Picky Planner Privacy Policy

1. Introduction and Data Controller Information

Picky Planner (“we,” “our,” or “us”) operates an event planning marketplace platform that connects customers seeking event services with verified vendors in Kenya. We are committed to protecting your privacy and personal data in accordance with the Kenya Data Protection Act 2019, GDPR (where applicable), and international best practices.

Data Controller: Picky Planner Limited
Registered office: Nairobi, Kenya
Contact: privacy@pickyplanners.com
Data Protection Officer: dpo@pickyplanners.com

If you believe your privacy rights have been infringed, you may complain to the Office of the Data Protection Commissioner, P.O. Box 30920-00100, Nairobi (complaints@odpc.go.ke).

2. Legal Basis for Processing

We process your personal data based on the following legal grounds under the Kenya Data Protection Act 2019 and GDPR:

3. Personal Data We Collect

3.1 Customer Data

3.2 Vendor Data

3.3 Technical Data

3.4 Sensitive Personal Data

Some information we collect is sensitive personal data under the Kenya Data Protection Act 2019, including biometric data (a facial image and liveness data) and national identification details used to verify identity, and business-registration details used to verify vendors. We process such data only where you have given your explicit consent, and solely for the specific purposes of identity and business verification, fraud prevention, and compliance with legal and regulatory obligations. You may withdraw your consent, subject to the limitation that we may be unable to verify your account or provide certain services without it, and subject to our legal retention obligations.

4. How We Use Your Data

5. Third-Party Data Sharing

We share your data with the following categories of third parties only as necessary for our services:

We engage these providers under contracts that require them to protect your data and to process it only on our instructions. The providers we currently use are named in section 6. If you would like more detail about any of them, contact our Data Protection Officer.

Identity verification and biometric data. Vendors must verify their identity before their listing goes live. This is carried out by Smile Identity on their own hosted page: you photograph a government-issued ID and take a live photograph of your face. Images captured through Smile Identity stay with that provider; we do not download those images into Picky Planner. If you choose manual document review instead, you upload identity and business evidence directly to our private storage for authorized staff to review. For the Smile-hosted flow, we retain verification results and encrypted structured identity details returned by Smile Identity, but do not download the ID or face images. For manual review, we retain uploaded evidence while the application and review are unresolved. After a review decision or application closure, original files are deleted after 90 days, measured from the later of closure and the last review update, unless a specific retention hold applies. Abandoned drafts on open applications are deleted after 30 days without activity. Because this involves biometric data, we ask for your explicit consent before the check begins, and we record that consent. You can decline automated biometric processing and request manual review. Identity and applicable business checks must still be completed before your listing goes live.

Vendor-Customer Data Sharing: We facilitate limited data sharing between vendors and customers for legitimate business purposes (contact information, event requirements, booking details). Where you choose to share your event details or documents with a vendor, we record your consent, including which fields you shared and the date and time.

6. Where Your Data Is Stored, and International Transfers

Data location: All personal data we collect is stored and processed on Google Cloud infrastructure in the us-central1 region (Council Bluffs, Iowa, United States). This includes our database, uploaded documents, and the backend services that run the Platform. We do not operate any database or file storage located within Kenya.

Kenyan law permits the transfer of personal data outside Kenya where specific conditions are met. Our transfers to the United States rely on the following grounds under sections 48 and 49 of the Data Protection Act, 2019:

Our other service providers are located as follows: Smile Identity (identity verification) in the United States and Kenya; Twilio (SMS verification) and Resend (transactional email) in the United States; and Safaricom (M-Pesa payment processing) in Kenya.

7. Data Retention

We keep data for as long as set out below. Where a period is not fixed, we say so rather than quoting a number we do not apply.

8. Your Rights

Under the Kenya Data Protection Act 2019 and GDPR, you have the following rights:

How to exercise them. Email privacy@pickyplanners.com or dpo@pickyplanners.com. We will respond within 30 days (7 days for access requests, as required by Kenyan law).

We want to be straightforward about how this works in practice. There is currently no self-service button in the Platform for downloading your data or deleting your account. Access, portability and erasure requests are handled by a person, on request, at the addresses above. We would rather tell you that than imply an automated process that does not exist.

What deletion actually does. When we action an erasure request we delete your profile, your events and everything filed under them (documents, payment schedules and vendor links), any event details you shared with vendors, your booking enquiries, notifications, vendor application and public listing, and your uploaded files. Your published reviews are kept but anonymised. Payment records, identity verification outcomes and records of consent are kept for the periods set out in section 7 — we are required or entitled to retain these, and we will tell you which ones applied to your request.

9. Data Security

10. Cookies and Tracking

We use essential cookies for platform functionality and optional cookies for analytics and personalization. You can manage cookie preferences through your browser settings or our cookie consent manager.

11. Children's Privacy

Our services are for people aged 18 and over. When you complete your profile you are asked to confirm that you are 18 or older, and we record that confirmation. We do not otherwise verify age, and we do not knowingly collect personal data from anyone under 18. If we become aware that we hold data about a minor, we will delete it.

12. Automated Decision-Making and Artificial Intelligence

We use automated systems and algorithms — and may use artificial intelligence — to operate and improve the Platform, including to match and rank vendors, recommend services, generate or estimate quotes, detect and prevent fraud and abuse, and moderate content. These automated outputs are provided to assist you and may be inaccurate or incomplete; they are not a substitute for your own judgement.

We may also offer AI-assisted planning tools and assistants for customers, and AI-assisted tools that help vendors serve customers (for example, to prepare quotes, draft messages and listings, and manage their services). When you use these features, the information and prompts you provide, together with relevant account, event, and listing data, may be processed by us and by third-party AI providers to generate suggestions, responses, and content. We use this information to provide and improve the feature; we retain it in line with Section 7 (Data Retention); and we do not use your personal data to train third-party artificial-intelligence models except with your consent. Please do not enter sensitive information into these features unless it is necessary, and do not submit other people's personal data without their consent.

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing without human involvement. Where any such decision would be based solely on automated processing, you have the right to request human review, to express your point of view, and to contest the decision. Where AI-assisted features are provided by third parties, your inputs may be processed by those providers under their terms. We do not use your personal data to train third-party artificial-intelligence models except with your consent or as otherwise described in this Policy. To exercise your rights in relation to automated decision-making, contact us at privacy@pickyplanners.com.

13. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or applicable laws. We will notify users of material changes via email and platform notifications 30 days before implementation.

14. Contact Information

For privacy-related questions, requests, or complaints: