Privacy Policy

1. Introduction

Orange Sands Ltd ("We", "Us") operates KURO, a universal visitor and access management platform. We are committed to protecting the privacy of hosts, visitors, and security personnel across all our managed facilities (Estates, Commercial Towers, Schools, and Logistics Hubs). This policy outlines how we collect, use, and protect your data in accordance with the Data Protection Act of Kenya.

2. Data We Collect

We collect the minimum data required for security and auditing purposes:

• Visitors/Clients/Drivers: Name, Phone Number, Vehicle Registration Plate, National ID/Passport Number (where applicable), and Photo.
• Hosts (Residents/Tenants/Staff): Name, Unit/Office Number, Phone Number, Email Address.
• Security Personnel: Name, ID Number, Phone Number, Guard PIN, and Shift Time Logs.

4. Purpose of Collection

The "Lawful Basis" for this processing is Legitimate Interest (ensuring the security, safety, and operational efficiency of the managed facility). Data is used solely for:

• Controlling and verifying access to the premises.
• Maintaining digital audit trails of entries/exits for security investigations and facility compliance.
• Emergency and operational communication with authorized hosts.

5. Data Protection Measures

Comprehensive data protection measures have been implemented to safeguard your personal information:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256 encryption).
• Secure Infrastructure: Data is stored on ISO 27001 certified cloud infrastructure with enterprise-grade security.
• Access Control: Strict Row Level Security (RLS) ensures absolute data isolation—no facility can access another facility's data.
• Authentication: Secure authentication protocols (PKCE) prevent unauthorized access to accounts.
• Rate Limiting: API rate limiting protects against abuse and unauthorized access attempts.
• Secure Tokens: Time-limited, cryptographically signed tokens for all sensitive operations.
• Minimal Data Collection: We only collect data essential for security and operational purposes.
• Access Logging: All data access is logged for audit and compliance purposes.

6. Data Sharing & Retention

We do not sell personal data to advertisers or third parties. Data is only accessible to:

• The specific Facility Management or Estate Committee (Data Controller) utilizing the software.
• Law Enforcement Agencies (strictly upon presentation of a valid legal warrant or court order).

Visitor logs are retained for a period determined by the specific Facility Management (typically 6-12 months) for security audit purposes, after which they are systematically anonymized or securely deleted.

7. Your Rights

Under the ODPC regulations, you have the right to access, correct, or request deletion of your data (subject to overarching security and legal retention mandates). Please direct initial inquiries to your respective Facility Management Office. You may also escalate data protection queries directly to us at: