Data Protection

Trust is the core of Avenra, and data protection is central to that trust. We apply data minimisation, purpose limitation, and security-by-design across the platform, and we hold ourselves to the DPA and the Data Protection (General) Regulations 2021.

Data controller: [Registered legal entity name], [Registered office address]. Data Protection Officer: [DPO name], [dpo@avenra.co.ke].

To verify professional identity we process National ID images and a selfie. A selfie used to confirm identity is biometric data under DPA s.2, which falls within the heightened Part IV protections. We process it only on your explicit consent, only to verify identity, and never for marketing or profiling.

Large-scale processing of biometric data requires a DPIA under the 2021 General Regulations. Avenra maintains a DPIA covering ID and selfie processing and reviews it when the processing changes. DPIA reference: [DPIA reference / date].

Avenra is registered with the Office of the Data Protection Commissioner as a data controller. Registration: [ODPC data controller registration number], valid until [expiry date].

Data is processed on Microsoft Azure; the nearest region is South Africa North and there is no Azure region in Kenya. As the ODPC has published no adequacy list, transfers rely on Standard Contractual Clauses and the Microsoft Data Protection Addendum, which we have executed and retain on file.

We keep verification evidence only for the active period plus 12–24 months for dispute resolution, then delete it. Where feasible we prefer a KYC provider that returns a verified result and liveness check rather than storing full-resolution ID images.

You can access, correct, export, restrict, or delete your data, and withdraw consent, from your account controls. Full details of your DPA s.26 rights are in the Privacy Notice.

We maintain a breach-response runbook. Where a breach is likely to result in a risk to your rights, we notify the ODPC within 72 hours and affected individuals without undue delay.

Contact our DPO first so we can help. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) via complaints.odpc.go.ke.