Privacy policy

Who we are

JengaTrack provides an online service for construction professionals, firms and suppliers in Kenya. This policy explains what personal data we handle, why, who can see it, and your rights under Kenya's Data Protection Act, 2019. Our contact details are on the contact page.

For your own account and use of the service, JengaTrack decides how your data is used (we're the data controller). When your organisation enters someone else's details, such as a client's, the organisation decides what's entered and why, and we process those details on its behalf to provide the service.

What we collect

• Your account: your name and email address, and your password, which is stored only in scrambled (hashed) form.
• Your organisation: its name, profession or account type, country, phone, email, address, KRA PIN and logo, if you add them, and who its members are and their roles.
• What you enter: clients' contact details and KRA PINs, projects, BOQs, quotations, invoices, payment records and receipts.
• Shared projects: the firms on a project and their roles, shared documents, uploaded files (PDF, JPG or PNG), appointments and withdrawal notices, transmittals and their answers, materials register entries, certificates, test records and non-conformances, controlled documents and their revisions, checklist items and evidence, registration checks a project's organisation records, alerts and a log of the emails sent about them, concerns, and the project record of who did what and when. Records and files carry a fingerprint (a SHA-256 hash) so changes can be detected. Uploaded images are redrawn before they're stored, which removes hidden data such as camera location.
• Supplier shops and contractor profiles: business details, contact numbers, listings and prices, declared registrations, and certificates.
• Consultants' registrations: the professional registrations a consultancy declares, such as with EBK or BORAQS, and their certificates. The registrations are shown to the firms on its projects; the certificates stay private to the firm.
• Payments to JengaTrack: the amount, currency, what it was for, the payment channel and Paystack's reference. We never receive your card number or M-Pesa PIN.
• Feedback you send us, with the page you sent it from.
• The demo: "Try the demo" makes a temporary account with no name or email of yours, and sample work. Your IP address is used only to limit how many demos start from one address in an hour; it isn't stored with the demo. The demo and everything typed in it are deleted 24 hours after it starts.
• Technical data: your IP address and browser details in server logs, rate-limit counters that protect against abuse, and an activity history of changes to records.

How we use it, and why

• To provide the service you signed up for: running your account, storing and showing your records, printing documents, sharing what you choose to share, and sending the emails the service depends on, such as address verification, invitations, alerts about concerns or rejected materials, overdue transmittals and expiring registrations.
• For our legitimate interests: keeping the service secure, preventing scams and abuse, reviewing shops and contractor profiles before they go public, fixing problems, and improving JengaTrack from feedback.
• To meet legal obligations, such as keeping payment records, or answering a lawful request from an authority.

We don't sell personal data. We don't use advertising trackers or analytics services, and we don't send marketing emails.

Who can see what

• Your organisation's members see its records, depending on their role.
• Other firms on a shared project see only what the rules described in our terms allow: never your client's details, drafts or unshared documents. A concern is seen only by the project's organisation, the firm that raised it and the firm it names.
• The public can see approved shops (including their phone, WhatsApp and email), approved contractor profiles (but never their certificates), and the check page behind an invoice's or receipt's QR code, which shows the issuer's name, the number, date, amounts and status, but not the client's name or line items. Search engines may list shops and profiles. Check pages ask them not to.
• Search engines are told not to list, and caches not to keep, anything behind a sign-in, any check page, and any file you upload or download. The only things they may list are our own pages, blog posts, and the shops and contractor profiles their owners chose to publish. Nothing about you goes public unless you put it on one of those yourself.
• Blog readers see the name you give with a comment, never your email.
• Suppliers you send a quote request to see the lines you chose, the county, your message and your organisation's name, never your rates, client or project.
• Authorities: if a project's organisation refers a project to a confirmed county or regulatory authority, that authority sees the reason given and the files sent, which can include names and details of people and firms on the project, until the access ends. A firm named in the referral sees the subject, the reason and what is added afterwards.
• JengaTrack's administrators see account details (organisation names, members, contact details), counts of records, payments to JengaTrack, feedback, and the shops and profiles they review. Our administration screens don't show the contents of your documents. To check how BOQ revisions are used, the system compares a BOQ's lines between revisions automatically and shows administrators only the number of revisions and lines and the percentage changed. Staff access systems only when needed to run or fix the service.

Services we use

• Paystack processes payments to JengaTrack. Its own privacy policy applies to the details you give it.
• An email provider delivers the service's emails.
• A hosting provider runs our servers and stores the data and backups.
• Google Fonts, jsDelivr and cdnjs supply fonts, styles, icons and the text editor, so they receive your IP address when pages load.

Some of these providers may process data outside Kenya. Where that happens, we rely on them to protect it as the Data Protection Act requires.

Cookies

JengaTrack uses only the cookies it needs to work: a session cookie that keeps you signed in, a security cookie that protects forms against forgery, and, if you like or dislike a blog post without signing in, a cookie holding a random code so the same reaction isn't counted twice. That code doesn't identify you, and we keep only a scrambled (hashed) copy of it. We don't use advertising or analytics cookies, so there's nothing to opt out of.

How long we keep it

We keep your data while your account or organisation is active. Issued documents, payment records and project records are kept as a permanent record, because the law, your clients and other firms on a project may rely on them. You can delete your account yourself, under Your account. That wipes your name, email and phone and ends your sign-in. Documents, payments and project records keep the name that was on them, because others rely on them. An Owner can also close an organisation there: its members lose access, but its records are kept for the same reason. Otherwise we delete or anonymise what we're no longer required or entitled to keep. Server logs are kept for a short time for security. An email that has to wait for our hourly sending limit is stored until it's sent, and for a week after that.

Keeping it safe

Each organisation's records are kept apart and checked on every request, passwords are hashed, connections are encrypted, private files are never served directly, and access depends on your role. Uploaded files are checked and images redrawn. No system is perfectly secure: if a breach puts your data at risk, we'll tell you and the Office of the Data Protection Commissioner as the law requires.

Your rights

Under the Data Protection Act, 2019, you can ask to be told what personal data we hold about you and get a copy, have it corrected, or have it deleted, and you can object to or ask us to restrict some uses of it. Some records may have to be kept where the law requires it, or where other firms on a project rely on them. You can correct your own name, email and phone, and delete your account, under Your account once you're signed in. For anything else, contact us. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

If your details were entered by an organisation you work with, such as a client record, you can also ask that organisation directly.

Children

JengaTrack is for adults working in construction. It isn't meant for anyone under 18.

Changes

We'll update this policy when the service changes, and tell account holders about significant changes by email or in the app.