Privacy policy.

Board.Africa is provided by Datacare Limited, a company registered in Kenya and registered with the Office of the Data Protection Commissioner. We are responsible for the personal data described in this policy. You can reach us about anything in it at ops@board.africa.

Where we decide how data is used, we are the data controller. That covers your account, your director-search profile, event registrations, enquiries and demo requests, payments to us, and this website.

Where an organisation uses Board.Africa to run its board, the organisation is the controller and we are its processor. That covers everything the organisation puts in: meetings, papers, minutes, resolutions, registers of directors and interests, evaluations and the like. We handle it only on the organisation’s instructions and under our terms. If your question is about your information in an organisation’s records, ask that organisation first; we will help it answer.

• Account details: your name, email address, the organisations you belong to and your role in each, and, if you add them, your phone number and photograph.
• Director-search profile: the experience, qualifications, sectors and markets you choose to add, and whether boards can see your profile.
• Board records: what your organisation puts into Board.Africa, which may include personal data about directors and others, such as their positions, declared interests and attendance.
• Security and activity records: sign-in events, two-step sign-in settings, the device and browser you use, IP address, and an audit trail of actions such as approving minutes or declaring a record.
• Payments: for M-Pesa, the phone number and transaction reference; for invoices, the billing name and email. We do not store card numbers.
• What you tell us: enquiries, event registrations, demo requests and support messages.
• Website use: if you agree to analytics cookies, how the public website is used (pages visited, device type, approximate location). See section 10.

• To provide Board.Africa: creating and securing your account, running your organisation’s board, sending invitations, notices and reminders. Because it is necessary for our contract with you or your organisation.
• To keep it secure: two-step sign-in, detecting misuse, audit trails, rate limits. Our legitimate interest in a secure service, and legal obligations.
• To answer you: enquiries, demo requests, support. Your request, and our legitimate interest in replying.
• To take payment and keep accounts. Our contract with you, and tax and accounting law.
• To improve the website with analytics. Only with your consent, which you can withdraw at any time.
• To tell you about events and courses. Only with your consent, or where the law allows for existing customers; every email lets you stop them.

We do not sell personal data. We share it only with the service providers who help us run Board.Africa, under contracts that require them to protect it:

Within an organisation, people see board records according to the role the organisation gives them. We also share data where the law requires it, to protect our rights or others’ safety, with our professional advisers under confidentiality, and with a buyer if Board.Africa is sold, who must honour this policy.

Our database and files are stored in the European Union, and some providers above process data in other countries. We transfer personal data out of Kenya only as the Data Protection Act 2019 allows, with appropriate safeguards such as contractual protections, and we choose providers with strong security.

• Account details: while your account is open, and deleted or anonymised within 90 days after it is closed, unless the law requires us to keep them longer.
• Board records: for as long as the organisation’s subscription runs, following its own retention schedules and legal holds. After it ends, the organisation has 30 days to export them; we then delete or anonymise them within 90 days.
• Payment and accounting records: as long as tax and company law require.
• Security records: as long as needed to protect the service and investigate incidents.
• Backups: removed as each backup expires in the normal cycle.

• Data is encrypted in transit (TLS) and at rest (AES-256, by our hosting provider).
• Access to every board record is checked by the database for each person and role, including committee walls and confidential and in-camera items.
• Two-step sign-in with an authenticator app is available to every user, with recovery codes.
• Our own staff access customer data only when needed to support or secure the service.

No system is perfectly secure. If a breach puts personal data at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, tell affected organisations without undue delay, and tell affected people where the law requires.

Under the Kenya Data Protection Act 2019, and similar laws where they apply to you (such as Nigeria’s NDPA and South Africa’s POPIA), you have the right to:

• be told how your personal data is used, and see the data we hold about you;
• have inaccurate or misleading data corrected;
• have your data deleted, where we no longer need it or have no lawful reason to keep it;
• object to its use, including for direct marketing, and withdraw consent at any time;
• receive your data in a portable form.

Write to ops@board.africa. We may need to confirm who you are, and we will answer within the time the law sets. Some records must be kept, for example minutes and registers a company is required to keep, so a request may be limited by law. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Needed to run the site: cookies that keep you signed in, remember which organisation you are working in, and remember your light or dark appearance. These do not need consent.

Analytics: Google Analytics cookies, used on the public website only, never inside the board portal, and only if you agree when asked. You can change your choice here:

We do not use advertising cookies.

AI features are off until an organisation switches them on. When they are on, the text needed for a task (for example a paper to summarise) is sent to our AI provider to produce a result; under its API terms, that provider does not use it to train its models. Director search may suggest candidates for a position; a person always decides. We do not make decisions with legal or similarly significant effects about you by automated means alone.

Board.Africa is for adults. We do not knowingly collect data from anyone under 18.

We will post any changes here with a new date, and tell account holders by email or in Board.Africa before a change that materially affects them takes effect.

Datacare Limited, Kenya. Email ops@board.africa with any question about this policy or your data.