Legal
Privacy Policy
Version 2026-1 · Last updated 1 October 2026
This policy explains how Krestline Group ("Krestline Group", "we") handles personal data when you use our website, submit an opportunity or investor enquiry, or use our client portal and deal rooms. We process personal data in line with the Kenya Data Protection Act 2019 and, where it applies to you, the EU and UK General Data Protection Regulations.
1. Who is responsible
Krestline Group is the data controller. Contact us about privacy at info@crestlinegroup.sbs.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, role, organisation, email, phone, country | You, through our forms and portal |
| Opportunity and mandate | Project details, amounts, sectors, investment criteria, documents you upload | You |
| Verification | Copies of identity documents, results of identity, sanctions and politically-exposed-person checks | You, and screening sources we consult |
| Deal activity | Messages, questions and answers, introductions, agreements accepted, documents opened | You and other parties in a deal room |
| Account and security | Login history, two-factor status, IP address (stored as a keyed hash), browser type | Automatically, when you use the Platform |
| Consent records | What you agreed to, which version, and when | You |
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Reviewing submissions, matching and making introductions | Steps at your request before entering a contract, and performance of our contract with you |
| Verifying identity and screening against sanctions and PEP lists | Legal obligation and our legitimate interest in preventing financial crime |
| Running deal rooms and keeping a record of the process | Performance of contract, and our legitimate interest in evidencing introductions and enforcing non-circumvention |
| Securing the Platform and preventing fraud | Legitimate interest |
| Service emails and notifications about your submission or deal | Performance of contract |
| Occasional updates about our work | Your consent, which you can withdraw at any time |
4. Who we share it with
We never sell personal data. We share it only:
- with the other party to a transaction, and only after an introduction has been agreed — before that, investors see an anonymous profile that does not identify a project or its sponsors;
- with service providers who process it on our instructions under written terms (listed below);
- with professional advisers, auditors and insurers under a duty of confidentiality; and
- where required by law, court order or a regulator, or to prevent crime.
5. Our service providers
| Provider | Service | Where data is held |
|---|---|---|
| Vercel Inc. | Website and application hosting | Global edge network; processing under Vercel's data processing addendum |
| Neon | Database | Region of the configured database |
| Vercel Inc. (Blob) | Document storage | European Union |
| Resend | Email delivery | United States, under standard contractual safeguards |
| Twilio Inc. | WhatsApp and SMS notifications, when enabled and where you have given a number | United States, under standard contractual safeguards |
6. International transfers
Some of our providers process data outside Kenya and outside the EU and UK. Where they do, we rely on contractual safeguards (such as standard contractual clauses) and on the provider's security commitments, in line with the transfer requirements of the Kenya Data Protection Act and the GDPR.
7. How long we keep it
| Data | Retention |
|---|---|
| Contact details and submissions not taken forward | 24 months after our last interaction with you |
| Copies of identity documents | 12 months, or sooner once the check they support is superseded |
| Records of verification checks (what was checked, by whom, when) | 7 years after our relationship ends, in line with anti-money-laundering record-keeping standards |
| Deal-room messages, questions and answers, introductions and accepted agreements | Kept as a permanent evidential record of the process; they are not deleted, and a withdrawn message stays marked as withdrawn |
| Consent and audit records | As long as needed to show what was agreed and done, and at least 7 years |
8. How we protect it
- Documents are stored privately and encrypted at rest; they are never publicly accessible and are served only through short-lived signed links.
- Access to deal information is limited to the parties to that deal and to our team, and every access to a document is logged.
- PDFs opened by a party are watermarked with that party's name and the time.
- Records of messages, introductions and agreements are append-only: the platform cannot edit or delete them after they are written.
- Two-factor sign-in is available on every account, and two-factor secrets are encrypted.
- If a personal-data breach is likely to put you at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you without undue delay.
9. Your rights
You have the right to be informed about, access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent. Some rights are limited where we must keep data to meet a legal obligation or to establish or defend legal claims — for example, the deal-room record and verification records. We respond to access requests within 7 days, erasure requests within 14 days and portability requests within 30 days. To exercise a right, email us; we may need to verify your identity first.
10. Cookies and similar technologies
We use only the cookies and browser storage needed to run the Platform and remember your choices. See our Cookie Policy for the full list.
11. Automated decisions
We do not make decisions about you based solely on automated processing. Our matching tool suggests investors whose stated mandate appears to fit an opportunity; a person always decides whether to share or introduce.
12. Complaints
If you are unhappy with how we have handled your data, please contact us first at info@crestlinegroup.sbs. You also have the right to complain to the Office of the Data Protection Commissioner (Kenya), www.odpc.go.ke, or to the data protection authority where you live or work.
13. Changes to this policy
We will post any changes here with a new version number and date. Where a change is material, we will tell you and, where required, ask for your consent again. The version you agreed to is recorded against your submission or account.