Privacy Policy
Last updated 1 August 2026
Ololapopo & Company ("we", "us") operates BuildFlow by Ololapopo. This policy explains what personal data we collect, why we collect it, and the controls that apply to it. It is written to align with the Kenyan Data Protection Act, 2019.
Data we collect
- Contact and enquiry data: name, phone number, email address, location and the answers you give in a request, consultation, plan order, materials quotation or workforce request.
- Account data: sign-in credentials managed by our authentication provider, and the role assigned to your account.
- Provider and merchant data: qualifications, experience, service areas and verification documents uploaded during onboarding.
- Transaction data: order and payment references, amounts, payment method and confirmation status.
- Technical data: device, browser and log information generated when you use the platform.
Why we use it
- To qualify, price, assign and deliver the services you request.
- To verify the identity, competence and eligibility of providers and merchants.
- To process and reconcile payments and to issue receipts and records.
- To communicate about your requests, and to keep an operational audit record.
- To meet legal, tax, regulatory and dispute-resolution obligations.
How we protect it
- Records are held in an access-controlled database with row-level security rules that limit each account to the records it is entitled to see.
- Identity, licence, financial and verification documents are stored in private storage and are never served from public URLs. Access is granted only through short-lived signed links issued to authorised staff.
- Anonymous visitors may submit a request but cannot read stored records.
- Notification emails and WhatsApp messages are alerts only. They never contain identity documents, financial details or sensitive project content.
Sharing
- We share only the minimum information needed to deliver a service: for example, a merchant assigned to a quotation sees the items, quantity and delivery area for that request.
- We do not sell personal data. We may disclose data where required by law or to establish, exercise or defend a legal claim.
Retention
- Enquiry, order, project and payment records are retained for as long as needed for the engagement and for the statutory retention periods that apply afterwards.
- Verification documents are retained for the duration of a provider or merchant relationship and for a reasonable period after it ends.
Your rights
- You may request access to, correction of, or deletion of your personal data, object to certain processing, and withdraw consent where processing is based on consent.
- Deletion requests are subject to records we must keep by law or for an active engagement.
- Written notice may be sent to Ololapopo & Company through the contact channels published on this platform.