Last updated: 05 July 2026 — We are committed to protecting your personal data.
Investika Limited ("we", "us") is a prediction market operator licensed by the Betting Control and Licensing Board (BCLB) of Kenya. We are the data controller for personal data processed through this Platform. Contact: support@predictea.co.ke
We collect the following categories of personal data: (a) Identity data: full name, date of birth, national ID number, facial image (via Smile Identity); (b) Contact data: phone number, email address (optional); (c) Financial data: M-Pesa transaction history, wallet balances, trade history; (d) Device data: FCM token (for push notifications), IP address; (e) Usage data: pages visited, markets viewed, trading activity; (f) Responsible gambling data: self-exclusion periods, deposit and loss limits.
We use your data to: (a) verify your identity and age as required by BCLB regulations; (b) operate your account and process deposits, withdrawals, and trades; (c) detect and prevent fraud, money laundering, and collusion; (d) send you transaction confirmations and platform notifications; (e) comply with our legal and regulatory obligations, including KRA withholding tax reporting; (f) honour self-exclusion requests and responsible gambling tools; (g) improve the Platform and conduct analytics. We do not use your data for automated decision-making that has legal or similarly significant effects without human oversight.
We process your data on the following grounds: (a) Contract performance — to provide our trading services; (b) Legal obligation — BCLB licensing, KYC, AML/CFT, and tax compliance; (c) Legitimate interests — fraud prevention, Platform security; (d) Consent — marketing communications (you may withdraw consent at any time).
We share your data with: (a) Smile Identity Ltd — for national ID and facial verification; (b) Safaricom PLC — for M-Pesa payment processing; (c) Africa's Talking Ltd — for SMS OTP delivery; (d) Amazon Web Services (AWS) — for encrypted document storage (S3); (e) Google Firebase — for push notification delivery; (f) BCLB, KRA, and law enforcement agencies — when required by law. We do not sell your personal data to third parties.
We retain your data for as long as your account is active, plus: (a) Financial transaction records: 7 years (required by KRA); (b) KYC documents: 5 years after account closure (required by BCLB); (c) Marketing consent records: until withdrawn + 3 years. You may request deletion of data not subject to legal retention obligations.
We implement the following security measures: (a) End-to-end TLS encryption for all data in transit; (b) Encryption at rest for national ID numbers and KYC documents; (c) Two-factor authentication for admin access; (d) Hashed passwords (bcrypt) — we never store passwords in plain text; (e) Optimistic locking on wallet balances to prevent race conditions; (f) IP allowlisting for payment callbacks.
Under Kenyan data protection law (Data Protection Act, 2019), you have the right to: (a) access a copy of your personal data; (b) rectification of inaccurate data; (c) erasure of data we are not legally required to retain; (d) object to processing for direct marketing; (e) lodge a complaint with the Office of the Data Protection Commissioner (ODPC). Contact us at support@predictea.co.ke to exercise any of these rights. We will respond within 21 days.
We use session cookies for authentication and preference cookies for your language and display settings. We do not use tracking or advertising cookies. You may disable cookies in your browser, but this will affect Platform functionality.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you via SMS or email at least 7 days before material changes take effect.
Contact our DPO at dpo@predictea.co.ke. You may also contact the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.