Privacy notice
Draft for counsel. Values marked "to be confirmed" are not yet settled.
Updated 18 October 2026
Kuta Zetu is the national registration for visual artists under the Affordable Housing Programme. This notice says what we collect when you register, why, who can see it, how long we keep it, and what you can ask us to do. It follows the Kenya Data Protection Act 2019.
Who is responsible for your data: to be confirmed. The programme documents name the programme office as the likely data controller and Jabali Studio, which runs the platform, as the processor; government legal confirms this before the notice is final. Registration with the Office of the Data Protection Commissioner: to be confirmed.
What we collect, and why
| What | Why | Who can see it |
|---|---|---|
| Your name as on your national ID, your WhatsApp number, and your email if you give it | To identify you, reach you about your registration, and send copies of your certificates | You, reviewers and the programme office. Your public name only is shown to others |
| Gender, age group, and whether you live with a disability (optional) | Used only to make sure selection is fair to women and men and across ages, and to make the programme accessible | Reviewers and the programme office, and in counts by county that never name anyone |
| County, constituency, ward, and your town, estate or village | To place you for selection, which is balanced by county and checked for spread, and so county teams can reach you | Your county is public only if you choose. Your ward, constituency and town are never public |
| The kind of art you make, how long, what you have sold or shown, your group, whether you can make murals, how you heard of us | To match you to calls and commissions | Reviewers, panels and the programme office; your art forms are public on your profile |
| Your national ID number, date of birth, and a selfie with your ID | To confirm once that every Creator ID belongs to one real person, and that only you can be paid for your work | Identity reviewers only, and every look is logged. Your ID number is encrypted and masked on every screen; it is never shown to anyone |
| Your works: original photos with their file details, a proof photo with a code, title, year, materials, size and story | To record that the work is yours, dated and checked, and to issue its certificate | Public: a low-resolution, watermarked image and the public details. Private: the originals, their file details and any location they carry |
| Your payment account (M-Pesa or bank), held by the payment gateway and linked by reference, and your KRA PIN if you give it | To set up your wallet and pay you in your own name | You and finance roles. Never public |
| Your profile, story, video and practice | To show on your public page and behind the QR code on your works, once you approve it | Public, after moderation and your approval |
What is public
Only your public name, your art forms, your county if you choose to show it, your bio, story and video, and the public details and images of your works. Your legal name (unless it is your public name), ID number, phone, email, ward, town, payment details and the location in your photos are never shown.
How long we keep it
These periods are proposed in the programme documents and are confirmed by counsel before this notice is final.
| Data | Kept for |
|---|---|
| Public profile and works | While your profile is active; removed if you ask to delete |
| Personal details (name, phone, email, location, gender, age, disability) | The life of your account plus 2 years, then deleted or anonymised |
| Selfie and face match | 90 days after verification |
| National ID number | Encrypted for the life of your account |
| Payment account reference, wallet and payment records | 7 years from the transaction, for tax and audit |
| Evidence of authorship: originals, proof photos, checks, declarations, provenance | The life of the work record; never deleted while a certificate stands |
| An unfinished registration | 30 days |
Where it is kept and how it is protected
Personal data is hosted in Kenya and encrypted in transit and at rest. Your ID number, the location in your photos and your payment references are encrypted separately. Every look at your record by a reviewer is logged.
Your rights
- To see what we hold about you: ask for an export from Settings and privacy, or write to us.
- To correct it: your profile and visibility are yours to change at any time; a correction to your verified identity goes through review.
- To delete your profile: ask from Settings and privacy. Personal and public data are removed and the record anonymised; evidence a live certificate requires is kept, with the reason logged.
- To withdraw consent to be contacted on WhatsApp, at any time, by telling us.
- To complain to the Office of the Data Protection Commissioner.
Consent
Before any detail is stored you accept this notice and the terms, confirm you understand that registering does not guarantee selection, and agree to be contacted on WhatsApp about your registration. The version of the wording you accepted and the time are kept with your record.
Questions
Write to to be confirmed or ask on WhatsApp. Support hours: to be confirmed.