Privacy Policy

1. Introduction & Data Controller

The Horizon Wire is a digital news and public-affairs platform published from Kenya, operating at https://thehorizonwire.co.ke/ and related subdomains. For the purposes of the Kenya Data Protection Act, 2019 (“DPA”) and applicable regulations, we act as the data controller for personal data processed through the Services unless otherwise stated.

We are committed to processing personal data lawfully, fairly, transparently, and for specified purposes. This Policy should be read together with our Terms of Service.

2. Scope

This Policy applies to:

• Visitors who browse articles, categories, search results, and the Global Wire archive;
• Readers who register for an account, log in, or update a profile;
• Participants who vote in public opinion polls or submit optional demographic responses;
• Individuals whose page views, read times, or referral data are recorded for analytics;
• Staff and contractors who access our editorial dashboard under separate internal policies;
• Third parties who interact with our APIs, RSS feeds, sitemaps, or social integrations.

This Policy does not govern third-party websites, apps, or services linked from our content (including original publisher sites in Global Wire stories). Those parties operate under their own privacy policies.

3. Personal Data We Collect

Depending on how you use the Services, we may collect the following categories of data:

3.1 Information you provide directly

• Account data: username, email address, password (stored in hashed form), and optional profile details such as name or avatar;
• Poll responses: selected poll option and, where you choose to provide them, age group, gender, county, constituency, or ward;
• Communications: messages you send to us by email or through support channels;
• Editorial submissions: information provided by contributors or sources where applicable.

3.2 Information collected automatically

• Usage and device data: pages viewed, articles opened, approximate read time, referring URL, browser type, operating system, and device characteristics;
• Network data: IP address, request timestamps, and general location derived from IP (country/region level);
• Session identifiers: session keys used to distinguish anonymous poll participation and analytics events;
• Log data: server, application, and security logs generated when you use the Services or our APIs.

3.3 Information from third parties

• Social login or sharing platforms (if enabled): basic profile or page metadata according to your platform permissions;
• Content syndication partners and wire services used in our Global Wire feature;
• Infrastructure providers such as hosting, CDN, media storage, and email delivery services.

We do not intentionally collect special categories of personal data (such as health, biometric, or children’s data) unless you voluntarily provide it in a poll or communication and we have a lawful basis to process it.

4. How We Use Personal Data

We process personal data for the following purposes:

1. Providing the Services: displaying news, search, polls, accounts, RSS/sitemap feeds, and related functionality;
2. Personalisation: remembering preferences, session state, and vote eligibility where technically necessary;
3. Analytics and product improvement: measuring audience engagement, article performance, and platform reliability;
4. Editorial operations: managing original reporting, curated wire content, breaking news, and public-interest journalism;
5. Security and fraud prevention: detecting abuse, protecting accounts, and maintaining audit trails;
6. Legal compliance: responding to lawful requests, enforcing our Terms, and meeting regulatory obligations;
7. Communications: sending service-related notices, and—with your consent where required—updates about the platform.

5. Legal Bases for Processing (Kenya DPA)

Under the DPA, we rely on one or more of the following lawful bases:

• Consent: where you register an account, vote in polls with optional demographics, accept non-essential cookies, or subscribe to communications;
• Contract: where processing is necessary to provide account features you request;
• Legitimate interests: for journalism, audience measurement, platform security, and minor product improvements, balanced against your rights;
• Legal obligation: where we must retain or disclose data to comply with applicable law, court order, or regulatory directive;
• Vital interests or public interest: in rare cases involving safety or significant public-interest reporting, where permitted by law.

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

6. Cookies & Similar Technologies

We use cookies, local storage, and similar technologies to keep you signed in, maintain session integrity, remember poll participation limits, and understand how the Services are used.

You can control cookies through your browser settings. Disabling strictly necessary cookies may limit account login, voting, or certain interactive features.

7. Sharing & Disclosure

We do not sell your personal data. We may share data with:

• Service providers who host our infrastructure, store media, deliver email, provide AI-assisted editorial tools, or process analytics on our behalf, under contractual confidentiality and security obligations;
• Social media platforms when you connect sharing features or when we publish links to our content on those platforms;
• Professional advisers (lawyers, auditors) bound by confidentiality;
• Law enforcement or regulators when required by valid legal process or to protect rights, safety, and security;
• Successors in connection with a merger, acquisition, or asset transfer, subject to equivalent protections.

Aggregated or de-identified statistics (for example, poll result percentages by county) may be published editorially without identifying individual voters.

8. International Data Transfers

Our primary operations and data processing are oriented to Kenya. However, some service providers may process data in other countries. Where personal data is transferred outside Kenya, we implement appropriate safeguards consistent with the DPA, such as contractual protections, adequacy assessments, or your explicit consent where required.

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including:

• Account data: for the life of your account and up to 24 months after deletion, unless a longer period is required by law or dispute resolution;
• Poll votes: for the duration of the poll’s public reporting period and internal archival needs, typically up to 36 months in aggregate form;
• Analytics events: typically up to 26 months, unless aggregated sooner;
• Security and audit logs: as needed for incident investigation and compliance, typically 12–36 months;
• Legal holds: longer where litigation, regulatory inquiry, or journalism source-protection obligations require retention.

When retention ends, we delete or irreversibly anonymise data using commercially reasonable methods.

10. Your Rights

Subject to the DPA and applicable exceptions, you may have the right to:

• Be informed about how we process your personal data;
• Access a copy of personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion or restriction of processing in certain circumstances;
• Object to processing based on legitimate interests;
• Withdraw consent where processing is consent-based;
• Request data portability in a structured, commonly used format where technically feasible;
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.

To exercise your rights, email privacy@thehorizonwire.co.ke with sufficient detail to verify your identity. We will respond within the timelines required by law, typically within 30 days.

11. Children’s Privacy

The Services are intended for a general audience and are not directed at children under 18 years of age. We do not knowingly collect personal data from children without appropriate parental or guardian consent. If you believe a child has provided us personal data, contact us and we will take steps to delete it.

12. Security

We implement administrative, technical, and organisational measures designed to protect personal data, including access controls, encrypted transport (HTTPS), password hashing, audit logging, and restricted staff permissions. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of a personal data breach likely to affect your rights, we will notify you and the ODPC where required by law.

13. Automated Processing & AI Tools

We may use automated tools—including search indexing, content categorisation, and AI-assisted drafting or rewriting of syndicated wire material—to support editorial workflows. These tools do not produce legal, medical, or financial advice. Automated processing does not, by itself, produce legal or similarly significant effects on you. Human editorial review is applied to published original journalism.

14. Changes to This Policy

We may update this Privacy Policy to reflect legal, technical, or operational changes. When we make material changes, we will post the updated Policy on this page and revise the effective date above. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy, except where further consent is required by law.

15. Contact & Complaints

If you are unsatisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC), Kenya. Visit www.odpc.go.ke for current complaint procedures.