Privacy Policy

1. Introduction

Spot The Plug KE respects your privacy and processes personal data responsibly in connection with promotional campaigns, brand engagement, reward delivery, analytics, and platform operations.

This Privacy Policy explains what data we collect, how we use it, who we share it with, and what rights you have under the Kenya Data Protection Act and applicable law. By using the platform or participating in a campaign, you agree to the practices described here.

2. Data We Collect

We may collect the following categories of personal data depending on how you interact with the platform:

3. How We Collect Data

We collect data through the following channels:

• When you comment on a campaign post linked to our platform
• When you interact with campaign pages or the Spot The Plug KE scoreboard
• When you respond to a winner or vault notification by DM
• When you submit contact or payout details to claim a reward
• When a brand creates, configures, or manages a campaign
• Through cookies and analytics tools when you visit our website or dashboard
• Via Instagram and other social platform APIs where authorised

4. How We Use Your Data

We use personal data to:

• Set up and run campaigns according to published rules
• Verify campaign entries and apply eligibility checks
• Select winners or vault recipients based on campaign configuration
• Deliver rewards, vouchers, discount codes, and vault offers
• Process M-PESA payouts and verify payout details
• Prevent fraud, spam, duplicate entries, and rule violations
• Provide brands with campaign analytics and performance reports
• Improve platform features, AI processing, and moderation accuracy
• Comply with legal obligations and respond to regulatory requests
• Generate and maintain public audit trails for completed campaigns

5. Legal Basis for Processing

We process personal data on the following legal bases under the Kenya Data Protection Act:

6. Who We Share Data With

We do not sell personal data. We may share relevant data with:

• The campaign brand — for winner verification, vault delivery, and reward fulfilment
• Payment providers such as Safaricom M-PESA for payout processing
• Hosting, infrastructure, and analytics service providers
• AI processing and moderation providers
• Legal or regulatory authorities where required by law

All third parties we engage are required to handle personal data responsibly and only for the purposes for which it was shared.

7. Marketing Messages

We do not send unsolicited marketing messages. Promotional or campaign-related messages are sent only where:

• You have interacted with a campaign post and are eligible for a notification
• You are a selected winner or vault recipient for an active campaign
• You have explicitly consented to receive communications from us or a brand

You may opt out of promotional messages at any time by replying STOP to any DM or contacting us at privacy@spottheplug.co.ke.

8. Data Retention

We retain personal data for as long as necessary for the following purposes:

• Campaign administration and winner verification — for the duration of the campaign plus a reasonable post-campaign window
• Audit trail and fraud prevention records — as required by applicable law
• Tax, accounting, and legal compliance — as required under Kenyan law
• Brand account records — for the duration of the brand relationship plus applicable statutory periods

Sensitive payout data such as M-PESA numbers is retained only as long as necessary and masked in audit-facing views.

9. Security

We apply reasonable technical and organisational measures to protect personal data, including:

• Role-based access controls on the platform and dashboard
• Encryption of sensitive data in transit and at rest
• Audit logs for winner selection, payout processing, and data access
• Regular review of third-party service provider security practices

No system is completely secure. If you believe your data has been compromised, contact us immediately at privacy@spottheplug.co.ke.

10. Your Rights

Under the Kenya Data Protection Act, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to legal retention requirements
• Object to or restrict processing in certain circumstances
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

To exercise any of these rights, contact us at privacy@spottheplug.co.ke. We will respond within the timeframes required by applicable law.

11. Cookies & Analytics

Our website and dashboard use cookies and analytics tools to understand how users interact with the platform. This may include session data, device type, browser, referring page, and page interaction data.

You can control cookie preferences through your browser settings. Disabling cookies may affect some platform features.

12. Social Platform Disclaimer

Campaigns on Spot The Plug KE use Instagram and other social platforms as the entry channel. By participating, you acknowledge that:

• Campaigns are not sponsored, endorsed, administered by, or associated with Instagram, Meta, TikTok, or any other social platform unless expressly stated
• Your public profile and comments on those platforms are subject to their own terms and privacy policies
• We access public comment data only as permitted by the relevant platform API terms

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. Material changes will be communicated via the platform or by email where we hold your contact details.

The current version was last updated on May 27, 2026. Continued use of the platform after any update constitutes acceptance of the revised policy.

14. Contact

For privacy requests, questions, or complaints, contact our Privacy team: