Privacy policy
The data you give us is important to you. This policy explains, in plain language, what the Voterswall platform does with it and how we protect it.
Last updated: 30 October 2026
1. Who we are and our role
Voterswall is an election platform operated by VotersWall Institute of Democracy (“VotersWall”, “we”, “us”). Institutions — universities, polytechnics, colleges, schools, SACCOs, unions, associations and other organisations — use it to run their elections online and at supervised voting stations.
When we run an election for an institution, the institution is the data controller: it decides who is on its register, which details are collected and what the election is for. VotersWall is the data processor: we process that data only on the institution’s documented instructions and for that election. For our own website, demo requests and the accounts of institution staff we are the data controller.
2. What personal data we process
We only process what an election needs. Depending on how the institution sets up its election, this is:
- Register entries supplied by the institution: full name, the institution’s unique key (for example an admission or member number), gender, mobile phone number and/or email address, and the subgroups used for eligibility and turnout (for example campus, department, class or branch). We also record whether a voter has been verified and whether and when they voted, and by which channel (online or station) — never how they voted.
- Candidates: the preferred name, photo and slogan shown on the ballot, the position they stand for and, where used, an agent’s name and phone number.
- Staff accounts (administrators, returning officers, register clerks, station officers): name, email address, phone number, role and sign-in history.
- Security and limit data: IP address, a random device identifier kept in a cookie, browser and operating system family, device type and the time of each sign-in. These enforce per-device and per-network voting limits set by the institution, protect against abuse and appear in the election’s audit trail.
- One-time codes (OTP) sent by SMS or email to sign in. Codes are never stored in plain text: we keep only a keyed hash, and each code expires within minutes.
- Demo requests from this website: name, organisation, email, phone number (optional), expected number of voters, your message and the IP address used.
We do not ask voters for their age, home address or national ID number unless the institution chooses one of these as its unique key. We do not use biometrics.
3. Ballot secrecy
Your vote is secret, including from us. Each ballot is encrypted on submission and stored in an insert-only, hash-chained ballot store with no link to the voter, the voter’s session, device, IP address or the time it was cast. Results can only be decrypted at the end of the election, in a ceremony that needs at least two of three key custodians. The register shows only that you voted, so you cannot vote twice; it never shows your choices.
4. Why we use it and on what legal basis
Under section 30 of the Data Protection Act, 2019 we process personal data:
- to run the institution’s election on its behalf — verifying eligible voters, sending sign-in codes and voting links, presenting the right ballot, counting votes and producing results, reports and certificates (performance of the institution’s election mandate and of our contract with it);
- to keep elections secure and auditable — preventing fraud and abuse, enforcing voting limits and keeping a tamper-evident audit trail (legitimate interests and compliance with legal obligations);
- to answer demo requests you send us (steps taken at your request before a contract).
We do not use election data for marketing, we do not sell it, and we do not use it for any purpose other than the institution’s election.
6. How long we keep it
We keep election data for as long as the institution instructs, and no longer than needed for the election and for resolving any dispute about it.
To be honest about how integrity works: the audit trail and the sealed ballots are append-only by design. Individual entries cannot be edited or deleted, because that is what makes the election verifiable. They are kept for the period in which the result can be challenged and until any dispute is finally resolved, then archived or deleted as a whole as agreed with the institution. The sealed ballots contain no personal data.
Sign-in codes expire within minutes. Demo requests are kept while we follow up on them and are deleted when you ask us to.
7. Your rights
Under the Data Protection Act, 2019 you have the right to be informed of how your data is used, to access it, to object to its processing, to have false or misleading data corrected or deleted, and to data portability.
Because the institution controls its register, please contact your institution first (for example its election office or register clerk); it can correct register details before voting opens. You can also write to us at [email protected] — we will help, or pass your request to the institution and support it in answering.
Some requests cannot be met once voting has started: a cast vote cannot be changed or withdrawn, and audit entries cannot be removed, because the election must stay verifiable. Your ballot itself is anonymous and cannot be traced back to you.
8. Complaints
If you are not satisfied with how your data has been handled, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya — www.odpc.go.ke. We would appreciate the chance to resolve it first at [email protected].
9. Children
Voterswall is used for some school elections. In that case the school, as data controller, is responsible for having a lawful basis to process pupils’ data, including any parental or guardian consent required by section 33 of the Act. We process children’s data only on the school’s instructions, and only what the election needs. A parent or guardian with a concern can contact the school or write to us at [email protected].
11. How we protect it
- Encryption: ballots are encrypted per ballot; connections use HTTPS; secrets such as gateway keys are stored encrypted.
- One-time codes for every sign-in: voters sign in with their unique key and an OTP; every staff account uses two-factor sign-in, with attempt limits and lockouts.
- Tamper-evident audit trail: security-relevant actions are recorded in a hash-chained, insert-only log that can be exported and independently verified.
- Limits and rate limiting on sign-ins, codes and voting per device and per network.
- Least privilege: staff see only what their role needs; access is logged.
- Key custody: results can only be decrypted by at least two of three key custodians together.
No system is perfectly secure. If a personal data breach occurs we will notify the institution without delay so that it, and we where required, can notify the Data Protection Commissioner and affected people as the Act requires.
12. Changes to this policy
We may update this policy when the platform or the law changes. The date at the top shows the latest version; significant changes will be announced on this website and to the institutions we work with.
13. Contact us
For questions or requests about this policy or our data practices:
- [email protected]
- Kenya address
- Wang'ong'u Center, Waiyaki Way, Kenya
- US address
- 6565 N. MacArthur Blvd, #225, Irving, TX 75039, USA
