01Who we are
NSE Radar is a research and learning service for the Nairobi Securities Exchange, run by the NSE Radar team of Kenya (“we”, “us”). We are the data controller for the personal data described here.
This policy explains what we collect, why, who we share it with and the rights you have under the Kenya Data Protection Act, 2019. Contact us about privacy at our support inbox.
02What we collect
| Data | Where it comes from |
|---|---|
| Your first and last name, email address and a unique account ID | You, when you create an account and sign in with a one-time email link. There is no password. |
| Your mobile number, if you add one | You, in Profile & settings. It is optional and used only to text you account reminders, such as before your free month or plan ends. |
| Notification subscriptions for your devices | Your browser, when you turn on notifications. They let us send alerts and account reminders to that device; turning notifications off removes them. |
| Scrambled (hashed) copies of your email address and IP address, kept for up to a day | Our service, to limit how many sign-in emails can be requested and stop abuse |
| Your settings: display name, start page, theme, ticker, hidden securities and rows per page | You, in Profile & settings |
| Your watchlist, holdings (company, number of shares, average cost) and alerts | You, when you add them |
| Notifications we create when your alerts are triggered | Our service |
| Your plan, free-trial dates and paid-until date | Our service |
| Payment records: reference, plan, amount, payment method, status, dates and, for M-Pesa, a masked phone number | You and the payment provider. We never receive your card number, card security code or M-Pesa PIN. |
| Security and activity records, such as checkouts, trial starts and administrator changes | Our service |
| Technical data such as IP address, browser and request times | Your device, recorded by our hosting provider’s logs |
We do not knowingly collect sensitive personal data, and we ask you not to enter any into the service.
03How we use it and why
- To provide the service you sign up for: your workspace, watchlist, portfolio values, alerts and settings. Lawful basis: performance of our contract with you.
- To take payments and manage subscriptions, including free trials, receipts and refunds. Lawful basis: contract, and our legal obligations for financial records.
- To keep the service secure, prevent fraud and abuse, and investigate problems. Lawful basis: our legitimate interests.
- To tell you about your account, such as alerts you set, payment confirmations and important changes. Lawful basis: contract.
- To meet legal obligations, such as tax and accounting records or lawful requests from authorities.
We do not sell your personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.
04Cookies and device storage
We use only what the service needs to work. There are no advertising or analytics cookies.
- Sign-in cookies, which keep you signed in and complete email-link sign-in securely.
- Browser storage on your device for your theme, start page and Learning centre progress, so pages open the way you left them.
- Offline copy of the app’s basic files and an offline page, stored by the installable app so it opens without a connection. It does not store your personal data.
You can clear these in your browser settings; you will need to sign in again.
06International transfers
Our providers may store or process data outside Kenya. Where they do, we rely on the safeguards the Kenya Data Protection Act allows, such as contractual protections and providers’ security commitments, and transfer only what is needed for the purposes above.
07How long we keep it
- Account, settings, watchlist, holdings and alerts: while your account is open. When you ask us to delete your account, we delete them within 30 days.
- Payment and subscription records: for as long as Kenyan tax and accounting law requires, currently at least five years after the transaction.
- Security and activity records: up to 12 months, unless needed longer to investigate a specific incident.
- Hosting logs: for the periods set by our hosting providers.
08How we protect it
Data is encrypted in transit, access to administration is limited to authorised staff, payment keys are held as server secrets rather than in the database, and card and wallet details are entered only on the payment provider’s own pages or your phone. No system is perfectly secure; if a breach affects your personal data in a way that risks harm to you, we will notify you and the Data Commissioner as the law requires.
09Your rights
Under the Kenya Data Protection Act you have the right to:
- be told how your personal data is used, as in this policy;
- access the personal data we hold about you;
- have inaccurate or misleading data corrected;
- have data deleted where we no longer have a lawful reason to keep it;
- object to processing, including any direct marketing;
- receive your data in a portable format.
You can change most of your data yourself in Profile & settings, your watchlist, portfolio and alerts. For anything else, email our support inbox. We will respond within the time the law allows and may need to confirm your identity first.
If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
10Children
NSE Radar is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
11Changes to this policy
We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.