Privacy Notice
Version 2026-10-31
Draft under legal review. Wording may change before launch.
eTAhelp is run by eTAhelp Ltd., Nairobi, Kenya. We are the data controller for the personal data described here. Contact us about your data at etahelp@gmail.com.
We are not the Government of Kenya. We don't issue eTAs, decide applications or collect government fees. You submit your application on the official portal, etakenya.go.ke, where the Government processes your data under its own terms.
What we collect, why, and how long we keep it
| What | Why | Lawful basis | Kept for |
|---|---|---|---|
| Account: name, email, password (stored only as a secure hash) | To sign you in and contact you about your case | Our contract with you | While your account is open |
| Your eTA answers: name as on passport, contact details, date of birth, passport number, nationality, residence, travel purpose and dates, accommodation | To prepare and check the information you'll submit on the official portal | Our contract with you | Deleted 30 days after your case is completed or cancelled; 90 days after your last activity if you never pay |
| Documents you upload (passport scan) | To check your answers against your passport | Our contract with you | As your answers |
| Payments: fee, reference, payment and refund status | Receipts, refunds and tax records | Contract; legal obligation | As required by tax law. We never see your card or mobile-money details: Paystack handles them |
| Messages with our team | To help you and record requested changes | Our contract with you | With your case |
| If an organisation applies for you: your name and email (given to us by the organisation), and whether and when you confirmed your details | To ask you to check and confirm your details before the organisation pays, and to tell the organisation your answer | Your consent, given on the confirmation page; the organisation's and our legitimate interests until then | As your answers; your name and email are deleted with them |
| Business accounts: the organisation's name and type, and its members' names and emails | To run the organisation's account, invitations and receipts | Our contract with the organisation | While the account is open; invitations expire after 14 days |
| Contact form: your name, email and message | To answer you | Legitimate interests | Up to 30 days in our sending system, then in our support inbox only as long as needed to help you |
| Technical: sign-in cookies, server logs, error reports | To keep you signed in, secure the service and fix faults | Legitimate interests | Cookies until you sign out; error reports contain no name, email or answers |
We use only the cookies needed to keep you signed in: no advertising or analytics cookies. Our Cookie notice lists them.
If an organisation applies for you
An employer, travel agency, school or other organisation can prepare your application with a eTAhelp business account. The organisation collects your details from you and enters them with us, and it is responsible for doing so lawfully, for example by asking you first. We use them only to prepare and check your application, as described above.
- Before the organisation can pay for your case, we email you a link to check every detail and confirm, or tell them what's wrong. Nothing is reviewed by our team or paid for until you confirm. If the details change afterwards, we ask you again.
- The organisation may also send you a link to upload your own documents (such as your passport photo page and a photo). Files you upload go straight into your application, with the same checks and protection as any other.
- These links work for 14 days and show your details to whoever opens them, so please don't forward them. If you don't know the organisation, don't confirm: choose “Something isn't right” and tell us.
- Everyone in the organisation's account can see and change your case, and receives its emails. Our staff see it as they see any case.
- You have the same rights as anyone else here, even without an account: email etahelp@gmail.com. For what the organisation itself does with your data, ask the organisation.
Who we share it with
We don't sell your data or use it for advertising. Only staff who need it can see your case, and only reviewers can open documents, after two-factor sign-in. Service providers that process data for us under contract: Supabase (database, storage, sign-in), Netlify (hosting), Paystack (payments), Sentry (error monitoring, with personal data removed) and our email provider. Some process data outside Kenya; we keep a record of each transfer and its safeguards as the Data Protection Act requires. We also share data when the law requires it.
Your rights
Under the Data Protection Act, 2019 you can ask us, free of charge, to:
- give you a copy of your data (we respond within 7 days);
- correct data that is wrong or incomplete (within 14 days) — you can also edit your answers while your case is open;
- delete data we no longer need (within 14 days), except records the law requires us to keep;
- stop all or part of our processing, or send your data to you in a machine-readable format.
You can download a copy of your data, or delete your account, yourself at any time from the Account page once signed in. Deleting your account removes your documents, answers, messages, name, email and sign-in; we keep payment and refund records, without your name or email, because tax law requires it. You can't delete your account while our team is still working on a paid case.
A person reviews every case; we make no decisions about you by automated means alone. For anything else, email etahelp@gmail.com from your account's address to use these rights. If you're unhappy, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
How we protect your data
- Documents are in private storage, opened only through short-lived links.
- Staff sign in with a password and an authenticator code; each role sees only what it needs.
- Every change to a case and every staff action is logged.
If a breach puts your data at real risk, we'll report it to the Data Commissioner within 72 hours and tell you as soon as practicable.