Privacy Policy

1. Who this policy covers

Barazas is operated by Mydora Consultants Limited, a company registered in the Republic of Kenya. In this policy, "we" means that company.

This policy explains how we handle personal data for two groups: people who work for a client organization (organization admins and staff using the Barazas portal), and event attendees and delegates registered by a client organization through Barazas.

Which of the two roles we are in

The distinction matters, because it decides who you ask about your data and who answers for it.

For attendee and delegate data, we are a processor. The client organization running the event is the controller: it decides to hold the event, who to invite, what to ask them, and how long to keep the answers. We store and process that data on its documented instructions, and for no purpose of our own. We do not decide what an event collects, we do not contact its delegates on our own initiative, and we do not use delegate data to market anything, ours or anyone else's.

For client account data, we are the controller. That means the accounts of organization admins and staff, billing and subscription records, messages sent to us through the contact form, and the measurement described in section 8. Those are our own business records and we decide how they are handled.

If you are a delegate and want your data corrected or deleted, ask the organization that registered you. They hold the relationship and the decision. Write to us at info@barazas.com if you cannot reach them or do not know who they are, and we will put you in touch or pass the request on; we will not act on it ourselves without their instruction, because acting on it would mean altering their records on someone else's say-so.

Mydora Consultants Limited is registered with the Office of the Data Protection Commissioner of Kenya as a data processor, registration 389-218F-83A5.

2. What we collect

Organization users: name, email, role, and login activity.

Attendees: name, email, phone, delegation/organization, country, role/title, and any photo-usage consent choice, whatever the client organization enters when registering them, plus check-in timestamps when applicable.

3. How we use it

To operate the Service: authenticating users, sending registration/consent/reminder/check-in emails on an organization's behalf, generating badges and QR codes, and producing the reports an organization requests about its own event. We don't sell personal data or use it to serve ads.

4. Who we share it with

We use a small number of service providers to operate Barazas, for hosting, payment processing, audience measurement on our public pages, and the optional AI import. Each receives only the data it needs to perform its function, is bound to use it solely on our instructions, and may not use it for its own purposes. Those that hold data outside Kenya are named in section 8.

We do not sell personal data, and we do not share it with advertisers or data brokers.

5. Cookies and sessions

Barazas uses a session cookie to keep you signed in to the portal. Nothing in the portal or the administration area goes beyond what is required to operate the Service.

On our public pages, meaning the marketing site and public event pages, we use Google Tag Manager for audience measurement, and it may set measurement cookies. We switch Google's advertising features off on those pages, so nothing collected there is used for advertising or to build a profile of you. We set no advertising cookies anywhere on the Service.

6. Data retention

Account and attendee data is kept in active form for 24 months from the end of the event it relates to. After that period it is moved to archive storage, which is retained indefinitely so past events remain auditable and so tax, accounting and legal obligations can be met.

Archived data is not used to run the Service, does not appear in the portal, and is accessible only to authorised staff.

For attendee data, this period is the default we apply on the client organization's behalf. The organization may instruct us to delete sooner, and deletion requests from attendees are decided by that organization rather than by us.

For client account data, where we are the controller, you can ask us directly to delete sooner or to remove data from the archive, using the contact details below. We will do so unless the law requires us to keep it.

7. Your rights

Depending on where you're located, you may have the right to access, correct, or request deletion of your personal data. Attendees should start by contacting the organization that registered them, since they control that data; organization users can contact us directly using the details below.

8. International transfers

Barazas is operated from Kenya, but the data it holds is stored and processed outside Kenya. Our hosting, databases, file storage and outbound email run on Amazon Web Services infrastructure in the United States (the us-west-2 region, Oregon). Paystack processes payments from its own infrastructure, and documents uploaded to the optional AI import feature are processed by Anthropic in the United States.

This means personal data you or your attendees provide is transferred outside Kenya. We rely on the contractual protections in our agreements with each of these providers, which bind them to process the data only on our instructions and to maintain appropriate security. If you would rather your data were not transferred in this way, do not use the Service, and contact us if you have already submitted data and want it removed.

9. Changes to this policy

We may update this policy from time to time; we'll update the "last updated" date above when we do.

10. Contact

Questions about this policy or your data? Write to us at info@barazas.com. For questions about personal data specifically, that address also reaches our data protection contact.

Mydora Consultants Limited, 48 Mbabane Road off James Gichuru, P.O. Box 1267-00621, Nairobi, Kenya.