Legal

Data Protection

Last updated: 1 June 2026

This statement sets out how Chura protects the data entrusted to us and complies with the Kenya Data Protection Act, 2019. It complements our Privacy Policy.

Your recipient lists are private

All information relating to your recipient lists — phone numbers, names, amounts and any notes — is private and accessible only to you and the authorised members of your organisation. We treat this data as confidential and apply access controls so that no other customer can view it.

How we protect your data

Access controls so that recipient lists and account data are visible only to you and your authorised team members.
Encryption of data in transit between your browser and our platform.
Role-based permissions, Maker/Checker controls and transaction PINs to limit who can act on your account.
Audit logs that record key actions for accountability.

We will never sell your data

Chura does not, and will not, sell your personal data or your recipients’ data to third-party companies for marketing or any other purpose. We share data only where strictly necessary to deliver the service (for example, passing a phone number to the relevant mobile network operator to complete a top-up) or where required by law.

Lawful basis and purpose limitation

We process personal data only for the purposes of operating the service — delivering airtime, processing payments, issuing receipts and providing governance and reporting. We do not repurpose your data for unrelated uses.

Data processors

Where we rely on third parties (such as mobile network operators and payment partners) to deliver the service, we share only the minimum data necessary and require them to handle it securely.

Service availability depends on mobile network operators

Airtime distribution is delivered through third-party mobile network operators (Safaricom, Airtel and Telkom). Chura does not control their networks, and the availability, speed and successful delivery of any top-up depends on the relevant operator’s systems being online and operational. Outages, maintenance, congestion or restrictions on an operator’s side may delay or prevent delivery, and these events are outside Chura’s control.

Your data protection rights

You have the right to access, rectify, erase and restrict processing of your personal data, and to lodge a complaint with the Office of the Data Protection Commissioner. Contact us to exercise these rights.

Questions?