This Privacy Policy explains how BCL Production ("we", "us", "our") collects, uses, and protects information when you use this website, including voting for contestants, tipping, entering campaigns, buying event tickets, and booking tours. We are based in Kenya and handle personal data in line with the Kenya Data Protection Act, 2019.
1. Information We Collect
We collect information you provide directly, and a small amount collected automatically:
- Account information — name, username, email address, and password (stored securely hashed, never in plain text) if you register an account.
- Payment information — your phone number and the resulting M-Pesa transaction details (amount, M-Pesa receipt number, transaction status) when you vote, tip, pay a campaign entry fee, or buy a ticket. We never see or store your M-Pesa PIN — that is entered directly on your phone and handled entirely by Safaricom.
- Contestant / event content — photos, bios, videos, and other material you submit when applying to a campaign or listing an event.
- Communications — messages you send us through the contact form, or messages/names you attach to a tip.
- Technical information — IP address and basic request metadata, used for security purposes such as detecting abusive or automated payment requests.
2. How We Use Your Information
- To process votes, tips, ticket purchases, and campaign entry payments via M-Pesa.
- To create and manage your account and contestant/event listings.
- To review and approve (or reject) campaign entries and event listings.
- To communicate with you about your account, applications, or payments.
- To detect and prevent fraud, abuse, and automated attacks on our payment endpoints (for example, rate limiting to stop excessive or harassing payment requests).
- To comply with legal and tax obligations.
3. Sharing Your Information
We do not sell your personal data. We share it only where necessary:
- Safaricom / M-Pesa (Daraja API) — your phone number and payment amount are sent to Safaricom to process each transaction. This is required to complete any M-Pesa payment.
- Public contestant/event profiles — information you choose to submit for a contestant profile or event listing (name, photo, bio) is displayed publicly as part of using the platform.
- Legal requirements — if required by law, court order, or to protect the rights, safety, or property of BCL Production or others.
4. Payment Security
All M-Pesa payments are processed through Safaricom's official Daraja API using STK Push. Your M-Pesa PIN is entered directly on your phone and is never transmitted to or stored by BCL Production. Transaction confirmations are verified directly with Safaricom before any vote, tip, ticket, or entry is credited.
5. Cookies
We use essential cookies only — for keeping you logged in (session) and protecting forms from cross-site request forgery (CSRF). We do not use third-party advertising or tracking cookies.
6. Data Retention
We retain account and transaction information for as long as your account is active, and afterward for as long as necessary to meet legal, tax, and dispute-resolution obligations.
7. Your Rights
Under the Kenya Data Protection Act, 2019, you have the right to access, correct, or request deletion of your personal data, object to certain processing, and request a copy of your data. To exercise any of these rights, please contact us.
8. Children's Privacy
This platform involves real financial transactions and is not directed at, or intended for use by, anyone under 18 years of age. We do not knowingly collect personal data from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.
10. Contact Us
Questions about this Privacy Policy or your data can be sent through our contact page.