Privacy and your data
We collect only what the service needs, tell you why, and give you control.
This is a demonstration
What we ask for, and why
- Name, citizenship, email, phone: so the embassy can identify and contact you.
- Destination and dates: so the right mission can send you relevant alerts.
- Accommodation address (optional): only to help in an emergency. Leave it blank if you prefer.
- Emergency contact (optional): used only if you ask the embassy to contact someone.
- Dependants: only with the consent confirmation shown at registration.
We do not ask for passport numbers or document uploads to register travel. Documents may be requested later for a specific consular service.
What we never do
- Track your location continuously. Location can be shared once, for one wellbeing request, with your explicit consent. You can withdraw it.
- Share your status or location with emergency contacts automatically.
- Publish a directory of citizens. Staff only see records within their mission's jurisdiction, and every access is logged.
- Treat a missed update or reply as a sign you are missing or in danger.
Kenyan law and cross-border data
Personal data of Kenyan citizens is protected by Kenya's Data Protection Act, 2019. Before launch, the Ministry (as data controller) must register with the Office of the Data Protection Commissioner, publish a lawful basis and retention schedule for each kind of data, and decide where data is hosted and how transfers between Nairobi and missions abroad are protected. Citizens keep their rights to access, correct and request deletion of their data. This pilot has had no legal review.
Retention, correction, export and deletion
You can correct your travel details and profile at any time, download a copy of your data, and request deletion from your profile. Some records (for example assistance cases and audit logs) may need to be kept for a legally required period. Retention periods are configurable by the operating institution; the demo uses illustrative values only.
What this demo does and doesn’t do
- Works: server-side permission checks by role and mission, scoped citizen records, input validation, attachment type and size limits, audit logging without sensitive content.
- Simulated: email, SMS and push delivery (messages are shown in-app and labelled as simulated); identity verification; staff multi-factor authentication.
- Not implemented: real authentication, encryption at rest and key management, malware scanning for attachments, regional data residency. These are required before real use.
What registration is — and isn’t
Travel registration helps the embassy communicate with you and provide assistance. It does not replace visas, immigration registration or local emergency services, and it does not guarantee assistance. Support depends on each mission's real services and capabilities.