TruthPesa Privacy Policy

Introduction

This Privacy Policy applies to the interfaces, websites, applications, and related features made available through https://truthpesa.com (collectively, the "Interfaces" and "Features"). Words defined in our Terms of Use have the same meaning here, and this policy forms part of the Agreement they describe.

TruthPesa is the data controller for the personal data described in this policy, and processes it in accordance with the Data Protection Act, 2019 of Kenya and its regulations.

BY CREATING AN ACCOUNT OR OTHERWISE USING THE INTERFACES OR FEATURES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. IF YOU DO NOT AGREE WITH IT, DO NOT USE THE INTERFACES OR FEATURES.

Personal Data We Collect

We collect the following categories of personal data:

• Account Data. Your mobile phone number, your password (which we store only in hashed form), your username, and, if you choose to provide them, your name, email address, and profile photo.
• Verification Data. The one-time codes we send by SMS to confirm your phone number when you sign up, log in, reset your password, or change your number, and whether your email address has been verified.
• Payment Data. When you deposit or withdraw through M-Pesa, the phone number the payment is made to or from, the amount, the currency, the exchange rate applied, the M-Pesa transaction reference, and the status and time of each payment. We do not receive or store your M-Pesa PIN.
• Trading Data. Your account balance, the orders you place and cancel, the trades they produce, your positions, and the results of the markets you trade in.
• Content You Post. Comments, replies, and likes you add to markets.
• Settings. Your notification preferences and the security events on your account, such as a password reset or phone number change and any withdrawal hold that follows it.
• Technical Data. Your IP address, browser and device type, the pages you request, and the time of each request, collected in server logs and in error reports when something goes wrong.

You must be at least 18 years old to use the Interfaces and Features. TruthPesa does not knowingly collect personal data from anyone under 18.

How We Use Your Personal Data

We use your personal data only for the purposes below, and rely on the lawful basis stated for each:

• To provide the Features you ask for: creating and securing your account, running your balance, matching and settling your orders, and paying out resolved markets. This is necessary to perform our contract with you.
• To process deposits and withdrawals through M-Pesa, including reviewing withdrawals before they are paid. This is necessary to perform our contract with you.
• To keep accounts secure: verifying your phone number by SMS, detecting suspicious activity, and pausing withdrawals for 48 hours after a password reset or phone number change. This is in our legitimate interest and yours in preventing fraud.
• To send you the notifications you have switched on, in the Interface and, once your email address is verified, by email. You can change these at any time in your notification settings.
• To meet our legal obligations, including anti-money laundering, counter-terrorist financing, tax, and record-keeping requirements, and to respond to lawful requests from authorities.
• To find and fix errors and keep the Interfaces and Features working. This is in our legitimate interest in operating a reliable service.
• To enforce our Terms of Use, including investigating market abuse and other prohibited conduct.

TruthPesa does not sell your personal data, and does not use it for third-party advertising.

Information That Is Public

Some of what you do on the Interfaces is visible to anyone, whether or not they have an account:

• Your public profile, at a link containing your username, which shows your username, profile photo, the date you joined, your positions, and your trading activity.
• Your trades, which appear under your username in each market's activity feed and, where you are among the largest holders, in its list of top holders.
• Your comments, replies, and likes.
• Any position share card you choose to create or post.

Your phone number, email address, name, balance, deposits, and withdrawals are never shown publicly. Choose a username that does not identify you if you prefer not to be identifiable.

Who We Share Your Personal Data With

We share personal data only with the following recipients, and only as much as each needs:

• Payment Providers. Safaricom, as operator of M-Pesa, receives the phone number, amount, and reference needed to complete each deposit or withdrawal.
• Messaging Providers. The SMS provider that delivers your verification codes receives your phone number and the message, and the email provider that delivers notifications receives your email address and the message.
• Hosting and Infrastructure Providers. Our cloud hosting, database, and storage providers hold the data we process on our behalf.
• Error Reporting. When an error occurs, technical details of the request, which may include your IP address and account identifier, are sent to our error-monitoring provider so we can fix it.
• Authorities. Regulators, law enforcement, courts, and other public bodies, where the law requires it or where it is necessary to establish, exercise, or defend legal claims.
• Successors. A buyer or successor of all or part of our business, who will remain bound by this Privacy Policy for the data they receive.

Our service providers may use your personal data only to provide their services to us, and must keep it secure and confidential.

Third-Party Services Your Browser Connects To

Some content is loaded by your browser directly from third parties, which therefore receive your IP address and browser details under their own privacy policies:

• Gravatar. If you have not uploaded a profile photo, your avatar is requested from Gravatar using a one-way hash of your email address, or of your username if you have no email address.
• Market Data Providers. Charts for markets that follow an asset price, such as cryptocurrency markets, load that price directly from the provider that publishes it.
• Image Storage. Some market images are loaded from the external storage network that hosts them.

Cookies and Local Storage

• Essential Cookies. We use a session cookie to keep you signed in and a security cookie to protect your requests against cross-site request forgery. The Interfaces cannot work without them, so they cannot be switched off.
• Local Storage. Your browser stores some preferences on your own device, such as your theme, chart settings, odds format, recent searches, and bookmarked markets. TruthPesa never receives them, and you can clear them in your browser settings at any time.

We do not use advertising or cross-site tracking cookies.

International Transfers

Some of our service providers store or process personal data outside Kenya. Where they do, we transfer it only as permitted by the Data Protection Act, 2019, and take steps to ensure it receives a level of protection comparable to that required in Kenya.

How Long We Keep Your Personal Data

We keep your personal data for as long as your account is open. After it is closed, we keep what the law requires us to keep, including records of balances, payments, and trades needed for anti-money laundering, tax, and accounting purposes, for the period the law requires, and delete or anonymise the rest. Verification codes expire after 30 minutes. Content you made public may remain visible where removing it would break the record of a market, but it will no longer be linked to your identity.

How We Protect Your Personal Data

We use technical and organisational measures appropriate to the risk, including encrypted connections, hashed passwords, SMS verification for sign-in, optional two-factor authentication, password confirmation before sensitive changes, review of withdrawals, and restricted access to personal data. No system is completely secure, so keep your password and phone private and tell us immediately if you believe your account has been compromised.

Your Rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your personal data is used, which this policy does.
• Access the personal data we hold about you.
• Correct personal data that is inaccurate or incomplete. You can change your username, name, email address, profile photo, and phone number yourself in your settings.
• Delete personal data that we no longer need or have no lawful basis to keep, subject to the records the law requires us to retain.
• Object to, or ask us to restrict, processing based on our legitimate interests.
• Receive your personal data in a structured, commonly used, machine-readable format, and have it transferred to another controller where technically possible.
• Withdraw any consent you have given, such as to email notifications, without affecting processing that took place before.

To exercise any of these rights, contact us using the contact method provided within the Interface. We may need to confirm your identity before acting on a request, and will respond within the time the law allows. If you are not satisfied with our response, you have the right to complain to the Office of the Data Protection Commissioner of Kenya.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will tell you through the Interfaces or by another appropriate means before they take effect. Your continued use of the Interfaces and Features after an update takes effect means you accept the updated policy.

Contact

Questions, requests, or complaints about this Privacy Policy or about how TruthPesa handles your personal data should be directed via the contact method provided within the Interface.