This policy explains how DigitalCertVerify handles personal data when institutions publish certificate records, when verifiers check them, and when anyone uses this website. It is written to meet the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
1. Who we are
DigitalCertVerify is an online academic certificate verification service operated by Tildai Tech ("we", "us"), Kenya.
- Contact and Data Protection Officer: verification@tildaitech.com
- ODPC registration number: [to be added once registration is complete]
- Postal address: [to be added]
Our role. Universities and other institutions decide which graduate records to publish and whether a certificate is valid; for those records they are the data controller and we process the data on their behalf under a data processing agreement. For user accounts, payments, security logs and the verification service itself, we are the data controller.
2. Personal data we process
| Whose data | What | Where it comes from |
|---|---|---|
| Graduates and certificate holders | Full name, registration number, certificate number, institution, award and course, grade or class, year of graduation, verification status, and the date it was decided | The issuing institution, by bulk upload or by approving a submission; or the person who submitted the certificate for verification |
| Account holders (individuals, employers, institution representatives, administrators) | Username, email address, password (stored only as a one-way hash), user type, institution or organisation, role at that organisation, contact details and website you provide, two-factor login setting, date you accepted this policy | You, when you sign up or edit your profile |
| People who pay for a verification | M-Pesa phone number, amount, M-Pesa receipt number, time of payment, refund requests | You, and Safaricom through our payment gateway |
| Verifiers and API clients | The certificate or registration numbers you search, the results, bulk verification uploads, API key usage counts | You |
| Everyone using the site | IP address, the pages and actions requested, login attempts, browser type, and records of security-relevant changes (the audit log) | Collected automatically |
| People who contact us | Name, email address, subject and message | You, through the contact form |
We do not intend to collect sensitive personal data as defined in the Act (such as health, ethnicity, religion or biometrics). Please don't include it in messages or uploads. We do not knowingly process data of children; accounts are for people aged 18 and over.
3. Why we use it and our lawful basis
| Purpose | Lawful basis (Data Protection Act, section 30) |
|---|---|
| Confirming whether a certificate is genuine for a verifier, and showing the live result of a QR code or share link | Performance of our agreements with institutions; legitimate interest of institutions, employers and the public in preventing academic fraud |
| Creating and running your account, including email verification, password reset and two-factor login | Performance of a contract with you |
| Taking payments, issuing receipts and handling refunds | Performance of a contract; legal obligation (tax and accounting records) |
| Notifying institutions of submissions and requesters of decisions | Performance of a contract |
| Keeping the service secure: rate limits, login lockout, audit log, fraud and abuse detection | Legitimate interest in protecting the service and the people whose records it holds |
| Answering messages and complaints | Legitimate interest; your request |
| Complying with court orders and lawful requests from authorities | Legal obligation |
We do not use your data for advertising or marketing, and we do not sell it.
4. Who can see it
- Verifiers see a certificate's details only after they pay for that lookup, or when the graduate gives them a share link or the QR code on a verification report.
- Anyone holding a QR code or share link sees the certificate's current status, name, institution, award, grade, year and certificate number. Share links expire and can be revoked by the graduate at any time.
- The issuing institution sees records for its own graduates and submissions made to it.
- Our staff see what they need to run and support the service. Every change they make is recorded in the audit log.
- Service providers acting for us: our payment gateway and Safaricom (M-Pesa) to process payments; our hosting provider; our email provider to send messages. They may use the data only to provide their service to us.
- Authorities, when the law requires it.
5. Transfers outside Kenya
Our servers or service providers may be located outside Kenya ([hosting location to be added]). Where data leaves Kenya we do so only as allowed by sections 48 to 50 of the Act, with appropriate safeguards such as contractual protections and security measures at least as strong as those described here.
6. How long we keep it
| Data | How long |
|---|---|
| Certificate records | As long as the issuing institution remains a participant, or until it asks us to remove them |
| Accounts | While the account is active, then up to 2 years after it is closed |
| Accounts never verified by email | Up to 90 days |
| Payment and refund records | 7 years, for tax and accounting law |
| Verification requests and bulk uploads | 2 years |
| Audit log and security records | 3 years |
| Server error logs | 90 days |
| Contact messages | 2 years |
After these periods we delete the data or anonymise it so it no longer identifies anyone.
7. How we protect it
- All traffic is encrypted (HTTPS).
- Passwords and API keys are stored only as one-way hashes.
- Two-factor login is required for administrators and institution representatives.
- Each user can only reach their own data, and institutions only their own records; every access rule is denied by default.
- Changes to certificate records, user roles and payments are written to an audit log that can't be edited or deleted from the application.
- Verification links are encrypted and authenticated, and reports can be digitally signed, so they can't be forged or altered unnoticed.
- Logins are locked after repeated failures; public pages are rate-limited against scraping.
Data breaches. If a breach puts your rights at real risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell affected people as soon as practical, as required by section 43 of the Act.
8. Decisions about you
We do not make decisions about people by automated means alone. Whether a certificate is valid is decided by the issuing institution, not by our software.
9. Your rights
Under section 26 of the Act you have the right to:
- be informed of how your data is used (this policy);
- access your data: use Download my data in your account, or email us;
- correct data that is wrong or misleading;
- have data deleted when we no longer have a lawful reason to keep it;
- object to processing based on legitimate interest;
- restrict processing while a complaint is looked into;
- data portability: receive your data in a machine-readable format (the download is JSON).
Email verification@tildaitech.com to use any of these rights. We may ask you to prove your identity first. We answer access requests within 7 days and correction or deletion requests within 14 days, as the Regulations require, and tell you if we can't comply and why.
If your certificate record is wrong (for example a misspelt name or wrong grade), contact the institution that issued it and tell us too. Only the institution can change an academic record; we will pass your request on and help until it is resolved.
10. Cookies
We use only cookies that the site needs to work: a session cookie to keep you logged in, a "remember me" cookie if you tick that box, and a security cookie that protects forms (CSRF). We do not use advertising or third-party tracking cookies.
11. Complaints
Please contact us first and we will try to put things right. You can also complain to the Office of the Data Protection Commissioner (ODPC), Kenya: www.odpc.go.ke.
12. Changes to this policy
We will update the date shown on this page when the policy changes, and email account holders about significant changes before they take effect.