Privacy Policy.

Last updated: July 1, 2025

1. Introduction and Who We Are

Paper Street ("Paper Street", "we", "us", or "our") provides virtual office services and optional add-ons to businesses across Kenya. Our office is at Westlands Business Park, Waiyaki Way, Nairobi, Kenya.

This Privacy Policy explains how we collect, use, store, and share personal data about you when you visit our website, sign up for our services, communicate with us, or visit any of our physical locations. It applies to all clients, visitors, and contacts of Paper Street.

Paper Street is committed to protecting your personal information in accordance with the Kenya Data Protection Act, 2019, and any implementing regulations issued thereunder. We are registered as a data controller with the Office of the Data Protection Commissioner (ODPC) of Kenya.

2. Information We Collect

We collect personal data in the following categories depending on your relationship with us:

2.1 Information You Provide Directly

• Identity information: Your full legal name, date of birth, and a copy of your government-issued ID or passport.
• Business information: Company name, Certificate of Incorporation, CR12, KRA PIN, and the nature of your business activities.
• Contact details: Email address, phone number (including WhatsApp number), and residential address.
• Billing information: M-Pesa number, bank account details, or payment card information. Full card numbers are processed by our PCI-compliant payment processor and are not stored on our systems.
• Communication data: Any messages you send us via email, our contact form, WhatsApp, or telephone, including call recordings where you have been informed and consented.
• Meeting room and booking preferences: Room requirements, catering preferences, and company representatives authorised to make bookings.

2.2 Information We Collect Automatically

• Website usage data: Pages visited, time spent on pages, browser type, operating system, referring URL, and device type, collected via cookies and similar technologies.
• IP address and approximate location: Used to help detect fraud and comply with geo-specific legal requirements.
• CCTV footage: Our physical locations are monitored by CCTV for the security of clients, staff, and property. Footage is retained for 30 days and then automatically overwritten.
• Mail and parcel logs: Records of mail and parcels received on your behalf, including sender, carrier, weight, and dimensions.

2.3 Information from Third Parties

• Credit reference information from licensed Kenyan credit reference bureaus where required for high-value service packages.
• Business registry information from the Business Registration Service (BRS) to verify company details.
• Information from referral partners or introducers where you have given them permission to share your details with us.

3. How We Use Your Information

We use your personal data for the following purposes:

3.1 Providing and Managing Your Services

• Activating and administering your Paper Street subscription and any associated services.
• Verifying your identity and business details as required by Kenyan KYC regulations.
• Notifying you of mail and parcels received at your registered address.
• Managing any optional add-on services you have subscribed to, such as additional mail forwarding or workspace access.
• Answering calls in your company name and relaying messages as per your instructions.

3.2 Billing and Payments

• Issuing invoices and processing payments for subscription fees, add-ons, and any additional charges.
• Chasing outstanding payments and managing debt recovery if necessary.
• Maintaining financial records as required by the Kenya Revenue Authority.

3.3 Legal and Regulatory Compliance

• Complying with the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) and related regulations.
• Reporting suspicious transactions to the Financial Reporting Centre (FRC) as required by law.
• Responding to lawful requests from government authorities, courts, or law enforcement agencies.
• Retaining business records as required by Kenyan tax and company law.

3.4 Service Improvement and Marketing

• Analysing how clients use our services to identify areas for improvement.
• Sending you service updates, new product announcements, and relevant offers where you have opted in or where we have a legitimate interest to do so.
• Conducting client satisfaction surveys (participation is always voluntary).

4. Legal Basis for Processing

We process your personal data on the following legal grounds under the Kenya Data Protection Act:

• Contract performance: Processing necessary to fulfil the service agreement between you and Paper Street.
• Legal obligation: Processing required by Kenyan law, including KYC, anti-money laundering, and tax obligations.
• Legitimate interests: Processing for fraud prevention, service improvement, and direct marketing of similar services to existing clients, where these interests are not overridden by your rights.
• Consent: Where we rely on consent (for example, for certain marketing communications), you may withdraw your consent at any time by contacting us at privacy@paperstreet.africa.

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We share your information only in the following circumstances:

5.1 Service Providers

We share data with trusted third-party service providers who assist us in delivering our services, including payment processors, cloud hosting providers, SMS and email delivery platforms, and accounting software. All service providers are contractually required to protect your data and use it only for the purpose for which it was shared.

5.2 Regulatory and Law Enforcement Authorities

We may disclose your information to government bodies, regulatory authorities, or law enforcement agencies in Kenya where we are required to do so by law, court order, or to prevent fraud and financial crime. We will notify you of such disclosures unless we are legally prohibited from doing so.

5.3 Business Transfers

If Paper Street is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. We will provide notice via email or a prominent notice on our website prior to your data being transferred and subject to a different privacy policy.

5.4 With Your Consent

We may share your information with third parties for purposes not covered above when you have given us your explicit written consent.

6. Data Retention

We retain your personal data for the following periods:

• Active client records: For the duration of your subscription plus 7 years, in accordance with Kenyan tax and company law requirements.
• KYC documentation: Retained for a minimum of 5 years after the end of the business relationship, as required by POCAMLA.
• CCTV footage: 30 days, then automatically overwritten unless specific footage is preserved in connection with an incident or law enforcement request.
• Website analytics data: Aggregated and anonymised after 26 months.
• Enquiry and marketing contact data: Retained for 2 years from last contact if you did not become a client, or for the duration of your subscription plus 2 years if you did.

After the applicable retention period, we will securely delete or anonymise your personal data.

7. Data Security

Paper Street implements a range of technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, disclosure, alteration, or destruction, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest in our databases.
• Role-based access controls so that only staff with a legitimate business need can access your data.
• Regular security reviews and vulnerability assessments.
• Physical security measures at all our locations, including access control systems and CCTV monitoring.
• Staff training on data protection and information security.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the ODPC without undue delay and within 72 hours of becoming aware of the breach, as required by the Kenya Data Protection Act.

8. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyse site traffic, and understand how visitors use our site. We use the following types of cookies:

• Strictly necessary cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our website. We use anonymised data only.
• Marketing cookies: Used to show you relevant advertisements on third-party platforms. These are only set with your consent.

You can manage your cookie preferences at any time via the cookie settings panel on our website or through your browser settings. Note that disabling certain cookies may affect the functionality of our website.

9. Your Rights

Under the Kenya Data Protection Act, 2019, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you, free of charge, within 21 days of your request.
• Right to rectification: You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure: You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
• Right to restriction of processing: You may request that we temporarily stop processing your data in certain circumstances, for example while a dispute about accuracy is resolved.
• Right to data portability: You may request that we provide your data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to object: You may object to processing based on our legitimate interests, including direct marketing. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, email us at privacy@paperstreet.africa with your name, email address, and a description of your request. We will respond within 21 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

10. International Data Transfers

Some of our service providers are based outside Kenya, including cloud hosting and analytics platforms. When we transfer your personal data outside Kenya, we take steps to ensure it receives an equivalent level of protection to that required under Kenyan law, including through contractual safeguards such as Standard Contractual Clauses.

11. Children's Privacy

Our services are intended for use by businesses and individuals aged 18 and above. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@paperstreet.africa and we will delete it promptly.

12. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. We will notify you of material changes by sending an email to the address on file at least 14 days before the changes take effect. The updated policy will also be posted on our website with the revised "Last updated" date. Your continued use of our services after the effective date of the updated policy constitutes your acceptance of it.

13. Contact and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:

• Email: privacy@paperstreet.africa
• Phone: +254 700 000 000
• Postal address: Data Protection Officer, Paper Street, Westlands Business Park, Waiyaki Way, Nairobi, Kenya

If you are not satisfied with our response to your complaint, you have the right to contact the Office of the Data Protection Commissioner of Kenya at www.odpc.go.ke.