Unity Art Collective

Privacy notice

Last updated: 16 October 2026 · Effective date: Draft — not yet in effect.

This notice explains how Unity Art Collective handles personal data in connection with this website. It is written for the Kenya Data Protection Act, 2019.

What this website does and does not do

Everything on this website (pages, styles, fonts, scripts and images) is served from our own server. No third-party content delivery networks, font services, embedded social media, advertising pixels or third-party analytics are loaded.

We receive personal data when you choose to:

• contact us or pay us, for example by WhatsApp, email or mobile money;
• request a ticket or RSVP for an event on our events page;
• apply to our roster on our careers page.

Visit counting (only if you allow it)

Some pages show a banner asking whether we may count page visits and WhatsApp taps. Nothing is counted unless you choose Allow. If you allow it, your browser sends our own server: the event (for example a page view or a tap on a WhatsApp link), the page address, a fixed button label, a random session code that is cleared when you close the browser, your device type (mobile, tablet or desktop) and the name of the website that linked you here, if any. It does not include your name, phone number or messages, and it is never shared with an analytics or advertising company.

Browser storage: we save your Allow/No choice in your browser's local storage, and, if you allow counting, the random session code in session storage. Ordinary visitors get no cookies. Staff who sign in to staff tools get a sign-in cookie. To change your choice, clear this site's data in your browser and the banner will appear again.

Who is responsible (the data controller)

Unity Art Collective, a registered company in Kenya, based in Nairobi.

Contact: unityartcollectiveio@gmail.com or WhatsApp +254 798 965 733.

What personal data we process

Only what you choose to send us, which may include:

• your name and phone number (including your WhatsApp profile name and number);
• your email address, if you email us;
• payment details shown on your receipt or confirmation, such as the M-Pesa or other transaction code, amount, date and the paying name or number;
• receipts or screenshots you send;
• the content of your messages, such as the item, size and delivery details for an order, or details of a commission or partnership enquiry;
• event tickets and RSVPs: your name, phone number, optional email, the number of places, your agreement to this notice and whether you opted in to reminders or follow-ups, plus the entry code we issue and when it is scanned in or out at the door;
• career applications: the details you enter (such as your name, phone, email, city, Instagram, portfolio link, experience, availability, rate and statement) and any files you upload.

Our web server also records standard technical logs (such as IP address, browser type and the pages requested) to deliver and secure the site.

Why we use it

• to match your payment to your order, confirm it, and arrange delivery;
• to reply to your questions, commissions and partnership enquiries;
• to issue entry codes, run entry and exit at events, and check capacity;
• to review roster applications and reply to applicants;
• if you allow it, to count visits and taps so we can see which pages are useful;
• to keep records of sales and payments.

We do not sell your personal data, and we do not use it for advertising.

Lawful basis

• Contract: when you order and pay, we need your details to complete and deliver the order.
• Consent: when you choose to message or email us about anything else, send a career application, opt in to reminders or follow-ups, or allow visit counting. You can withdraw consent at any time (see your rights below).

Who else handles it

The services you choose to use to reach or pay us process your data under their own terms and privacy policies:

• WhatsApp (Meta) — for messages and receipts you send us on WhatsApp.
• Payment providers — Safaricom (M-Pesa), Diamond Trust Bank (DTB, Paybill 516600 / Till Moja), and, if you use them, Airtel Money, Telkom T-Kash or PesaLink, plus your own bank or mobile-money provider.
• Google (Gmail) — for email sent to unityartcollectiveio@gmail.com.
• Our server provider (Contabo) — we rent the server that runs this site and stores event, application and visit-count records. Contabo provides the hardware; we run the site ourselves.

The site links to our social media pages (Instagram, Threads, TikTok, X, YouTube, and two Facebook accounts: Unity Art and the Unity collective Page). Nothing from those platforms is embedded in our pages, and they receive nothing from us when you load a page. If you follow a link, that platform's own privacy policy applies.

Transfers outside Kenya

WhatsApp/Meta, Google and our server provider may store or process data on servers outside Kenya. Where this happens, it is under those providers' terms and the safeguards they offer.

How long we keep it

• Order and payment records (name, phone number, M-Pesa or other transaction code, and receipts): kept for 5 years, then deleted.
• WhatsApp and email conversations: deleted after 12 months.
• Unpaid ticket requests expire after 30 minutes and release the place.
• Event, RSVP and application records: kept for running events and reviewing applications, and deleted or anonymised on request.

Server technical logs are kept for a limited time to keep the site secure.

Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access the personal data we hold about you;
• ask us to correct it if it is wrong or incomplete;
• ask us to delete it;
• object to our processing of it;
• ask us to restrict processing;
• receive your data in a portable format (data portability);
• withdraw your consent at any time, without affecting processing that happened before.

To use any of these rights, email unityartcollectiveio@gmail.com or WhatsApp +254 798 965 733. We may need to keep some records where the law requires it.

Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke.

Changes to this notice

If we change how the site works (for example, if we add new forms, change visit counting or add a new service provider), we will update this notice before the change goes live.