Privacy notice

This notice explains what we collect when you use Gliding Stars, why, and the choices you have. It is written to meet the Kenya Data Protection Act, 2019.

What we collect

• Your account details: name, email address and phone number.
• Children's details you add: first name, year of birth, skating level, any support notes, and the consents you give.
• Bookings, rentals, orders and payment records. Card and M-Pesa details are handled by our payment provider, Paystack; we never see your full card number or PIN.
• For coaches: identity documents, police clearance certificates and references, stored privately and seen only by our verification team.
• For schools: the contact details and program needs you send us.

Why we use it

• To run the lessons, rentals and orders you ask for, and to contact you about them.
• To keep children safe, including checking coaches and recording consent.
• To meet legal, tax and accounting duties.

We do not sell personal data. We do not send marketing unless you ask for it.

Children's data

We process a child's data only with the consent of their parent or guardian, and you can withdraw consent at any time from your account. Coaches see a child's details only for sessions that child is booked into.

Who else sees it

Our service providers store and process data for us under contract: our database and hosting providers and our payment provider. We share information with a school only about its own program, and with authorities only when the law requires it.

How long we keep it

We keep account and booking records while your account is open and for the period the law requires for financial records afterwards. Coach verification documents are kept while the coach works with us and deleted afterwards, except where the law requires otherwise.

Your rights

You can ask to see, correct or delete your data, object to how we use it, or withdraw consent. Write to us and we will respond within the time the law sets. You can also complain to the Office of the Data Protection Commissioner.

If something goes wrong

If a data breach puts you at risk, we report it to the Data Protection Commissioner within 72 hours and tell you without delay.

The data controller's registered name and contact address will be published here before launch.