Privacy Policy

RafikiRaffles ("we", "us"), Nairobi, Kenya, decides what happens to the personal data described here. Questions about this policy go to hello@taji.co.ke.

• The M-Pesa phone number you type in when you pay. Customers do not need an account.
• A private receipt access code stored in your browser; only its hash is saved with the order. Anyone with your reference and code can view the receipt, so keep them private.
• Which raffle you entered, how many tickets, and the amount paid.
• A payment reference and status from Paystack (paid, failed, pending) — not your M-Pesa balance, not your PIN.
• SMS and call records we use to notify you about a draw or a winner.
• Basic technical information from your phone: device type, browser, approximate location and pages viewed, so we can fix problems and see what is working.

• To take your payment and issue your tickets.
• To run the draw and contact winners about delivery.
• To spot duplicate numbers, bots and payment abuse.
• To keep records the law requires us to keep.
• To send you draw reminders — only if you ask for them, and you can stop them any time.

Paystack processes M-Pesa payments on our behalf and Safaricom completes the transfer on your line. We receive the amount, the phone number, a reference and whether the payment succeeded. We never receive your M-Pesa PIN or your balance, and we do not store card details on our servers.

Under the Kenyan Data Protection Act, 2019 we rely on: performing our agreement with you (selling a ticket and running the draw), our legitimate interest in stopping fraud, a legal obligation to keep transaction records, and your consent for anything optional such as marketing messages.

• Paystack and Safaricom, to complete and confirm your payment.
• Delivery partners, so a prize reaches a winner — only name, town and phone number.
• Our hosting and analytics providers, to keep the Site running.
• The Kenyan gaming regulator, the tax authority or a court, when they are entitled to ask.

We publish a winner's first name, initials, town and prize on the Site so players can see the draws are real. We ask before using a winner's photo, and you can say no. Your phone number is never published.

• Payment records: 7 years, for tax and audit.
• Ticket entries: until the draw is complete, then 90 days.
• Winner contact details: until delivery is confirmed, then per the payment rule above.
• Marketing consent: until you withdraw it.

Some of our providers (Paystack, hosting) store data outside Kenya. We only use providers with proper security and contracts, and we check that your information is protected to a standard close to Kenyan law.

The Site is served over HTTPS, payment checks happen on our server, and only staff who need the data can reach it. No system is perfectly safe — if a breach ever puts your number at risk, we tell you and the Data Commissioner what happened and what we are doing about it.

• Ask us what we hold about you and get a copy.
• Ask us to correct wrong details or delete data we no longer need.
• Object to processing, or withdraw marketing consent, any time.
• Complain to the Office of the Data Protection Commissioner if you think we have mishandled your information.

Send requests to hello@taji.co.ke. We answer free of charge within 30 days and may need to confirm it is really you.

RafikiRaffles is not for anyone under 18. We do not knowingly collect data from a minor, and we delete it if we find out we have.