1. Introduction
Votrack Inc. ("Votrack", "we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Votrack election vote tracking platform and related services ("Services").
Votrack is registered with Kenya's Office of the Data Protection Commissioner (ODPC) as both a data controller and a data processor under the Data Protection Act, 2019 (the "Act").
2. Legal Basis for Processing
We process personal data under the following legal bases as provided under the Data Protection Act, 2019:
- Consent — Where you have given explicit consent for processing (e.g., agent registration, Telegram bot verification)
- Contract — Where processing is necessary for the performance of our service agreement with you
- Legitimate Interest — Where processing is necessary for our legitimate business interests (e.g., platform security, fraud prevention, service improvement)
- Legal Obligation — Where processing is required by law (e.g., election observation compliance, data protection requirements)
3. Categories of Personal Data Collected
We collect and process the following categories of personal data:
3.1 Account Holder Data
- Full name, organization/campaign name
- Email address and phone number
- Electoral position and geographic scope
3.2 Polling Agent Data
- Full name
- Phone number (used for USSD and Telegram authentication)
- National ID number (used for identity verification)
- Assigned polling station
- Telegram username and chat ID (if using Telegram bot)
- Passport-size photo (if uploaded for badge generation)
3.3 Election Data
- Vote tallies submitted per candidate per polling station
- Station lifecycle events (opened, closed, counting started/completed)
- Agent attendance records (arrival and departure times)
- Form 34A photographs
- Incident reports with descriptions and photo evidence
3.4 Technical Data
- IP address, browser type and version
- Device information, operating system
- Login timestamps and session data
- USSD session identifiers and phone numbers
- Cookies and tracking identifiers (Google Analytics, Hotjar)
3.5 Usage Data
- Features used and actions taken within the platform
- Page views and navigation patterns
- Submission channel used (web, USSD, Telegram)
- Error logs and performance data
4. How We Use Personal Data
- To authenticate agents via phone number, ID verification, and Telegram
- To provide the vote tallying and election tracking services
- To assign agents to polling stations and track their attendance
- To generate agent badges with QR codes
- To send notifications via SMS, USSD, or Telegram
- To maintain audit trails of all data submissions and modifications
- To produce court-ready data archives when requested
- To improve the platform and resolve technical issues
- To comply with applicable laws and regulations
5. Data Sharing
We do not sell personal data. We may share data with:
- USSD service providers — Phone numbers and session data for USSD result submission
- Telegram — Chat IDs and usernames for Telegram bot functionality
- SMS gateway providers — Phone numbers for OTP and notification delivery
- Analytics providers (Google Analytics, Hotjar) — Anonymized usage and interaction data for platform improvement
- Cloud infrastructure providers — Data is stored on secure servers
- Legal authorities — When required by court order or legal obligation
6. Data Isolation
Each Votrack subscriber operates on an isolated database. Your election data, agent information, and all submitted results are never shared with or accessible to other subscribers. This database-level isolation ensures complete data separation between campaigns.
7. Data Retention
- Election data — Retained for 5 years after the election cycle to support legal proceedings and historical analysis
- Agent personal data — Retained for the duration of the subscription plus 12 months, unless a longer retention period is required by law
- Audit logs — Retained for 7 years to support legal and compliance requirements
- Technical logs — Retained for 90 days for security and troubleshooting purposes
8. Data Security
We implement appropriate technical and organizational measures to protect personal data, including:
- Database isolation per tenant (separate database per subscriber)
- Role-based access control with fine-grained permissions
- OTP verification for sensitive operations
- Encrypted data transmission (TLS/SSL)
- Comprehensive audit logging of all actions
- Authentication logging (login/logout events, IP addresses, user agents)
- Session timeout and idle detection
- USSD request signature validation and rate limiting
- Telegram identity verification (last 4 digits of ID number)
- Maximum 3 failed identity verification attempts before lockout
9. Data Subject Rights
Under the Data Protection Act, 2019, you have the right to:
- Access — Request a copy of your personal data
- Rectification — Request correction of inaccurate data
- Erasure — Request deletion of your data (subject to legal retention requirements)
- Restriction — Request limitation of processing
- Portability — Request data in a structured, machine-readable format
- Objection — Object to processing based on legitimate interest
To exercise these rights, contact us at privacy@votrack.co.ke. We will respond within 30 days.
10. International Data Transfers
Your data is primarily stored and processed in Kenya. Where data is transferred internationally (e.g., to cloud infrastructure providers), we ensure appropriate safeguards are in place as required by the Data Protection Act, 2019.
11. Children's Privacy
The Services are not intended for use by persons under the age of 18. We do not knowingly collect personal data from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the platform.
13. Contact & ODPC Registration
For privacy inquiries or to exercise your data protection rights:
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):
Last updated: March 2026