Privacy Policy
Last updated 27 October 2026
This policy explains what personal data AfraViva collects through its websites, why, who receives it, how long it is kept and how you can exercise your rights. It applies to afraviva.com, afravivamedia.com (also reached at media.afraviva.com), farms.afraviva.com and homes.afraviva.com, and to enquiries we receive through them.
We follow Kenya's Data Protection Act, 2019 and its regulations, and Uganda's Data Protection and Privacy Act, 2019 for our Uganda farm work.
1. Who we are
AfricaNext Opportunities (ANO), trading as AfraViva, is the data controller for the personal data described here. AfraViva Media, AfraViva Homes and AfraViva Farms are brands of the same company.
| Address | St. Joseph Studio, Covenant Road, off Ngong Road, past Dagoretti Corner, Nairobi, Kenya |
|---|---|
| Data protection contact | Admin@afraviva.com |
All questions, requests and complaints about personal data go to the data protection contact above.
2. What we collect and why
We collect only what we need to answer you, run the sites and tell our story. We do not sell personal data, profile visitors or run advertising trackers.
| Where it comes from | Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Contact form on afraviva.com | Name, email, phone (optional), message, page it was sent from | To reply and handle the enquiry | Your consent when you submit, and our legitimate interest in answering | 24 months after we receive it |
| Homes enquiry and "notify me" forms | Name, phone, email, property, message | Sent by you to us on WhatsApp so we can respond | Your consent | As long as the conversation is needed, up to 24 months |
| Staff access requests | Name, email, reason for access | To review and set up admin accounts | Legitimate interest | 12 months after the request is reviewed |
| Admin accounts | Name, email, password (stored encrypted), two-step login device | To run the content admin securely | Contract and legitimate interest | While the account is active, then 12 months |
| Admin login records | Username, IP address, browser and time of each admin login attempt | To detect and block password-guessing attacks | Legitimate interest | 90 days |
| Website server logs | IP address, browser type, pages requested, time | Security, fixing errors, preventing abuse | Legitimate interest | Rolling: trimmed weekly to recent entries |
| Photos, video and stories | Images, voices, names and stories of people we feature | To report our work in Media, Farms and Homes | Consent of the person shown (a parent or guardian for children) | While published, or until consent is withdrawn |
We do not knowingly collect sensitive data (such as health or religious affiliation data) through our forms. Please do not include it in messages.
3. Cookies
Our sites use only cookies that are strictly necessary for them to work. We use no analytics, advertising or social media tracking cookies.
| Cookie | Set on | Purpose | Lasts |
|---|---|---|---|
| csrftoken | Pages with a form | Stops other websites submitting forms in your name (security) | 1 year |
| sessionid | Admin pages, staff only | Keeps staff logged in | Until the browser closes, or after inactivity |
Embedded videos (YouTube, TikTok) may set their own cookies when you play them; see section 4. If we ever add analytics or advertising cookies, we will ask for your consent first and update this policy.
4. Who we share data with
We share personal data only with the service providers below, and only what each needs. Some are outside Kenya; where data leaves Kenya we rely on the provider's own safeguards and, where needed, your consent, as section 48 of the Data Protection Act requires.
| Provider | What they receive | Why | Where |
|---|---|---|---|
| Truehost Cloud (hosting and email) | Everything stored on the sites, enquiry emails, backups | Runs the websites and mailboxes | Truehost Cloud data centres |
| WhatsApp (Meta Platforms) | Details you send through the Homes forms or WhatsApp buttons | Lets us reply to enquiries | Outside Kenya |
| YouTube (privacy-enhanced mode) and TikTok | Your IP address and their cookies when you play an embedded video | Plays videos on Media pages | Outside Kenya |
We may also disclose data when the law requires it, for example to comply with a court order. We never sell or rent personal data.
5. Photos, video and children
We feature real people in our stories, events, farms and homes. We publish an identifiable person's photo, video, voice or story only with their consent.
- Adults sign a photo and video release before we publish, naming where the content may appear.
- Children under 18 appear only with written consent from a parent or guardian (section 33 of the Data Protection Act). We do not publish a child's full name, school or location alongside their image.
- Crowd and event shots are taken at events announced as filmed. Anyone who asks will be blurred or removed.
- Withdrawing consent: anyone featured can ask us to remove their image or story by contacting us (section 1). We remove it from our websites within 14 days and stop using it in new material.
6. How long we keep data and how we protect it
We keep personal data only for the periods in section 2. Enquiries, staff access requests and admin login records are deleted automatically once their period ends. A full backup of the sites is taken weekly and only the four most recent are kept, so deleted data leaves our backups within about one month.
- All sites use HTTPS encryption.
- Admin access is limited to named staff, locks after repeated failed logins and times out when idle.
- Passwords are stored only in encrypted (hashed) form.
- Enquiries are visible only to staff who handle them.
- Location and camera details are removed from photos when they are uploaded.
- Our fonts and images are served from our own server, so viewing a page does not share your IP address with font or image providers.
7. Your rights
You can contact us (section 1) to exercise these rights under the Data Protection Act, 2019:
- Be informed of how your data is used (this policy).
- Access a copy of the data we hold about you.
- Correct data that is inaccurate or out of date.
- Delete your data, or object to our using it.
- Withdraw consent at any time, without affecting what was done before.
- Data portability: receive your data in a common format, or have it sent to another organisation.
We confirm requests within 7 days and complete them as soon as possible, free of charge. We may ask for proof of identity first.
Complaints. If you are unhappy with how we handled your data, please contact us first. You can also complain to the Office of the Data Protection Commissioner in Kenya, or, for our Uganda farm work, to Uganda's Personal Data Protection Office.
Changes to this policy
We will update this page when our practices change, and show the date of the latest version at the top.