Privacy notice.

Oddriva Kenya Pilot Privacy Notice Version kenya-pilot-v2 · Effective 10 November 2026 The official pilot launch is scheduled for 20 November 2026. 1. Who controls your information ODDRIVA LIMITED, company number PVT-7816PYPV, of Kipro Center, Sports Road, Westlands, Nairobi, Kenya, P.O. Box 472-00100, Nairobi, is the data controller for this pilot. You can reach the Kenya Privacy Team at info@oddriva.app with the subject “Kenya privacy request” or write to the postal address above. This notice covers analysts who register or use the pilot and visitors to the Kenya pilot site. It explains the intake phase and identifies the additional processing that would begin if the financial phase opens. 2. What we collect and why - Account details. Your existing or newly created Oddriva account is used to sign in to both sites. Oddriva’s shared sign-in verifies your password and, where enabled, your authenticator. When you join the Kenya pilot, we use your verified email address, name and an internal account identifier to link your shared account to your Kenya workspace. The Kenya workspace records your age confirmation, the agreement and notice versions and when you accepted the agreement. We use these details to set up your workspace and perform the agreement. We keep limited proof for our legitimate interests in security, accountability and dispute resolution. - Sessions and security. Our systems generate sign-in and session records and may record IP addresses, browser details, sign-in attempts and security events. We process these and any authenticator or recovery information you choose to set up to keep you signed in, protect accounts, limit abuse and investigate incidents. We rely on contract performance for essential sessions and on our legitimate interests for security and accountability. - Research and review. You provide booking codes, selections, odds, proposed stake amounts and redacted screenshots. Our systems record submission times, and our reviewers record notes and decisions. We use this information to review your research and enforce submission limits under the agreement. Our legitimate interests include checking evidence and resolving disputes. - Support and privacy requests. We use the information you send us, our replies and any records of action to help you under the agreement, resolve complaints in our legitimate interests and respond to statutory requests as required by law. - Financial records if the funded phase opens. We would process ticket attribution, company placement and settlement records, rewards and evidence needed to make, reconcile and account for payments. For manual M-PESA, we would need a verified beneficiary name and number and a transaction reference. We would rely on contract performance, legitimate interests in payment integrity and applicable legal obligations. We will tell analysts about the applicable retention period and any additional information we need before this phase begins. A shared Oddriva account with a verified email address, age confirmation and acceptance of the Kenya agreement are required to join the pilot. Research evidence is needed to review a Drop. If withdrawals open, verified payment details will be needed to pay a request. You may decline to provide information or stop using the pilot. The related function may then be unavailable. Oddriva uses essential cookies to support sign-in and account security. The Kenya pilot does not use the Oddriva live visitor tracker or advertising cookies. Automated checks can enforce access and submission rules. Staff review research and disputes, and handle restrictions on accounts. Please redact unrelated information before uploading any screenshot. Never upload another person’s details, identity documents, credentials or unredacted account balances through the research form. 3. Who receives information and where it is processed Authorised Kenya pilot staff and operators can access information needed for their roles. Hosting, backup and transactional email providers may process information on Oddriva’s instructions. A bookmaker receives the code or ticket information needed to review or place the company’s own ticket when that activity is enabled. Analysts’ private contact and payment details are not routinely shared with bookmakers. When manual payments open, Oddriva may share the necessary beneficiary and transfer details with its M-PESA provider and relevant financial institutions. Advisers, auditors, regulators, tax authorities or courts may receive information where necessary and lawful. Shared Oddriva sign-in is operated through oddriva.app by ODDRIVA LTD, Nigeria, under its account privacy notice at https://oddriva.app/privacy. It handles the shared login account, while the Kenya pilot receives the verified identity needed to create or revisit your Kenya workspace. The country-specific research and financial records remain separate. The retention periods below apply to Kenya pilot records; the shared sign-in account follows the account privacy notice. The pilot application and its separate database run on Hostinger infrastructure in Manchester, United Kingdom. Account, session and research information, including submitted screenshots, is processed there. Hostinger stores the VPS’s weekly backups separately in Germany. Those backups can contain copies of the application records. Hostinger processes account email such as verification and password reset messages. Hostinger says it stores mailbox data and mailbox backups in France and Germany and may move them between those countries. The service processes recipients’ email addresses and message contents. Your own email provider also handles the messages you receive and may process them in other countries. Oddriva has completed a transfer review for the pilot’s UK hosting, German VPS backups and Hostinger Mail arrangements in France and Germany. Oddriva records the applicable Kenyan transfer grounds and safeguards in that review. We limit transfers to information needed for the stated purposes, restrict access by role, use HTTPS and encrypted mail connections, and control access to providers and recovery copies. You can ask the Kenya Privacy Team for information about the destinations, recipients, transfer grounds and safeguards that apply. 4. Retention and security Oddriva uses the following schedule for the research intake phase. The periods refer to records in active systems, including Oddriva’s relevant mailbox copies. - Sign-in and enrolment handoff. Kenya enrolment requires a verified shared account. A temporary sign-in record expires within 10 minutes and is removed when used or as part of the verification-record cleanup below. - Verified account details. While the account is active, then up to 90 days after you close your account or the pilot ends, whichever happens first. - Verification, recovery and session records. Up to 30 days after a verification or reset record expires, and up to 90 days after a session or trusted-device record expires or is revoked. We keep routine sign-in and abuse-prevention records for up to 90 days after the last relevant activity. - Raw research screenshots. Up to 90 days after the last review of the submission, with a limit of 180 days from upload. We keep unreviewed screenshots for up to 180 days from upload. - Research submissions and review decisions. Up to 12 months after the last review, or from submission if the Drop remains unreviewed. - Support. Up to 12 months after we resolve an ordinary support enquiry. - Agreement acceptance, privacy requests and significant security events. Up to 24 months after your account closes or the pilot ends for essential acceptance evidence, or after the request, incident or privileged action is closed or completed for the other records. At the end of these periods, Oddriva deletes personal information or anonymises it. If we need to keep specific records for a legal obligation, a security investigation or a dispute, we restrict access, retain only what we need and review when we can remove it. Hostinger rotates the two weekly VPS recovery points as new backups replace them. Deleted records may remain in those backups until they rotate out. Hostinger manages the rotation of its separate mailbox backups. Oddriva also retains restricted, encrypted recovery copies for up to 14 days. We restrict backup access to recovery purposes and reapply pending deletions when restoring data before putting it back into use. Oddriva uses HTTPS for the site, encrypted connections to send account email and multi-factor authentication for operator access. We restrict access by role. Screenshots are available to the submitting analyst and authorised staff whose role requires access. Oddriva investigates suspected breaches and notifies affected persons and the Office of the Data Protection Commissioner as required by law. 5. Your rights and contact You may ask how Oddriva uses your personal data, request access and correction, object to processing, request deletion or restriction where applicable, and request a portable copy where the law provides it. If Oddriva relies on consent for a specific optional purpose, you may withdraw it for future processing. Rights may be subject to lawful limits, including retention of records required to meet legal obligations or resolve a dispute. Email info@oddriva.app with the subject “Kenya privacy request” to exercise a right, ask about an automated restriction or raise a complaint. Oddriva may need to verify that the request comes from you or your authorised representative. You may also complain directly to Kenya’s Office of the Data Protection Commissioner through its official complaints portal at https://cie.odpc.go.ke/Complaint. The pilot is for adults. Contact the privacy team if you believe an account belongs to a child or a screenshot contains personal information that should be removed. Oddriva will publish material changes and notify affected participants where appropriate.