Privacy policy
Who is responsible
KenyaStocks is a free information site about the Nairobi Securities Exchange, run from Kenya by one individual, who is the data controller under the Data Protection Act, 2019 and can be reached at hello@kenyastocks.co.ke.
There are no accounts, no sign-up and no newsletter. You can use every page without telling us who you are.
What is collected
The site collects as little as a public website can. In full:
- Server logs. Our hosting provider records the address of each request, the page asked for, the time, the browser type and the referring page. We read these only to find errors and abuse.
- Analytics. Page views are counted by Vercel Web Analytics, which sets no cookie and stores no persistent identifier; we see totals per page and per country, never a person.
- Google Analytics. Once Google Analytics 4 runs, it sets a first-party cookie in your browser to tell a returning visit from a new one, and reports the page, the referrer, the country, the device type and how long the page was open. It is used to see which pages are read and to link the site to Google Search Console. Advertising features and Google Signals are switched off, so nothing is used to build a profile of you or to target advertising.
- Advertising cookies. Once Google AdSense runs on the market and company pages, Google and its partners set cookies and read device identifiers to serve and measure ads (see Cookies and advertising). No other advertising network is used.
- Your theme choice. The light or dark setting is stored in your browser's local storage and is never sent to us.
- Email. If you write to us, we keep your message and address for as long as it takes to deal with it.
Why it is collected
- To serve the pages you ask for and keep the site running (legitimate interest in operating the service).
- To measure which pages are read so the site improves (legitimate interest; no profiling).
- To show and measure advertising that pays for the site (Google's processing rests on the consent it collects where the law requires it, otherwise on legitimate interest).
- To answer correction and takedown requests (performance of what you ask us to do).
Who receives it
- Vercel Inc. hosts the site and runs the analytics; it processes request logs on our behalf.
- Supabase Inc. hosts the database of prices, company facts and headlines. It holds no personal data about visitors.
- Google LLC provides advertising through AdSense and measurement through Google Analytics 4, and processes the cookie data described below under its own privacy policy.
- Our email provider stores the messages you send us.
No personal data is sold or shared with anyone else, and nothing is combined with data from other sites.
Transfers outside Kenya
The providers above run servers in the United States and Europe, so request logs and cookie data leave Kenya. Each provider is bound by contractual terms that require it to protect the data to a standard at least as high as the Act requires (section 48). Prices and headlines themselves are public information and are not personal data.
How long it is kept
- Request logs: kept by the hosting provider for a short rolling period measured in days, and not exported.
- Analytics: Vercel counts are aggregated only; the Google Analytics 4 measurement cookie and its reports are kept for the 14-month retention window Google allows, then deleted.
- Advertising cookies: set by Google for the periods Google states in its cookie documentation; you can clear them in your browser at any time.
- Email: deleted within twelve months of the matter being closed, unless a takedown record must be kept as evidence of compliance.
Security
Every page is served over HTTPS. There are no passwords to protect because there are no accounts. Access to the hosting, database and email is limited to the operator.
Your rights
Under section 26 of the Data Protection Act you have the right to be informed about how your data is used, to access it, to object to its processing, to have it corrected and to have it deleted. Because the site holds almost nothing that can be tied to you, most requests concern email you have sent us or the cookies Google set in your browser.
Write to hello@kenyastocks.co.ke. We answer within the period the Act allows. For cookies, the controls in the next section act immediately.
Registration with the Data Commissioner
KenyaStocks is exempt from registration as a data controller under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, because its annual turnover is under KES 5 million and it has fewer than ten employees. It will register with the Office of the Data Protection Commissioner when either threshold is met.
Complaints
If you believe your data has been handled wrongly, write to hello@kenyastocks.co.ke first so it can be put right. You also have the right to complain to the Office of the Data Protection Commissioner at any time.
Changes to this policy
This page carries the date of its last substantive change. A change that adds a new kind of data, a new recipient or a new purpose is announced on the About page before it takes effect.