Data Subject Rights
This page describes the rights you have over the personal data we hold about you and how to exercise those rights with Volcha Enterprises Limited. These rights arise principally from the Kenya Data Protection Act, 2019 ("KDPA"), the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA").
1. Your rights in summary
Subject to the law that applies to you, you have the right to:
| Right | What it means | Source |
|---|---|---|
| Access | Request a copy of the personal data we hold about you. | KDPA §24; GDPR Art. 15; CCPA §1798.100 |
| Rectification | Ask us to correct inaccurate or incomplete data. | KDPA §25; GDPR Art. 16 |
| Erasure ("right to be forgotten") | Ask us to delete your data, subject to legal exceptions. | KDPA §26; GDPR Art. 17; CCPA §1798.105 |
| Restriction / suppression | Limit how we process your data while a complaint is resolved. | KDPA §27; GDPR Art. 18 |
| Portability | Receive your data in a structured, machine-readable format. | KDPA §28; GDPR Art. 20 |
| Object | Object to processing based on legitimate interest or for direct marketing. | KDPA §29; GDPR Art. 21 |
| Withdraw consent | Where we rely on consent, withdraw it at any time without affecting prior processing. | KDPA §32; GDPR Art. 7(3) |
| Opt out of sale or sharing | We do not sell personal data. If this ever changes, a "Do Not Sell or Share" link will be available here. | CCPA §1798.120 |
| Non-discrimination | We will not deny you the Service or charge you a different price for exercising your rights. | CCPA §1798.125 |
| Human review of automated decisions | You have the right to request human review of any decision that was significantly influenced by automated processing. | GDPR Art. 22(3) |
2. How to exercise them
You can exercise your rights in any of the following ways:
- Self-service from the Service: if you have an active session, the footer links to a dedicated data-subject request flow that lets you export or delete your data directly. This is the fastest option.
- API endpoints: you can programmatically export or delete your data:
POST /api/data/export, returns a JSON document of all data we hold for the supplied email.POST /api/data/delete, schedules deletion of all data associated with the supplied email, after identity verification.
- Email: write to info@volcha.co.ke from the email address you registered with us (or include proof of identity if writing from a different address). Tell us which right you wish to exercise and the scope of the request.
- Postal mail: write to the Data Protection Officer at the address in section 6 below.
3. Response times
We will acknowledge your request within 5 business days and complete it within 30 calendar days of receiving a verified request. Where a request is complex, we may extend the response time by up to 60 additional days under the KDPA and GDPR, in which case we will notify you of the reasons for the delay.
There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act (with an explanation).
4. Identity verification
For your protection, we need to confirm the identity of the person making the request before we disclose or delete personal data. Typically this means receiving the request from the email address on file, or attaching additional proof of identity (a copy of an ID document) where the request originates from a different address. We delete the verification documents as soon as the request is closed.
5. Right to complain to a regulator
If you believe our processing of your personal data is unlawful, you have the right to lodge a complaint with a supervisory authority. The lead authority for Volcha is the Office of the Data Protection Commissioner of Kenya. Depending on where you live, you may also complain to your local data protection authority, such as the European Data Protection Board (for the EU), the Information Commissioner’s Office (for the UK), or the California Privacy Protection Agency (for California).
6. Contact
Volcha Enterprises Limited, Data Protection Officer
Email: info@volcha.co.ke
Phone: +254 704 987 850