Privacy Policy

Who is responsible for your data

Dafluma is operated by IWEBZ KENYA LTD using the Dafluma platform. IWEBZ KENYA LTD is the data controller unless a separate agreement identifies another controller.

Information we collect

• Account and identity information, including name, email address, phone number, role, and verification state.
• Learning information, including enrolments, lesson progress, assessments, submissions, certificates, and support interactions.
• Commerce evidence, including plans, orders, M-Pesa references, transaction status, receipts, refunds, coupons, and referral attribution. We do not store your M-Pesa PIN.
• Instructor and administrator information needed for applications, permissions, payouts, audit, security, and compliance.
• Technical information such as session identifiers, masked or security-relevant network information, device/browser data, logs, and security events.

Why we use information

• To create and secure accounts, deliver courses, track progress, issue verifiable credentials, and provide support.
• To initiate and reconcile payments, provide access, prevent duplicate charges, issue receipts, and meet accounting obligations.
• To prevent fraud and abuse, enforce platform rules, investigate incidents, and maintain reliable services.
• To improve product quality and measure public discovery or campaigns where permitted. Optional analytics or advertising technologies are not treated as essential cookies.
• To comply with applicable law, lawful requests, and record-retention duties.

Legal grounds

Depending on the context, processing is necessary to perform a contract, comply with a legal obligation, protect legitimate interests such as platform security, protect vital interests, perform a task in the public interest, or act on consent. Consent may be withdrawn where it is the applicable basis.

Sharing and international processing

We disclose only what is reasonably necessary to service providers such as hosting, storage, email, payment, security, media-processing, and monitoring providers; to instructors where required to deliver a course; and to authorities where legally required. Providers must be subject to appropriate contractual and security controls. If data is processed outside Kenya, the operator must use safeguards required by applicable data-protection law.

Retention

We retain data only for as long as needed for the stated purpose, legal obligations, dispute resolution, security, and audit. Account deletion does not erase immutable financial, credential, fraud-prevention, or audit evidence when the operator must lawfully retain it; personal identifiers should be minimized or anonymized where feasible.

Your choices and rights

Subject to applicable law, you may ask to access, correct, object to or restrict processing of, port, or delete personal data, and may complain to the Office of the Data Protection Commissioner. Contact privacy@dafluma.com. We may verify identity before acting on a request.

Children

Dafluma is not intended for a child to create an account without the consent or authorization required by applicable law. Contact us if you believe a child supplied personal data without appropriate authorization.