic region — using privacy-respecting analytics tools. This data is aggregated and not linked to any individual. No advertising trackers or cross-site tracking cookies are used.

4. How We Use the Data We Collect

Questionnaire responses are used solely for product research — to understand the needs of Kenya's creative workforce and to design a platform that serves them. Specifically:

• Research and product development:Understanding what features matter most to Kenya's independent workers
• Community building: If you provide your email, we may contact you to share updates, invite you to beta participation, or ask follow-up research questions

We will not use your data for automated decision-making, profiling, or any purpose unrelated to building the Kolekta platform.

Legal basis for processing (DPA 2019, s.30): Consent. You choose to complete the questionnaire. You may withdraw that consent at any time by emailing support@kolekta.co.

Legal basis for processing under GDPR (Article 6(1)(a)): Consent, where GDPR applies.

5. Data Storage and Security

Our research questionnaire is built using Google Forms. Responses are collected and stored in Google Sheets, both of which are services operated by Google LLC (and its affiliates). Google acts as a data processor on our behalf.

Google applies industry-standard security measures to data processed through its Workspace products, including encryption in transit (TLS) and encryption at rest. Google's data processing practices for Workspace are governed by Google's Cloud Data Processing Addendum, which sets out the contractual basis on which Google handles data on our behalf. (workspace.google.com/terms/dpa_terms.html)

We do not sell, rent, or share your personal data with third parties for commercial purposes. We may share data with:

• Google LLC — as our data processor for questionnaire collection and storage via Google Forms and Google Sheets, as described above
• Other service providers who assist us in operating this website, under data processing agreements that require them to protect your data
• Law enforcement or regulatory authoritieswhere we are required to do so by law, including under Kenya's Data Protection Act 2019 and the Computer Misuse and Cybercrimes Act 2018

We retain questionnaire data for as long as it is relevant to product development, and for a maximum of three years from the date of collection, unless you ask us to delete it sooner. You may request deletion at any time by emailing support@kolekta.co. We will delete your responses from our Google Sheets records within 21 days of a valid deletion request.

6. Cross-Border Data Transfers

Google LLC is headquartered in the United States. By using Google Forms to submit your questionnaire responses, your data is transferred to and stored on Google's servers, which may be located outside Kenya — including in the United States and other countries where Google operates data centres.

We rely on Google's Cloud Data Processing Addendum as the safeguard for this transfer, consistent with the requirements of Kenya's Data Protection Act 2019 (s.49 — restriction on transfer of personal data outside Kenya) and, where applicable, GDPR Chapter V. Google's Addendum incorporates Standard Contractual Clauses approved for cross-border transfers.

You may review Google's privacy practices at policies.google.com/privacy.

If you are not comfortable with your data being processed by Google outside Kenya, please do not complete the questionnaire. You can still use the tax estimator, read our education content, and contact us by email — none of those activities involve Google Forms.

7. Your Rights

Under Kenya's Data Protection Act 2019 (Part IV) and, where applicable, the GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your personal data (the "right to erasure"), subject to any legal retention requirements
• Object to processing of your personal data
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke

To exercise any of these rights, email support@kolekta.co. We will respond within 21 days, as required by the DPA 2019.

8. Cookies

This website uses only essential cookies necessary for the site to function (for example, to remember your session on the tax estimator page). We do not use advertising cookies or cross-site tracking cookies.

You can control cookies through your browser settings. Disabling essential cookies may affect how the site works.

9. Children's Privacy

This website is not directed at persons under the age of 18. We do not knowingly collect personal data from children. If you believe a child has submitted data through this website, please contact us at support@kolekta.co and we will delete it promptly.

10. What Will Change When the Platform Launches

When Kolekta moves from pre-launch to live operations, this policy will be substantially updated to cover:

• The collection and processing of tax records, KRA-related data, and financial information
• ODPC registration details and our Data Protection Officer contact
• The trust architecture governing how accountants access client data under mandate (without password sharing)
• Specific retention periods for tax records (Kenya's Tax Procedures Act requires five-year retention)
• Our TSP (Tax Service Provider) registration status with KRA

We will notify questionnaire subscribers by email when this updated policy is published.

11. Changes to This Policy

We may update this policy from time to time. The "Last reviewed" date at the top of this page will always reflect the most recent version. For material changes, we will provide notice via the website or by email where we hold your contact details.

12. Contact

For any questions about this policy or how we handle your data:

For complaints you may also contact the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke