World Cup 2026 Kids Football, Summer School Break. Ages 4 to 15, girls and boys. Apply now. See the schedule
Book Now

Privacy Policy

How we collect, use, and protect your personal data.

1. Who We Are

PAKTB Grace Sports Center ("we", "us", "our") operates the website paktb.ke and the physical sports venue located at Thindigua, off Kiambu Road, Kiambu County, Nairobi, Kenya. We are the data controller for the personal information described in this policy.

Contact: info@paktb.ke | +254 712 192 898

2. What Data We Collect

We collect the following categories of personal data when you use our website and booking services:

  • Account information — full name, email address, phone number, password (hashed)
  • Booking details — date, time slot, booking reference, session notes
  • Payment information — M-PESA transaction ID, payer phone number, amount, transaction date. We do not store card numbers or M-PESA PINs.
  • Business information (B2B customers) — company name, KRA PIN, physical address, contact person details
  • Contact form submissions — name, email, phone (optional), subject, message content
  • Technical data — IP address, browser type, pages visited, collected automatically via cookies and server logs
  • Academy & event registration: parent/guardian name, phone, email, and an emergency contact name and number; for each child, their name, date of birth, age group, gender, and school name; and consent records

3. How We Use Your Data

We process your personal data for the following purposes:

  • Creating and managing your account
  • Processing and confirming pitch bookings
  • Processing payments via M-PESA (Safaricom Daraja API)
  • Generating invoices, proforma invoices, and credit notes
  • Communicating booking confirmations, reminders, and service updates
  • Responding to your enquiries via the contact form
  • Improving our website and services
  • Complying with legal obligations, including Kenya Revenue Authority (KRA) eTIMS requirements

4. Legal Basis for Processing

Under the Kenya Data Protection Act, 2019, we process your data on the following legal bases:

  • Contract performance — processing bookings, payments, and account management
  • Legitimate interest — improving our services, website analytics, preventing fraud
  • Legal obligation — tax compliance (eTIMS), record-keeping requirements
  • Consent — marketing communications (you may withdraw consent at any time)
  • Parental / guardian consent: for collecting and processing a child's personal data (Kenya Data Protection Act, 2019, Section 33)

5. Third-Party Data Sharing

We share your personal data only with the following parties, and only to the extent necessary:

  • Safaricom PLC — M-PESA payment processing via the Daraja API
  • Kenya Revenue Authority (KRA) — invoice data submitted via eTIMS for tax compliance
  • Hostinger International Ltd — website hosting provider (data stored on their servers)
  • Google LLC — website analytics via Google Site Kit (anonymised usage data)

We do not sell, rent, or trade your personal data to any third party.

6. Data Retention

  • Account data — retained while your account is active, deleted within 90 days of account closure
  • Booking records — retained for 7 years (Kenya tax law requirement)
  • Invoice records — retained for 7 years (KRA eTIMS requirement)
  • Contact form messages — retained for 12 months, then deleted
  • Server logs — retained for 90 days
  • Academy / event applications: retained for the duration of the program plus 24 months, then deleted

7. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion of your data (subject to legal retention requirements)
  • Restriction — request we limit processing of your data
  • Data portability — receive your data in a structured, commonly used format
  • Object — object to processing based on legitimate interest
  • Withdraw consent — where processing is based on consent

To exercise any of these rights, email us at info@paktb.ke. We will respond within 30 days.

8. Cookies

Our website uses the following cookies:

  • Essential cookies — WordPress session cookies required for login and booking functionality
  • Analytics cookies — Google Analytics (via Site Kit) to understand how visitors use our site

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the booking system.

9. Data Security

We implement the following measures to protect your personal data:

  • HTTPS/TLS encryption for all data in transit
  • Passwords stored using one-way hashing (never stored in plain text)
  • Sensitive credentials (eTIMS, payment gateway) encrypted at rest using AES-256-CBC
  • Role-based access controls limiting staff access to necessary data only
  • Rate limiting on login and contact form submissions

10. Children's Privacy

Our booking system is for adults (18+). Academy and youth programs are different: when a parent or guardian registers a child, we collect limited personal data about that child, specifically the child's name, date of birth, age group, gender, and school name.

Each of those items serves a stated purpose: the date of birth confirms the child is eligible for the age group and lets us place them in the right squad; the school name helps us group children who train together and identify a child where two share a name. We also ask the guardian for an emergency contact name and number so a responsible adult can be reached if the guardian cannot be. Where that emergency contact is a third party, the guardian confirms they have that person's permission to give us their number.

We collect and process children's data only with the consent of the parent or guardian, given at the point of registration, and only to run the program, keep children safe, and communicate with the guardian about participation. We do not use children's data for marketing. Photographs or video of a child are used in our marketing only where the guardian gives separate, optional consent.

Access to a child's full details is restricted to administrators. Other staff working the program see only the child's initials and age group, together with the guardian's contact number, in line with the data minimisation principle.

A parent or guardian may ask us to access, correct, or delete their child's data at any time by emailing info@paktb.ke. This is handled in accordance with Section 33 of the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date. Continued use of our services after changes constitutes acceptance of the revised policy.

12. Contact & Complaints

For privacy-related enquiries or complaints:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya: www.odpc.go.ke

Effective date: August 17, 2026