Privacy Policy

1. Who we are

Enreal Limited ("we", "us") operates the Uniterns platform and is the data controller for personal data processed through it, within the meaning of the Data Protection Act, 2019.

2. Data we collect

• Identity & KYC: full name, National ID number and document image, date of birth (students), and for companies the legal name, registration number and certificate.
• Contact: email address and phone number.
• Account & profile: role, institution/course and study details (students), sector, county and town (employers), skills, interests and availability, and any CV you upload.
• Payment: your M-Pesa number or card name, and records of membership and stipend payments (we do not store full card numbers).
• Activity: matches, placements, term funding and disbursements, ratings, incidents you report, and technical logs including IP address and timestamps recorded in our audit trail.

3. Why we process it & our lawful basis

We process personal data to: provide and secure the service; verify identity (KYC) and eligibility; match students with placements; facilitate escrow-held stipend funding and disbursement; prevent fraud and safeguard users; comply with legal obligations; and communicate with you. Our lawful bases include the performance of a contract with you, your consent (which you may withdraw), our legitimate interests in operating a safe platform, and compliance with the law.

4. Who we share it with

We share the minimum necessary data with trusted processors and counterparties: a licensed escrow provider (to hold and release stipends); payment providers (e.g. Safaricom M-Pesa); an identity-verification provider (for KYC); and infrastructure providers for database, file storage, email and hosting. We also share the information necessary between a matched student, sponsor and employer to enable a placement. We do not sell your personal data.

5. Storage & security

Identity documents, CVs and certificates are stored in private storage and are never exposed on a public URL — they are served only to you or an authorised administrator. Data in transit is encrypted (HTTPS/TLS), sessions use secure httpOnly cookies, and an append-only audit log records key events. No system is perfectly secure, but we apply reasonable technical and organisational measures.

6. International transfers

Some of our processors store or process data outside Kenya (for example, database and email infrastructure in the European Union, and content-delivery infrastructure globally). Where personal data is transferred outside Kenya, we take steps to ensure an appropriate level of protection consistent with the Data Protection Act, 2019.

7. Retention

We keep personal data for as long as your account is active and as needed to provide the service, and thereafter as required to meet legal, regulatory, tax, audit and dispute-resolution obligations, after which it is deleted or anonymised.

8. Your rights

Under the Data Protection Act, 2019 you have the right to: be informed of the use of your data; access your data; request correction of inaccurate data; request deletion (where applicable); object to or restrict certain processing; request portability; and withdraw consent at any time. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

9. Cookies & sessions

We use a strictly necessary, secure session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

10. Age

Uniterns is intended for users aged 19 and older. We do not knowingly collect data from anyone under 19.

11. Changes & contact

We may update this policy; material changes will be notified in-app or by email. For any privacy request or question, contact Enreal Limited at [privacy@enreal.co.ke].