GDPR Compliance

Bundi Insights is committed to protecting the privacy and personal data of all individuals who interact with our platform. We respect the principles of the EU General Data Protection Regulation (GDPR) and Kenya's Data Protection Act, 2019, and apply them as a baseline standard for all users regardless of location.

We process personal data only where we have a lawful basis to do so. The lawful bases we rely on include:

• Consent - when you join our waitlist or sign up for our service, you consent to us contacting you about Bundi.
• Contract - when you use our platform, processing your data is necessary to deliver the service.
• Legitimate interests - for product improvement, security, and fraud prevention, where these interests are not overridden by your rights.
• Legal obligation - where we are required to retain or share data by law.

Under GDPR and the Kenya Data Protection Act, you have the following rights regarding your personal data:

• Right of access - request a copy of the data we hold about you
• Right to rectification - request correction of inaccurate or incomplete data
• Right to erasure - request deletion of your data ("right to be forgotten")
• Right to restriction - request that we limit how we use your data
• Right to data portability - receive your data in a structured, machine-readable format
• Right to object - object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making - not to be subject to solely automated decisions that significantly affect you

To exercise any of these rights, email info@bundiinsights.co.ke. We will respond within 30 days.

Bundi Insights is based in Kenya. If we transfer your personal data outside Kenya or the European Economic Area, we ensure appropriate safeguards are in place, including standard contractual clauses or adequacy decisions, in compliance with applicable data protection law.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Waitlist data is retained until you unsubscribe or request deletion. Account and transaction data is retained for the duration of your use of the platform plus a reasonable period thereafter for legal and audit purposes.

Our website uses minimal cookies necessary for the site to function. We do not use third-party advertising cookies or tracking pixels. If we introduce any optional cookies in future, we will request your consent.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay, as required by law.

Bundi Insights has designated a point of contact for data protection matters. For any GDPR-related queries or to exercise your rights, contact us at info@bundiinsights.co.ke.

If you believe we have not handled your personal data in compliance with applicable law, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya, or your local data protection supervisory authority.