Effective date: 16/04/2025

1. Introduction

Credit Check Online (“we”, “us”, “our”) respects your privacy and is committed to protecting personal data. This Privacy & Data Handling statement explains what personal data we collect, why we collect it, how we use and protect it, your rights, and how to contact us. We operate in Kenya and follow applicable data protection rules including the Kenya Data Protection Act, 2019. Data Protection Office+1

2. Controller / Contact

Data controller: Credit Check Online
Contact email: support@creditcheckonline.co.ke

If you have privacy questions or want to exercise your data rights, contact us at the email above.

3. What personal data we collect

We collect only the personal data needed to provide our services and to communicate with you. This may include:

• Identity data: full name, date of birth (if provided), ID/passport number (when required for processing).

• Contact data: phone number, WhatsApp number, email address, postal address (if provided).

• Transaction data: payment confirmation, invoices, service selected.

• Service data: details you provide about your CRB request, employer authorization, and supporting documents you upload.

• Technical and usage data: IP address, browser type, device type, referring URL, and cookies (see Cookies section).

• Marketing & analytics data: interactions with our ads and communications if you consent to those uses.

We do not collect more data than necessary for the stated purpose.

4. Why we collect your data (purposes) & legal basis

We process personal data for the following primary purposes:

• To provide CRB checks, clearance certificate facilitation and related services (performance of a contract / service you request).

• To verify your identity with official verification channels and, where needed, with government or registry partners (legal obligation / legitimate interest as required to process the request).

• To communicate with you about your request (consent / contract).

• For payments, billing and fraud prevention (contractual necessity / legal obligation).

• For customer service and support (legitimate interest).

• To comply with legal or regulatory obligations (e.g., requests from official authorities).

• For analytics, performance, and advertising (only with your consent where required by law or platforms such as Google Ads). Google Help+1

If you provide consent for marketing or personalization (for example via cookies or opt-in forms), you may withdraw that consent at any time.

5. Who we share your data with

We share personal data only in the ways described below and only to the extent necessary:

• Official verification channels / CRB or government agencies — to obtain your CRB status or clearance.

• Payment processors — to process your payments (M-Pesa, banks, or payment gateways).

• Service providers — for hosting, email delivery, analytics, and call-tracking providers (e.g., Google Analytics, Google Ads). We require vendors to protect data and only process it under our instructions. Google Policies

• Legal & regulatory authorities — if required by law, court order, or to prevent fraud.

• Business transfers — in the event of a merger, sale, or reorganization, personal data may be transferred as part of the transaction subject to confidentiality protections.

We do not sell personal data to third parties.

6. Cookies, tracking & ads

We use cookies and similar technologies to operate the site and analyse usage. If you came from a Google Ad, we may use Google Ads features (including call forwarding numbers and conversion tracking) — these features may store cookies and other identifiers in accordance with Google’s policies. You may manage cookie preferences via our cookie banner and your browser settings. See Google’s privacy documentation for details on how they process ad data. Google Help+1

7. How long we keep your data (retention)

We retain personal data only as long as necessary for the purpose collected, including to:

• complete the service you requested,

• respond to questions or complaints,

• comply with legal requirements (for example tax or record-keeping laws).

Typical retention periods: service records and transactional data — up to 7 years for accounting and legal compliance; support and lead records — 12–36 months unless you request deletion sooner. Adjust these retention periods to match your actual business policy and local legal advice.

8. Data security

We use reasonable technical and organizational measures to protect personal data, including encryption, access controls, secure hosting, and staff training. However, no system is 100% secure — if a breach occurs we will follow applicable legal obligations (including notifications to affected individuals and the Data Protection Commissioner where required). Data Protection Office

9. Your rights

Depending on applicable law you may have rights including:

• the right to access the personal data we hold about you;

• the right to correct inaccurate or incomplete data;

• the right to request deletion (subject to legal or contractual retention obligations);

• the right to restrict or object to processing in certain circumstances;

• the right to withdraw consent where processing is based on consent;

• the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya. For guidance on these rights see the ODPC resources. Data Protection Office

To exercise any of these rights, contact us at support@creditcheckonline.co.ke. We will respond within the timeframes required by law.

10. Minors

We do not knowingly collect personal data from children under 18. If you believe a minor has provided us personal data without consent, please contact us and we will take steps to remove the data.

11. International transfers

Some of our service providers (e.g., cloud hosting, analytics) may process data outside Kenya. Where transfers occur we use appropriate safeguards (contracts, standard contractual clauses with providers, or data processing agreements). Contact us for more information about safeguards in place.

12. Third-party links

Our site may contain links to third-party websites. We are not responsible for their privacy practices — read their privacy policies before using their services.

13. Limitation of liability & disclaimers

We make reasonable efforts to ensure the accuracy and security of our services and the lawful handling of data. However:

• We do not guarantee that the CRB result will lead to any particular outcome (e.g., loan approval or employer decisions). Any official clearance or certification is issued by the authorized issuing body, not by Credit Check Online.

• We are not responsible for decisions made by third parties (banks, employers, government bodies) based solely on a CRB result.

• We will not be liable for indirect, incidental, or consequential damages arising from use of our services except where prohibited by law.

• Nothing in this policy affects your statutory rights.

This limitation is intended to be reasonable and enforceable — it is not a statement that prevents liability for willful misconduct, gross negligence or obligations under applicable law.

14. Changes to this policy

We may update this Privacy & Data Handling page. We will post the updated policy with an updated “Effective date” and, where required, obtain consent for material changes.

15. How to contact us and complaints

For questions, to exercise your rights, or to complain contact:
Email: support@creditcheckonline.co.ke
If you remain dissatisfied you may contact the Office of the Data Protection Commissioner in Kenya. Relevant guidance and resources are available on the ODPC website. Data Protection Office