Privacy Policy
This Privacy Policy explains how KNICKPOINT (https://knickpoint.co.ke/) collects, uses and protects information when you browse the site, buy or download documents, or contact us. We follow the Kenya Data Protection Act, 2019 and, where it applies to you, the EU/UK General Data Protection Regulation.
This Policy applies to all visitors, registered users, buyers, contributors, reviewers and anyone else who interacts with KNICKPOINT. It should be read together with our Terms of Service, Refund Policy and any other notices we publish. Where we refer to "we", "us" or "our", we mean KNICKPOINT. Where we refer to "you", we mean the individual accessing or using the site.
By browsing the site, creating an account, purchasing or downloading a document, contributing a resource, leaving a review, or contacting us, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the site.
1. Who we are and how to contact us
KNICKPOINT operates the website at https://knickpoint.co.ke/. For the purposes of the Kenya Data Protection Act, 2019 (the "Act") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR"), we are the data controller in respect of the personal data described in this Policy.
If you have any questions, requests or complaints about this Policy or about how we handle your personal data, you can contact us at:
Email: dericketale254@gmail.com
Phone: · +254113446312
Website: https://knickpoint.co.ke/
We aim to respond to all legitimate requests within a reasonable period and, where the Act or GDPR sets a specific deadline, within the time required by law.
2. The legal and regulatory framework we follow
We handle personal data in accordance with:
The Kenya Data Protection Act, 2019, together with regulations and guidance issued by the Office of the Data Protection Commissioner ("ODPC").
The EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, where they apply to you.
Other applicable laws relating to electronic communications, consumer protection, taxation and record-keeping.
Where different laws apply to you, we apply the standard that gives you the greatest protection in respect of the rights described in this Policy.
3. Definitions
Personal data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on personal data, including collection, storage, use, disclosure, transfer, deletion and destruction.
Data subject means the individual to whom personal data relates.
Controller means the person or entity that determines the purpose and means of processing.
Processor means a person or entity that processes personal data on behalf of a controller.
Cookies means small text files placed on your device by a website.
M-Pesa means the mobile money service operated by Safaricom PLC.
Editoria Payment Hub means our payment processing partner.
4. Information we collect
We collect information in the following categories. Some of it is provided directly by you, some is generated automatically when you use the site, and some is received from third parties such as payment providers.
4.1 Purchase details
When you buy or download a document, we collect:
The document you buy or download.
The amount paid.
The invoice reference and any related transaction identifiers.
The M-Pesa confirmation, including the receipt code and the phone number used to pay.
The date and time of the transaction.
The status of the transaction (for example, completed, pending, reversed or refunded).
Any refund, chargeback or dispute information connected with the purchase.
Payments are processed by our payment partner (Editoria Payment Hub and Safaricom M-Pesa). We never see or store your M-Pesa PIN. We receive only the confirmation details needed to verify payment, deliver the document and keep proper accounting records.
4.2 Information you give us
When you contact us, request a document, contribute a resource, leave a review or otherwise interact with the site, we may collect:
Your name or the name you choose to use.
Your email address.
Your phone number.
The content of your message, request, contribution or review.
Any files, links or attachments you send us.
Your preferences and any consents you give or withdraw.
If you contribute a resource, we may also collect information about your authorship, licensing preferences and any attribution details you ask us to display.
4.3 Technical information
When you browse the site, we and our service providers automatically collect:
Your IP address, stored in a shortened, hashed form for security.
Your browser type and version.
Your device type and operating system.
The pages you visit, the time and duration of your visit, and the referring page.
The searches you make on the site.
Cookie identifiers and similar technical identifiers.
Approximate location derived from your IP address, where available.
This information is used to keep the site secure, to detect and prevent fraud and abuse, to troubleshoot problems, and to improve the site.
4.4 Information from third parties
We may receive limited information from:
Our payment partners, confirming that a payment has been made.
Analytics and advertising providers, such as Google, as described in sections 6 and 7.
Hosting and security providers, in the form of logs and security signals.
Public sources, where you have made information public and it is relevant to a contribution or review.
4.5 Sensitive data
We do not intentionally collect sensitive personal data, such as data revealing your health, religious beliefs, political opinions, trade union membership, genetic or biometric data, or data concerning your sex life or sexual orientation. Please do not send us such information. If you do, we will handle it only to the extent necessary to deal with your request and will delete it when it is no longer needed.
5. How we use information
We use personal data for the following purposes:
5.1 Delivering documents and purchases
To process your order and confirm your payment.
To deliver the document you paid for.
To let you recover a purchase later, including by re-sending a download link or restoring access.
To maintain a record of your purchases so we can resolve disputes and provide support.
5.2 Responding to requests and messages
To answer your questions, requests and complaints.
To process contributions and reviews you submit.
To notify you about changes to the site, this Policy or your purchases.
5.3 Security, fraud prevention and abuse prevention
To verify transactions and detect fraudulent or unauthorised activity.
To protect the site, our users and our service providers from abuse, spam, scraping and attacks.
To enforce our Terms of Service and other policies.
To keep logs and records for security and audit purposes.
5.4 Analytics and improvement
To understand how the site is used, which documents are popular and how visitors navigate the site.
To diagnose technical problems and improve performance, accessibility and content.
To test new features and measure their effectiveness.
5.5 Advertising
To show advertising that keeps many documents free.
To measure the performance of advertising.
To respect your consent choices where consent is required.
5.6 Legal and accounting compliance
To keep accounting, tax and transaction records as required by law.
To respond to lawful requests from regulators, courts and law enforcement.
To establish, exercise or defend legal claims.
5.7 Legal bases for processing
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
Contract: processing needed to deliver a document you have purchased or to take steps you have requested before entering into a contract.
Legitimate interests: processing needed for security, fraud prevention, analytics, service improvement and advertising, balanced against your rights and interests.
Consent: processing for advertising or analytics cookies where consent is required, and any other processing for which we ask your consent.
Legal obligation: processing needed to comply with accounting, tax, record-keeping or other legal duties.
Vital interests: processing needed to protect someone's life or safety in an emergency.
Public interest: processing needed for reasons of substantial public interest, where permitted by law.
Where the Kenya Data Protection Act, 2019 applies, we rely on the equivalent lawful bases set out in that Act, including consent, contract, legal obligation, vital interests, public interest and legitimate interests.
6. Advertising and Google cookies
We use Google AdSense to show ads. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to our users based on their visits to this site and/or other sites on the Internet.
6.1 What this means
Google and its partners may place and read cookies on your browser.
They may use web beacons, pixel tags and similar technologies.
They may collect information about your visits to this site and other sites.
They may use that information to show you personalised ads.
They may combine it with information they hold about you from other sources, subject to their own privacy policies.
6.2 Your choices
You may opt out of personalised advertising by visiting Google Ads Settings: https://adssettings.google.com
You can also opt out of some third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices
Learn how Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites
6.3 Consent for EEA, UK and Switzerland visitors
Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent before advertising or analytics cookies are used. Where consent is required, we will not use advertising or analytics cookies unless you have given consent. You can withdraw your consent at any time through the cookie banner or settings on the site, or by contacting us at dericketale254@gmail.com.
6.4 Other advertising partners
We may work with other advertising partners from time to time. Where we do, we will update this Policy and, where required, ask for your consent before using their cookies.
7. Analytics
We may use Google Analytics to understand how visitors use the site. It collects information such as pages viewed and the approximate location, using cookies. See https://policies.google.com/privacy for Google's privacy policy.
7.1 What we learn from analytics
Which pages and documents are most popular.
How visitors find the site.
How long visitors stay and where they leave.
Which devices and browsers are used.
Which countries or regions visitors come from, at an approximate level.
7.2 How we use analytics data
To improve the site and its content.
To fix problems and improve performance.
To plan future features and documents.
To measure the effectiveness of our communications and advertising.
7.3 Analytics cookies and consent
Where consent is required, analytics cookies will not be used until you give consent. You can withdraw consent at any time. You can also use browser settings and Google's opt-out tools to limit analytics tracking.
8. Cookies and similar technologies
We use cookies and similar technologies for:
Essential purposes: keeping the site secure, remembering your session, and enabling core functions such as downloads and payments.
Preferences: remembering your choices, such as language or cookie consent.
Analytics: understanding how the site is used.
Advertising: showing ads and measuring their performance.
You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the site from working. Where consent is required, we will ask for it before using non-essential cookies.
9. Sharing
We do not sell personal data. We share it only with service providers who help us run the site (hosting, payments, email, analytics, advertising), when the law requires it, or to protect our rights and users.
9.1 Categories of recipients
Hosting and infrastructure providers, who store and serve the site.
Payment providers, including Editoria Payment Hub and Safaricom M-Pesa, who process payments.
Email and communication providers, who help us send messages and respond to you.
Analytics providers, including Google Analytics.
Advertising providers, including Google AdSense and its partners.
Security and fraud prevention providers, who help us protect the site.
Professional advisers, such as lawyers and accountants, where needed.
Regulators, courts and law enforcement, where required by law.
Successors, if we merge, are acquired or transfer our assets, in which case personal data may be transferred as part of the transaction.
9.2 Safeguards
Where we share personal data with service providers, we require them to:
Process it only for the purposes we specify.
Protect it with appropriate technical and organisational measures.
Comply with applicable data protection law.
Return or delete it when the relationship ends, subject to legal requirements.
9.3 International transfers
Some of our service providers may be located outside Kenya, the EEA or the UK. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection, including by using appropriate safeguards such as standard contractual clauses, adequacy decisions or your consent where required.
10. Retention and security
We keep purchase records for as long as needed to provide downloads, resolve disputes and meet accounting duties. Data is protected with access controls, encrypted connections (HTTPS) and limited retention of logs.
10.1 Retention periods
Purchase records: kept for as long as needed to provide downloads, resolve disputes and meet accounting and tax duties, and then deleted or anonymised.
Contact messages: kept for as long as needed to respond and for a reasonable period afterwards for reference, then deleted.
Contributions and reviews: kept for as long as they are published, and for a reasonable period afterwards for record-keeping, unless you ask us to delete them.
Technical and security logs: kept for a limited period, typically no longer than necessary for security and troubleshooting, and then deleted or anonymised.
Analytics data: kept according to the settings of our analytics providers, and in any event no longer than necessary for the purposes described in this Policy.
Consent records: kept for as long as needed to demonstrate compliance, and then deleted.
10.2 Security measures
We use a range of measures to protect personal data, including:
Access controls and role-based permissions.
Encrypted connections (HTTPS).
Hashed or shortened storage of IP addresses.
Limited retention of logs.
Regular review of our security practices.
Training and awareness for staff and contractors who handle personal data.
10.3 No absolute guarantee
No method of transmission or storage is completely secure. While we take reasonable steps to protect personal data, we cannot guarantee absolute security. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as required by law.
11. Your rights
You may ask to access, correct or delete your personal data, or object to its use, by writing to dericketale254@gmail.com. You may also complain to the Office of the Data Protection Commissioner (Kenya): https://www.odpc.go.ke
11.1 Your rights under the Kenya Data Protection Act, 2019
Subject to the conditions in the Act, you have the right to:
Be informed about how your personal data is used.
Access your personal data.
Request correction of inaccurate or incomplete data.
Request deletion of data that is no longer needed or that has been unlawfully processed.
Object to processing.
Request restriction of processing.
Data portability, where applicable.
Withdraw consent at any time, where processing is based on consent.
Lodge a complaint with the ODPC.
11.2 Your rights under the GDPR and UK GDPR
Where the GDPR or UK GDPR applies, you have the right to:
Access your personal data and receive a copy.
Rectify inaccurate or incomplete data.
Erase data in certain circumstances.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests or for direct marketing.
Data portability in certain circumstances.
Withdraw consent at any time.
Lodge a complaint with your local supervisory authority.
11.3 How to exercise your rights
To exercise any of these rights, contact us at dericketale254@gmail.com. We may ask you to verify your identity before acting on your request. We will respond within the time required by law. If we cannot comply with your request, we will explain why.
11.4 Complaints
If you are unhappy with how we have handled your personal data, you can complain to:
Office of the Data Protection Commissioner (Kenya): https://www.odpc.go.ke
Your local supervisory authority in the EEA, the UK or Switzerland, where applicable.
We would appreciate the chance to address your concerns before you approach a regulator, so please contact us first at dericketale254@gmail.com.
12. Children
The site is intended for a general audience. We do not knowingly collect personal data from children under 13 without parental consent.
12.1 Our approach
We do not direct the site at children under 13.
We do not knowingly collect personal data from children under 13 without parental consent.
If we learn that we have collected personal data from a child under 13 without parental consent, we will delete it promptly.
If you are a parent or guardian and believe we have collected data from a child under 13, please contact us at dericketale254@gmail.com.
12.2 Older children
Where local law requires consent from a parent or guardian for children older than 13, we will comply with that law. If you are a young person and are unsure whether you can use the site, please ask a parent or guardian.
13. Changes
We may update this policy; the date below shows the latest version.
13.1 How we notify you
We will post the updated Policy on the site.
We will change the "Last updated" date.
Where changes are significant, we may also notify you by email or through a notice on the site.
13.2 Your continued use
Your continued use of the site after an update means you accept the updated Policy. If you do not agree, please stop using the site and contact us if you have questions.
14. Additional information for specific regions
14.1 Kenya
If you are in Kenya, the Office of the Data Protection Commissioner is the supervisory authority. You can contact them at https://www.odpc.go.ke. We comply with the Kenya Data Protection Act, 2019 and its regulations.
14.2 European Economic Area, United Kingdom and Switzerland
If you are in the EEA, the UK or Switzerland, you have the rights described in section 11.2. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object. You can also complain to your local supervisory authority.
14.3 California, United States
If you are a California resident, you may have additional rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing, and the right to non-discrimination. We do not sell personal data. To exercise your rights, contact us at dericketale254@gmail.com.
14.4 Other regions
If you are in a region with its own data protection laws, you may have additional rights. Please contact us at dericketale254@gmail.com and we will do our best to help.
15. How we handle do-not-track signals
Some browsers offer a "Do Not Track" ("DNT") signal. There is no common industry standard for how to respond to DNT. We do not currently respond to DNT signals, but you can use the cookie controls described in this Policy to limit tracking.
16. Third-party links
The site may contain links to third-party websites, including payment providers, advertising partners and resources. We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing personal data.
17. Business transfers
If we merge, are acquired, reorganise or transfer our assets, personal data may be transferred as part of the transaction. We will require the recipient to honour this Policy, and we will notify you of any material changes.
18. Automated decision-making and profiling
We do not currently use automated decision-making that produces legal or similarly significant effects. We may use profiling for analytics and advertising, as described in this Policy. Where we use automated decision-making in the future, we will update this Policy and, where required, provide you with information about the logic involved and how to request human review.
19. Data minimisation and accuracy
We aim to collect only the personal data we need for the purposes described in this Policy. We take reasonable steps to keep personal data accurate and up to date. You can help us by telling us when your information changes.
20. Accountability and governance
We take steps to comply with our obligations under applicable data protection law, including:
Keeping records of our processing activities.
Conducting data protection impact assessments where required.
Implementing appropriate security measures.
Training staff and contractors.
Reviewing our practices regularly.
Appointing a contact point for data protection queries.
21. Contact
Contact: dericketale254@gmail.com · +254113446312
If you have any questions about this Policy, please contact us at dericketale254@gmail.com or · +254113446312. You can also write to us through the site at https://knickpoint.co.ke/.
Last updated: 26 September 2026
Other policies: Terms of Use · Cookie Policy · Copyright & Takedown · Disclaimer