Obituaryweb Privacy Policy & Data Protection Notice

Last updated: January 2026

This Privacy Policy explains how Obituaryweb collects, uses, stores, protects, and discloses personal data in accordance with the Data Protection Act, 2019 (Kenya) and the guidance of the Office of the Data Protection Commissioner (ODPC). Obituaryweb is a digital memorial platform built on the principle of dignity, respect, and responsible stewardship of personal and memorial data.

1. Data Controller

Obituaryweb is the data controller responsible for the processing of personal data under this Policy.

Contact details:

Email: info@obituaryweb.com
Location: Mama Ngina Street, Embu Town, Mwananchi Building, Kenya

2. Legal Basis for Processing

Consent provided by the data subject;
Performance of a contract, where processing is necessary to provide our services;
Legal obligation, where retention or disclosure is required by Kenyan law;
Legitimate interests, limited strictly to operating and securing the platform without overriding user rights.

3. Personal Data We Collect (Data Minimization)

Obituaryweb applies strict data minimization principles. We collect only what is necessary.

3.1 Mandatory Data (All Users)

Full name
Email address

3.2 Conditional Data (Optional / Role-Based)

Telephone number only if a user opts to participate as a sales agent and selects M-Pesa as a payment method.

3.3 Payment-Related Data

System-generated transaction reference codes

We do not collect or store:

M-Pesa numbers
Credit or debit card numbers
CVV codes or banking credentials

4. Purpose of Data Collection

User registration and authentication
Account communication and service notifications
Facilitating commissions and payouts for sales agents
Security, fraud prevention, and audit compliance
Legal and regulatory compliance

We do not sell, rent, trade, or disclose personal data to third parties for marketing purposes.

5. Memorial and Obituary Content

Obituaryweb allows users to publish memorial content about deceased persons. While such content may include names, dates, and narratives, it is treated with sensitivity and respect. Users are responsible for ensuring they have lawful authority or consent to publish memorial information. Obituaryweb does not intentionally process sensitive personal data beyond what is publicly submitted by users.

6. Data Security Measures

Secure password hashing using industry-standard cryptographic algorithms
Role-based access controls
Protection against unauthorised access, alteration, disclosure, or destruction

Administrators cannot view or retrieve user passwords.

7. Data Retention

User account data is retained while the account remains active
Payment logs are retained for 30 days only for audit and reconciliation purposes
Data no longer required is securely deleted or anonymised

8. Data Subject Rights (Kenya)

Be informed about the processing of their personal data
Access personal data held about them
Request correction of inaccurate or misleading data
Request erasure of personal data where legally permissible
Object to or restrict processing

Requests may be submitted via email and will be handled within statutory timelines.

9. Cross-Border Data Transfers

Where personal data is stored or processed outside Kenya, Obituaryweb ensures that appropriate safeguards are in place in line with Kenyan law.

10. Cookies and Technical Data

Obituaryweb may use essential cookies or similar technologies required for authentication, security, and basic functionality. We do not use cookies for behavioural advertising or profiling.

11. Complaints and ODPC Oversight

If you believe your data protection rights have been violated, you may lodge a complaint with:

Office of the Data Protection Commissioner (ODPC), Kenya

12. Updates to This Policy

This Privacy Policy may be updated periodically. Material changes will be communicated through the platform or via email where appropriate.

A. ODPC Registration Alignment (Internal Reference)

Data Controller Identification: Section 1
Categories of Personal Data: Section 3
Purpose of Processing: Section 4
Lawful Basis: Section 2
Data Retention Periods: Section 7
Security Measures: Section 6
Data Subject Rights: Section 8
Cross-Border Transfers: Section 9

Language avoids excessive disclaimers and reflects actual system practices, which aligns with ODPC review expectations.

B. Data Protection Notice (For Registration & Signup Pages)

Data Protection Notice

Obituaryweb collects only your name and email address to create and manage your account. Your data is used strictly for service communication and is never sold or shared with third parties. Passwords are securely hashed and cannot be accessed by administrators. Telephone numbers are collected only if you choose to participate as a sales agent and select M-Pesa as a payment method. Payment records do not contain financial credentials and are retained for 30 days only. Your data is processed in accordance with the Kenya Data Protection Act, 2019.

C. Legal Clarifications (Platform Governance)

C.1 Content Ownership

Users retain ownership of obituary and memorial content they submit. By publishing content on Obituaryweb, users grant Obituaryweb a non-exclusive, royalty-free licence to host, display, and distribute such content solely for the operation of the platform.

C.2 Family Disputes and Authority

Obituaryweb does not adjudicate family or succession disputes. In the event of conflicting claims over memorial content, Obituaryweb may temporarily restrict access or remove content pending resolution or valid legal instruction.

C.3 Takedown Requests

Requests for content removal may be submitted where:

Content is inaccurate or defamatory
The requester demonstrates lawful authority or a legitimate interest
Removal is required by law or court order

Obituaryweb reserves the right to assess requests to balance dignity, public interest, and legal compliance.