Privacy Policy

UniNexus Connect (the “Platform”), the Inter-Universities Nexus Platform, is a flagship initiative of the B.A Connect Organization (“we”, “us”). We are the data controller for the personal data described below and process it in line with the Kenya Data Protection Act, 2019. This page explains what we collect, why, who helps us handle it, how long we keep it, and the rights you have.

1. What we collect

• Membership account: full name, email address, password (stored only as a secure hash by our authentication provider — we never see or store your plain password), the category you choose (institution, affiliation or other), and the name of your institution or group. If you sign in with Google we receive your name and email from Google.
• Disability status (optional, sensitive): if you tick “I identify as a person with a disability” at sign-up. This is voluntary, is used only for anonymous platform statistics and inclusion planning, and you may leave it unticked.
• Event tickets: your name, email, M-Pesa phone number, the ticket you bought, the amount, and the M-Pesa receipt reference. We never receive or store your M-Pesa PIN or any card details — payment is completed on your phone with Safaricom.
• Gala Awards voting: a one-time SMS code is sent to your phone number. We store only a hashed (irreversible) version of your phone number and code, a hashed IP address and a random device token, to enforce one vote per person.
• Newsletter and push notifications: your email address if you subscribe; a browser push-subscription identifier if you allow notifications.
• Feedback and comments: what you write, and your name where shown.
• Technical data: IP address, browser/device type and error reports, used for security, abuse prevention and fixing problems.

2. Why we use it, and our legal basis

• To create and run your membership and issue your Membership ID — performance of the service you asked for.
• To sell tickets, take payment and email your gate pass — contract.
• To run fair, one-person-one-vote Gala Awards and to block bots and abuse — legitimate interest.
• To send you newsletters, campaigns and push notifications — your consent, which you can withdraw at any time.
• To produce anonymous, aggregate statistics (such as total members and institutions) — legitimate interest.
• To meet legal obligations and protect the Platform — legal obligation / legitimate interest.

We do not sell your personal data, and we do not use it for advertising.

3. Who we share it with

We use trusted service providers (“processors”) who handle data only on our instructions:

• Supabase — database and sign-in (data is hosted in the EU, Ireland region).
• Vercel — website hosting.
• Safaricom (M-Pesa Daraja) — ticket payments.
• Resend — sending gate-pass and campaign emails.
• Africa’s Talking — sending voting SMS codes.
• Upstash — rate limiting (temporary IP and phone-hash identifiers).
• Sentry — error monitoring.
• Cloudflare Turnstile — bot protection on sign-in and voting forms.
• Google — optional “Continue with Google” sign-in and embedded event maps.

Some of these providers process data outside Kenya. Where that happens we rely on appropriate safeguards as required by the Data Protection Act. We may also disclose data when required by law or a court order.

4. How we protect it

• Data is encrypted in transit (HTTPS) and database access is restricted by row-level security, so members can only read and change their own information.
• Administrator accounts are protected by two-step verification.
• Secrets and payment credentials are kept in encrypted server settings and never exposed to your browser.
• Login, payment, voting and form endpoints are rate-limited and bot-protected.

No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the Office of the Data Protection Commissioner as the law requires.

5. How long we keep it

• Membership data: while your membership is active, and deleted or anonymised when you ask us to close it.
• Ticket and payment records: kept as long as needed for accounting, audit and dispute purposes.
• One-time voting codes: expire within minutes; hashed vote-integrity records are kept for the life of the awards season.
• Newsletter and push data: until you unsubscribe or your browser subscription expires.

6. Your rights

You have the right to be informed about how your data is used; to access it; to correct inaccurate data; to ask us to delete it; to object to or restrict processing; to withdraw consent at any time; and to receive a copy of your data in a portable format. To use any of these rights, email uninexusplatformke@gmail.com from the address on your membership. We may need to verify your identity before acting on a request.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner (Kenya) at www.odpc.go.ke.

7. Cookies

We use only essential cookies: a secure session cookie that keeps you signed in, and a random device token used to prevent duplicate votes. We do not use advertising or cross-site tracking cookies.

8. Young people

The Platform is built for university, college and tertiary students and youth. If you are under 18, please make sure a parent or guardian is aware of and agrees to your use of the Platform.

9. Changes to this policy

We will update this page when our practices change and show the new “last updated” date above. For significant changes we will also notify members by email.

10. Contact

B.A Connect Organization — UniNexus Connect, Kenya. Email: uninexusplatformke@gmail.com. See also our Terms of Use.