Who we are
Kiacert is a product of Ampliora Solutions. For organisers' account data we are the data controller. For attendee data, the organiser who uploads it is the controller and we are their data processor: we only use it to make, send and verify their certificates, on their instructions. Contact us about privacy at support@kiacert.com.
If you are an organiser
What we collect
- Your name and email address, from Google or the email you sign in with.
- Your designs, fonts, settings and the runs you create.
- Payment records: the bundle, amount, date and Paystack reference. Your card or bank details go to Paystack, never to us.
- A one-way code made from the network address you signed up from, used only to spot many accounts made by the same person. We do not keep the address itself.
- Records of important actions on your account, such as revoking a certificate or deleting a run.
Why, and on what basis
- To provide the service you signed up for (performance of our contract with you).
- To take payments and keep accounting records (legal obligation).
- To prevent fraud and abuse of free units, and keep the service secure (legitimate interests).
- To understand which parts of the product work and fix errors (legitimate interests), using figures that do not identify you by name or email.
- To email you about your account and runs. We do not send marketing without asking first.
If you are an attendee
Your certificate was created by the organiser of your event, training or course. They gave us the details on their list, which usually means your name and email address and sometimes other details such as a course or score. We use them only to:
- Put your details on your certificate.
- Email you a link to it, if the organiser chose to, and record whether the email was delivered.
- Show a verification page for your certificate, so you and anyone you share it with (an employer, for example) can confirm it is genuine. The page shows your name, the event, the issuer and the date. It never shows your email address.
To correct, remove or ask about your details, contact the organiser who issued your certificate; they can fix or revoke it. You can also contact us and we will pass your request on and help.
Who else sees data
We never sell personal data. We use these providers to run Kiacert, each bound to protect the data and use it only for us:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | European Union |
| Netlify | Hosting the website and running jobs | United States and global network |
| Resend | Sending certificate emails | United States |
| Paystack | Taking payments | Nigeria |
| Sign in with Google, if you choose it | Global | |
| Cloudflare | Telling people from bots at sign-in | Global network |
| Sentry | Error reports, so we can fix problems | United States |
| PostHog | Anonymous product usage figures | European Union |
Some of these providers store data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows, such as contractual commitments to protect the data to an equivalent standard. We may also share data when the law requires it.
How long we keep data
- Runs and their attendee details stay until the organiser deletes the run or their account, so certificates keep verifying.
- When a run is deleted, its attendee details, certificates and downloads are removed straight away, and from backups within 30 days.
- Account data is kept while the account is open and deleted within 30 days of a deletion request.
- Payment records are kept as long as tax and accounting law requires, usually six years.
- Error reports and usage figures are kept for up to 12 months.
How we protect it
Data is encrypted in transit and at rest with our providers. Only our servers can read the database; the public cannot. Downloads use links that expire. Access by our team is limited to what is needed to support you, and admin actions are logged. If a breach ever puts your data at risk, we will tell the Nigeria Data Protection Commission and affected people as the law requires.
Your rights
Under the NDPA you can ask us to:
- Tell you what personal data we hold about you and give you a copy.
- Correct data that is wrong, or delete it.
- Limit or object to how we use it, including for analytics.
- Give your data to you, or to another service, in a common format.
- Withdraw consent wherever we rely on it.
Email support@kiacert.com and we will reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Cookies
We use cookies that are needed to keep you signed in. If product analytics is switched on, it uses a cookie to count visits without recording your screen or what you type. We do not use advertising cookies.
Children
Organiser accounts are for adults. Certificates may be issued to younger attendees, for example by schools; in that case the school or organiser is responsible for having the right permission.
Changes
We will update this policy when our practices change and show the date at the top. Significant changes will be announced by email or in the app.