Privacy Policy

1. Who we are

Jikoni Space is a creative coworking and event space operated by Saracen Marketing Group Limited, a company incorporated in Kenya (hereinafter "Jikoni", "we", "us", or "our"). Our principal place of business is Ideas House, Off Kabarsiran Avenue, Lavington, Nairobi, Kenya.

We are the data controller of the personal information described in this policy. We are registered with the Office of the Data Protection Commissioner (ODPC) of Kenya in accordance with the Data Protection Act, 2019 (Cap. 411C of the Laws of Kenya).

Questions about this policy or our data practices may be directed to: jikoni@saracen-media.com .

2. Personal data we collect

We collect personal data only to the extent necessary to provide our services. The categories we collect are:

3. How and why we process your data

Under the Data Protection Act, 2019, we process personal data only where we have a lawful basis. The table below sets out our purposes and the corresponding legal ground for each.

4. Who we share your data with

We do not sell personal data. We share personal data only in the following circumstances:

• Payment processors. We share booking and payment reference data with our payment service partners (including mobile money operators) solely to process transactions you initiate.
• Service providers. We engage third-party providers for email delivery, website hosting, and data storage. These providers act as data processors on our behalf under binding contractual terms and may not use your data for their own purposes.
• Legal and regulatory authorities. We may disclose personal data where required by Kenyan law, court order, or lawful request from a competent authority, including the ODPC.
• Business transfers. If Saracen Marketing Group Limited is involved in a merger, acquisition, or sale of assets, personal data held by Jikoni may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5. International data transfers

We primarily store and process your data within Kenya. Where we use service providers based outside Kenya (for example, cloud hosting infrastructure), we ensure that appropriate safeguards are in place consistent with the requirements of the Data Protection Act, 2019, including contractual clauses that require those providers to protect your data to a standard equivalent to that required under Kenyan law.

6. How long we keep your data

We retain personal data for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

• Account data — for the duration of your active account, plus 3 years after you close your account or your last booking, whichever is later.
• KYC documents and identity data — 5 years from the date of collection, in compliance with our legal obligations.
• Booking records — 5 years from the date of the booking, for tax and accounting purposes under the Income Tax Act.
• Payment records — 7 years, consistent with accounting and tax record-keeping obligations under Kenyan law.
• Technical and log data — 90 days, after which it is deleted or anonymised.
• Marketing consent records — until you withdraw consent, plus 1 year to evidence that consent was obtained.

When data is no longer required, we delete it securely or anonymise it so that it can no longer identify you.

7. How we protect your data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include encrypted connections (HTTPS/TLS) for all data in transit, access controls limiting data access to authorised personnel who need it for their duties, secure password hashing, and regular reviews of our security practices.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ODPC within 72 hours of becoming aware of the breach and will notify you directly where the breach is likely to result in a high risk to you, without undue delay.

8. Cookies and similar technologies

We use session cookies that are strictly necessary for the website to function. These cookies maintain your login state and protect against cross-site request forgery. They are deleted when you close your browser or log out.

We do not currently use analytics, advertising, or tracking cookies. If we introduce any non-essential cookies in the future, we will update this policy and seek your consent before placing them.

9. Your rights under the Data Protection Act, 2019

As a data subject, you have the following rights. To exercise any of them, contact us at jikoni@saracen-media.com and we will respond within 21 days.

10. Children's privacy

Our services are not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us and we will delete it promptly.

11. Links to third-party websites

Our website may contain links to external websites operated by third parties. This policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where the changes significantly affect your rights, notify you by email. Your continued use of our services after the effective date of a revised policy constitutes your acceptance of that policy.