Privacy Policy

Introduction

Blueprint ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our platform, website, and services.

This Privacy Policy complies with the Kenya Data Protection Act 2019 and applicable data protection regulations. By using Blueprint, you consent to the data practices described in this policy.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, you must not use our Platform.

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Register an Account: Name, email address, phone number, password
• Complete Your Profile: Profile photo, business information, company name, location, bio
• Create Projects (Customers): Project details, budget, timeline, location, requirements
• Submit Quotes (Providers): Pricing, milestones, project proposals
• Make Payments: Payment method details (processed securely by M-Pesa or Stripe)
• Upload Documents: Licenses, certifications, business registration, portfolio images
• Communicate: Messages, reviews, dispute information

1.2 Verification Information (Providers)

Providers must submit additional information for verification:

• Government-issued ID (National ID, Passport)
• Business registration documents
• Professional licenses and certifications
• Insurance documentation (if applicable)
• Tax identification numbers

1.3 Automatically Collected Information

When you access our Platform, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, time spent, clicks, navigation paths
• Location Data: General geographic location (city/region) based on IP address
• Cookies and Tracking: Session cookies, authentication tokens, analytics data

1.4 Information from Third Parties

We may receive information from:

• Payment Processors: M-Pesa and Stripe (transaction status, payment confirmations)
• Verification Services: Background check providers, license verification agencies
• Social Media: If you choose to link social accounts

2. How We Use Your Information

We use your personal information for the following purposes:

2.1 Platform Operations

• Create and manage your account
• Facilitate project creation, quote submission, and matching
• Process payments and manage escrow
• Enable communication between Customers and Providers
• Track project progress and milestones
• Handle disputes and customer support

2.2 Verification and Security

• Verify Provider credentials and qualifications
• Detect and prevent fraud, abuse, and security threats
• Comply with legal and regulatory requirements
• Conduct background checks and risk assessments

2.3 Improvements and Analytics

• Analyze Platform usage and performance
• Improve user experience and features
• Develop new services and functionality
• Conduct research and statistical analysis

2.4 Communications

• Send transactional notifications (quotes, payments, milestones)
• Provide customer support and respond to inquiries
• Send important Platform updates and security alerts
• Deliver marketing communications (with your consent)

2.5 Legal Compliance

• Comply with legal obligations and government requests
• Enforce our Terms and Conditions
• Protect our rights, privacy, safety, or property
• Resolve disputes and troubleshoot problems

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Other Platform Users

• Customers see: Provider profile, company name, portfolio, ratings, verification status
• Providers see: Customer name, project details, location, contact information (after quote acceptance)
• Public information: Reviews, ratings, and portfolio projects may be publicly visible

3.2 With Service Providers

We share information with trusted third-party service providers who assist us in:

• Payment Processing: M-Pesa (Safaricom), Stripe
• Hosting and Infrastructure: Cloud storage, database services
• Communication: Email delivery (SendGrid, Mailgun), SMS notifications
• Analytics: Usage tracking and performance monitoring
• Verification Services: Background checks, license validation

These service providers are contractually obligated to protect your information and may only use it for the purposes we specify.

3.3 For Legal Reasons

We may disclose your information if required by law or to:

• Comply with legal process (subpoenas, court orders)
• Respond to government or law enforcement requests
• Protect against fraud, security threats, or illegal activity
• Enforce our Terms and Conditions
• Protect the rights, property, or safety of Blueprint, our users, or the public

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and provide options regarding your information.

4. Data Security

We implement industry-standard security measures to protect your personal information:

• Encryption: Data transmitted over HTTPS/TLS; sensitive data encrypted at rest
• Access Controls: Limited employee access on a need-to-know basis
• Secure Infrastructure: Firewalls, intrusion detection, regular security audits
• Payment Security: We do not store full credit card details (handled by PCI-compliant processors)
• Regular Backups: Data backup and disaster recovery procedures

However, no system is 100% secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials.

5. Data Retention

We retain your personal information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations (tax records, financial audits)
• Resolve disputes and enforce agreements
• Maintain business records and analytics

Retention Periods:

• Active account data: Retained while your account is active
• Transaction records: Minimum 7 years (for tax and legal compliance)
• Inactive accounts: Deleted after 3 years of inactivity (with 60-day notice)
• Marketing data: Until you withdraw consent

6. Your Data Protection Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

6.1 Right to Access

You can request a copy of the personal information we hold about you.

6.2 Right to Rectification

You can update or correct your personal information through your account settings or by contacting us.

6.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal information, subject to legal retention requirements.

6.4 Right to Restrict Processing

You can request that we limit how we use your information in certain circumstances.

6.5 Right to Data Portability

You can request a copy of your data in a structured, machine-readable format.

6.6 Right to Object

You can object to processing of your information for marketing purposes or based on legitimate interests.

6.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw consent at any time.

To exercise your rights, contact us at: privacy@blueprintnint.com

We will respond to requests within 30 days as required by law.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

7.1 Types of Cookies

• Essential Cookies: Required for Platform functionality (authentication, security)
• Performance Cookies: Collect anonymous usage data for analytics
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Track effectiveness of advertising campaigns (with consent)

7.2 Managing Cookies

You can control cookies through your browser settings. However, disabling essential cookies may affect Platform functionality.

8. Third-Party Links and Services

Our Platform may contain links to third-party websites (e.g., payment processors, social media). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

9. Children's Privacy

Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and stored on servers outside Kenya (e.g., cloud hosting providers in the EU or US). We ensure that such transfers comply with Kenyan data protection laws and that adequate safeguards are in place.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email notification to registered users
• Prominent notice on the Platform
• Updated "Last Updated" date at the top of this policy

Your continued use of the Platform after changes constitutes acceptance of the updated Privacy Policy.

12. Contact Information and Complaints

For questions, concerns, or to exercise your data protection rights, contact us:

• Data Protection Officer: privacy@blueprintnint.com
• Email: support@blueprintnint.com
• Phone: [Company Phone Number]
• Address: [Company Physical Address]

File a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner (Kenya)
Website: www.odpc.go.ke
Email: info@odpc.go.ke