1. Introduction

Tumit Limited ("we", "us", or "our") operates the Sherehe Mezani platform ("Platform"). We are committed to protecting the personal data of our users in accordance with the Data Protection Act, 2019 (Kenya), the Kenya Information and Communications Act (Cap 411A), and any regulations issued thereunder.

By accessing or using the Platform you acknowledge that you have read, understood, and consent to the collection and use of your personal data as described in this Policy.

2. Data Controller

The data controller for purposes of this Policy is Tumit Limited, registered in Kenya. Queries regarding this Policy should be directed to: info@tumit.co.

3. Personal Data We Collect

We collect only the data necessary to provide our services:

• Identity data: full name
• Contact data: phone number and email address
• Payment data: M-Pesa transaction code (we do not store card details or PIN numbers)
• Event data: the event(s) you RSVP for and the date of registration
• Technical data: IP address, browser type, and device information collected automatically when you visit the Platform

We do not knowingly collect data from persons under the age of 18. If you believe a minor has submitted data on the Platform, contact us immediately at info@tumit.co.

4. Purpose and Legal Basis for Processing

We process your personal data for the following purposes, relying on the legal bases set out in Section 30 of the Data Protection Act, 2019:

5. Sharing of Personal Data

We may share your personal data with:

• Event organisers / businesses listed on the Platform, solely for admission and event management purposes
• Payment processors (including Safaricom M-Pesa) to verify and confirm payment
• Service providers who assist us in operating the Platform under strict confidentiality obligations
• Regulatory or law enforcement authorities where required by Kenyan law

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with our legal obligations under Kenyan law, including tax and financial record-keeping requirements. RSVP records are retained for a minimum of five (5) years after the event date. You may request earlier deletion subject to Section 7 below.

7. Your Rights Under the Data Protection Act, 2019

As a data subject under Kenyan law you have the right to:

• Be informed about the collection and use of your personal data
• Access your personal data held by us
• Request correction of inaccurate or incomplete data
• Object to or restrict processing in certain circumstances
• Request deletion of your personal data, subject to our legal retention obligations
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke

To exercise any of these rights, contact us at info@tumit.co. We will respond within 21 days as required by the Act.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, in accordance with the Computer Misuse and Cybercrimes Act, 2018. However, no method of transmission over the internet is completely secure and we cannot guarantee absolute security.

9. Cookies and Tracking

The Platform may use cookies and similar technologies to improve user experience and analyse traffic. You may disable cookies through your browser settings; however, certain features of the Platform may not function correctly if cookies are disabled.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified by posting a revised Policy on the Platform with an updated effective date. Continued use of the Platform after such changes constitutes acceptance of the revised Policy.

11. Governing Law

This Policy is governed by and construed in accordance with the laws of the Republic of Kenya. Any disputes arising out of this Policy shall be subject to the exclusive jurisdiction of the courts of Kenya.