Legal
Privacy Policy
Effective date: 14 September 2026
This policy explains what personal data Billiard Kenya (“we”, “us”) collects when you use this website, why, who helps us process it, and the choices you have. It is written to meet the Kenya Data Protection Act, 2019.
1. Who we are
Billiard Kenya runs www.billiardkenya.com and is the data controller for the personal data described here.
For anything about your data, email info@billiardkenya.com.
2. What we collect and why
Browsing halls, events and rules needs no account and no personal details. We collect data only when you use one of the features below.
| When you… | We collect | Why | Legal basis |
|---|---|---|---|
| Create a hall owner account | Name, email, a hashed password (or your Google account name and email if you sign in with Google), and the time you accepted this policy | To run your account and send account emails such as verification and password resets | Contract; consent |
| List a hall | Hall name, location, landmark, opening hours, prices, amenities, photos, and the contact details you choose to publish (phone, WhatsApp, email, website, social links) | To review and publish your listing. Contact details you enter are shown publicly on your hall page | Contract |
| Submit an event | Event details and the organiser contact details you enter | To review and publish the event | Contract |
| Order from the shop | Name, phone number, optional email, delivery area, landmark and notes | To confirm, deliver and support your order | Contract |
| Pay with M-Pesa | Phone number, amount, M-Pesa receipt number and payment status | To request payment and confirm it was received | Contract; legal obligation |
| Send an advertising or gear-selling request | Name, business name, email, phone and your message | To reply with a quote and set up your advert or listing | Consent; legitimate interests |
| Sign in or submit forms | IP address and browser type, kept with sessions and to limit repeated attempts | Security and abuse prevention | Legitimate interests |
Your location. If you tap the option to get directions from where you are, your browser asks permission and saves your approximate position on your own device only. It is not sent to our servers. When you open directions, Google Maps receives your start point to plan the route.
We do not use your data for automated decisions that have legal or similarly significant effects, and we do not sell personal data.
4. Who processes data for us
- Turso — hosts our database (accounts, listings, orders, requests).
- Amazon Web Services (S3, US East region) — stores photos and advert media you or our team upload. These files are publicly viewable once published.
- Vercel — hosts the website and provides cookie-free visit counts.
- Resend — sends account, order and request emails, so it receives the recipient's email address.
- Safaricom (M-Pesa Daraja) — receives your phone number and amount to send the payment prompt and confirm payment.
- Google — Google sign-in (if you choose it), embedded maps on hall pages, and AdSense ads (only with your consent).
- QR Server (api.qrserver.com) — generates the QR code image for a hall's page link. It receives only that public link.
Hall details, photos and the contact details owners choose to publish are public by design. Apart from that, we share personal data only with the providers above, when the law requires it, or to protect people from fraud or harm.
5. Data stored outside Kenya
Several of these providers store or process data outside Kenya, including in the United States. We use providers that offer contractual data-protection commitments, and we limit what each one receives to what it needs.
6. How long we keep data
We keep account, listing, event, order and payment records for as long as they are needed to run the service and meet accounting and legal duties. We do not yet delete these records automatically on a fixed schedule.
You can ask us to delete your account or other personal data at any time by emailing info@billiardkenya.com. We will delete it unless we must keep a record by law (for example, payment records needed for tax purposes), and we will tell you what we kept and why.
7. Your rights
Under the Kenya Data Protection Act you have the right to:
- Be informed about how your data is used (this policy).
- Access a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete. Hall owners can edit most details in their dashboard.
- Delete your data, subject to records we must keep by law.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, including for advertising cookies.
- Data portability — receive your data in a common, machine-readable format.
Email info@billiardkenya.com with the subject “Data rights request”. We may ask you to confirm your identity first.
8. Complaints
You can complain to the Office of the Data Protection Commissioner (ODPC): https://www.odpc.go.ke. We would appreciate the chance to fix the problem first, so please contact us too.
9. Security
Passwords are stored only as salted PBKDF2-SHA512 hashes, sign-in sessions are stored as hashed tokens, and all traffic uses HTTPS. We never see or store M-Pesa PINs; Safaricom handles the payment prompt.
10. Children
Owner accounts, the shop and advertising are for adults aged 18 and over. If you think a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
When we change this policy we will update the effective date above. For significant changes we will also email registered hall owners.
Questions?
Email info@billiardkenya.com or see our contact page.