Your data. Your rights.
Our obligations.

1. Introduction and Scope

VeriVote is an independent candidate intelligence platform built to empower Kenyan voters with objective, data-driven information about political candidates. This Data Security and Privacy Policy governs how VeriVote collects, processes, stores, protects, and deletes the personal data of every person who interacts with the platform.

This policy applies to:

• Voters and members of the public who use the VeriVote platform
• Candidates and their representatives who submit profiles or evidence
• VeriVote staff, analysts, and system administrators
• Third-party service providers and data processors engaged by VeriVote
• Developers building or maintaining the VeriVote platform

1.1 What VeriVote is — and what it is not

VeriVote does not facilitate voting, voter registration, or any formal electoral transaction. It collects only the minimum data required to provide candidate intelligence to voters and to operate the platform securely. This distinction limits the sensitivity profile of most data the platform holds.

However, the platform does process voter account credentials, candidate personal records (which include sensitive constitutional compliance information), and evidence submitted by candidates in challenge processes. These categories are treated with the highest level of protection available under this policy.

2. Data Controller and Contact

3. What Data We Collect and Why

We collect only the data that is necessary for the stated purpose. The principle of data minimisation applies throughout the platform.

3.1 Voter / Public User Account Data

3.2 Candidate Data

3.3 Data We Do NOT Collect

VeriVote does not collect and will never collect:

• How any individual voter intends to vote or has voted
• Ethnic, racial, religious, or political opinion data from voters
• Biometric data
• Financial payment information (if any paid tier is introduced, payment is processed by a third-party PCI-DSS compliant processor — VeriVote does not hold card data)
• Location tracking or GPS data
• Contact lists, social graphs, or data from any third-party apps

4. How We Protect Personal Data

VeriVote applies a layered security architecture covering both organisational controls and technical measures across authentication, encryption, and infrastructure.

4.1 Authentication and Access Control

4.2 Data Encryption

• All data in transit: TLS 1.2 minimum, TLS 1.3 preferred. HTTP connections redirected to HTTPS. HSTS header enforced.
• All data at rest: AES-256 encryption for the database and all backup storage.
• Candidate evidence files (submitted in challenge process): encrypted at rest in object storage. Access via pre-signed time-limited URLs only.
• Password reset tokens: stored as a SHA-256 hash. Plaintext tokens exist only in the email and in transit — never in the database.
• Backup encryption: all backups encrypted before transfer to off-site storage. Encryption keys stored separately from backup data.

4.3 Infrastructure Security

• Database: not exposed to public internet. Accessible only via application server or VPN.
• API endpoints: authenticated endpoints require valid session token. Unauthenticated requests return 401.
• Input validation: all user-supplied input sanitised at API layer. Parameterised queries mandatory (no raw SQL string concatenation).
• Dependency management: third-party packages audited quarterly. Known CVEs must be patched within 72 hours of disclosure.
• Penetration testing: annual external penetration test required before major releases. Findings must be documented and remediated.
• Secrets management: API keys, database credentials, and encryption keys stored in environment variables or a dedicated secrets manager — never in source code or version control.

5. Data Retention Policy

This section defines how long VeriVote retains each category of data and what happens when the retention period expires.

5.1 Retention Schedule

5.2 Special Rule: Electoral Cycle Data

Candidate evaluation data occupies a special category. VeriVote retains candidate evaluation records for the duration of the electoral cycle they were produced for, plus five years. This allows voters to review historical candidate performance, enables accountability journalism, supports legal appeals processes, and permits academic analysis of electoral integrity over time.

At the end of the retention period, candidate data is anonymised (not deleted) unless the candidate makes a deletion request under Section 6.3. Anonymisation means all personally identifying fields are removed, leaving only aggregate statistical data with no link to the individual.

5.3 Special Rule: Permanent Transparency Records

When a candidate's evidence challenge is accepted and results in a score change, a public log entry is written to the candidate's permanent record. This record is not subject to deletion. It records that a score was changed, the date, and the reason — not the full content of the evidence. This permanence is a governance requirement of the Candidate Response Protocol v2.0. The DPA Section 30(g) public interest basis covers this retention.

6. Your Rights Under the Kenya Data Protection Act 2019

The Kenya Data Protection Act 2019 grants you the following rights. VeriVote is legally obligated to honour all of them.

6.6 How to Exercise Your Rights

7. Cookie Policy and Consent Mechanism

7.1 Cookies VeriVote Uses

7.2 Cookie Consent

A cookie consent banner appears on your very first visit to any VeriVote page before any non-essential cookies are set. The banner contains a plain-language explanation, an "Accept All" button, a "Reject Non-Essential" button (equally prominent — not greyed out or harder to reach than Accept), a "Manage Preferences" option, and a link to this Privacy Policy.

Strictly necessary cookies (vv_session, vv_csrf) are set without consent as they are technically required. Analytics cookies are never loaded unless you actively accept them. You can change your cookie preferences at any time via Account Settings → Privacy → Cookie Preferences.

8. Data Sharing and Third Parties

8.1 Third-Party Processors

VeriVote may share data with third-party service providers who process data on our behalf. All third-party processors must sign a Data Processing Agreement (DPA) with VeriVote before receiving any data, process data only for the purpose VeriVote specifies, apply equivalent security standards, and delete or return all data upon termination of the engagement.

8.2 Legal Disclosure

VeriVote may disclose personal data to a government authority or law enforcement body only if required by applicable Kenyan law and only to the minimum extent required. We will notify affected users of any such disclosure if we are legally permitted to do so.

8.3 International Data Transfers

If cloud hosting services store data outside Kenya, VeriVote will ensure that appropriate safeguards are in place under DPA Section 48 (transfers to third countries). These safeguards include adequacy decisions or standard contractual clauses. Users will be informed of cross-border transfer arrangements in this policy.

9. Data Breach Response Plan

A data breach is any security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Under DPA 2019 Section 43, VeriVote must notify the ODPC of any breach within 72 hours of becoming aware of it.

10. Children and Minors

VeriVote is intended for use by voters who are eligible to vote under Kenyan law (18 years and older). VeriVote does not knowingly collect personal data from persons under 18. If we become aware that a user under 18 has created an account, we will delete the account and all associated data within 14 days.

11. Policy Governance and Updates

12. Glossary