Privacy Policy

1. Who We Are

GoKenyaHub ("we", "us", "our") is operated by GoKenyaHub Limited, a company providing online career resources, educational content, CV services, and UK immigration guidance specifically designed for Kenyan professionals.

Data Controller: GoKenyaHub Limited
Contact Email: support@gokenyahub.com
Website: https://gokenyahub.com

As a data controller, we are responsible for deciding how and why we process your personal data.

2. Data We Collect

We may collect and process the following categories of personal data:

Category	Examples	Purpose
Identity Data	Full name, username	Account creation, personalisation
Contact Data	Email address, phone number	Account registration, notifications, OTP verification
Technical Data	IP address, browser type, device type, referral URL	Security, fraud prevention, analytics
Usage Data	Pages visited, features used, time on site	Platform improvement, personalisation
Transaction Data	Purchase records, payment references	Order fulfilment, financial records
Communications Data	Support chat messages, email correspondence	Customer support, dispute resolution
Marketing Data	Email subscription preferences	Newsletter, promotional communications

We do not collect sensitive personal data (special category data) such as racial origin, health records, political opinions, or biometric data.

3. How We Collect Data

• Directly from you — when you register, purchase, submit a form, use the support chat, or contact us
• Automated technologies — cookies, server logs, and analytics tools when you visit our platform
• Third parties — payment processors (for transaction verification) and email delivery services

4. Lawful Basis for Processing

Under UK GDPR Article 6, we rely on the following lawful bases:

• Contract (Art. 6(1)(b)): Processing necessary to fulfil your subscription, purchase, or service request
• Legitimate Interests (Art. 6(1)(f)): Analytics, fraud prevention, platform security, and direct marketing to existing customers
• Consent (Art. 6(1)(a)): Marketing emails and non-essential cookies — you may withdraw consent at any time
• Legal Obligation (Art. 6(1)(c)): Financial record-keeping and compliance with applicable laws

5. How We Use Your Data

• Creating and managing your GoKenyaHub account
• Verifying your identity via email OTP for security purposes
• Delivering digital products, resources, and academy courses you have purchased
• Sending transactional emails (purchase receipts, password resets, OTP codes)
• Sending marketing newsletters (only with your explicit consent)
• Responding to support queries via our live chat and email systems
• Improving our platform through aggregated, anonymised analytics
• Detecting and preventing fraud, spam, and security threats
• Complying with legal and regulatory obligations

6. Sharing Your Data

We do not sell, rent, or trade your personal data to third parties. We may share data with:

• Service Providers: Hosting providers, email delivery services, and payment processors who process data on our behalf under strict data processing agreements
• Legal Authorities: Where required by law, court order, or to protect the rights and safety of our users or the public
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred — you will be notified in advance

All third-party processors are contractually bound to process data only on our instructions and in compliance with applicable data protection law.

7. International Data Transfers

Our servers are located within the European Economic Area (EEA). If data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions by the UK Government under the UK GDPR

8. Data Retention

Data Type	Retention Period
Account data	For the duration of your account + 2 years after closure
Transaction records	7 years (legal/financial obligation)
Support communications	3 years from last contact
Marketing preferences	Until you withdraw consent
Technical/log data	90 days
OTP verification codes	Deleted immediately after use or expiry

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access (Article 15): Request a copy of the personal data we hold about you
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your data where there is no compelling reason for continued processing ("right to be forgotten")
• Right to Restriction (Article 18): Request that we limit how we use your data
• Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests, including direct marketing
• Rights related to Automated Decision-Making (Article 22): We do not use solely automated decision-making that produces legal or similarly significant effects

10. Cookies & Tracking Technologies

What are cookies?

Cookies are small text files placed on your device when you visit our website. We use cookies to make our platform work correctly and to understand how it is used.

Cookie Type	Purpose	Consent Required
Essential	Session management, authentication, CSRF protection	No — strictly necessary
Preference	Remembering your dark/light mode setting	No — functional
Analytics	Aggregated usage statistics (anonymised)	Yes
Marketing	Not currently used	N/A

You can manage or delete cookies through your browser settings. Disabling essential cookies may affect the functionality of the platform.

11. Security Measures

We implement industry-standard technical and organisational security measures including:

• TLS/HTTPS encryption for all data in transit
• Bcrypt hashing for all stored passwords
• Email OTP verification and optional TOTP multi-factor authentication
• CSRF token protection on all forms
• Rate limiting and brute-force protection on authentication endpoints
• Input sanitisation and parameterised queries to prevent SQL injection and XSS
• Regular security reviews and access controls for staff

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay, as required by UK GDPR Article 33–34.

12. Children's Privacy

GoKenyaHub is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it immediately. If you believe we have collected data from a minor, please contact us at support@gokenyahub.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email at least 14 days before changes take effect
• Display a prominent notice on our website

Your continued use of GoKenyaHub after the effective date of any changes constitutes your acceptance of the updated policy.

14. Contact Us & Complaints

If you have any questions, concerns, or requests regarding your personal data, please contact our Data Protection Lead:

Email: support@gokenyahub.com
Subject line: "Privacy / Data Protection"

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113