Privacy Policy

Effective Date: 14 October 2026

Document Version: 1.0

1. Introduction

This Privacy Policy explains how personal information is collected, used, stored, protected and disclosed when individuals access coworking services, register accounts, reserve meeting rooms, manage memberships or communicate through Cowork Portal.

Cowork Portal is a coworking management and booking platform developed, hosted and maintained by Belphy Technologies. Individual coworking centre operators use the platform to administer their own facilities, customers, memberships, bookings, payments and communications.

By providing personal information, individuals are informed of the processing activities described in this Policy. Processing is carried out on the applicable lawful basis and does not depend solely on acknowledgement of this Policy.

2. Data Controller and Service Provider

Coworking Centre Operator: Belphy Technologies

Trading Name: Cowork Portal

Business Address: 6th Floor, Reliable Towers
Mogotio Road, Westlands,
P.O Box 2417 (00606) Nairobi, Kenya.

Contact Email: admin@belphy.com

The coworking centre operator generally determines the purposes of collecting and using customer information for its facility operations and is responsible for managing that information in accordance with applicable data protection law.

Platform Provider: Belphy Technologies provides, maintains and hosts the Cowork Portal software and supporting technical services. When processing personal data on instructions from a coworking centre, Belphy acts in a service-provider or processor capacity, subject to the applicable arrangements. Where Belphy independently determines processing purposes and means, it is responsible for that processing in its own capacity.

3. Personal Information Collected

Depending on the services used, the following categories of information may be collected:

• Personal identification and contact details, including names, email addresses and telephone numbers.
• Account credentials, access permissions, membership roles and authentication records.
• Company information, business addresses, billing contacts and KRA PIN details.
• Membership plans, company contracts, authorized members and related documents.
• Room reservations, booking dates, durations, attendance details and usage records.
• Invoices, amounts payable, payment references, payment status and transaction records.
• Support enquiries, conversations, Live Chat messages, WhatsApp correspondence and communications preferences.
• Activity logs, IP addresses where recorded, access events, security information and technical diagnostics.

Information may be provided directly, supplied by an authorized company representative, generated through use of the services or received from an integrated service provider.

4. Purposes of Processing

Personal information is processed for legitimate operational purposes, including:

• Creating, verifying and maintaining customer accounts.
• Managing companies, memberships, contracts and authorized users.
• Checking room availability and processing reservations.
• Calculating complimentary usage, additional charges and account balances.
• Preparing invoices, processing payments and maintaining financial records.
• Delivering booking confirmations, reminders and operational notifications.
• Responding to enquiries, support requests and customer communications.
• Managing customer support cases and internal follow-up activities.
• Protecting accounts, detecting misuse, troubleshooting errors and maintaining audit trails.
• Meeting applicable legal, accounting, tax and regulatory obligations.

Marketing and promotional communications, where provided, will be managed according to the applicable legal basis and communication preferences.

5. Lawful Bases for Processing

Depending on the processing activity, the applicable lawful basis may include performance of a contract, steps requested before entering a contract, compliance with legal obligations, legitimate interests where legally permitted, or valid consent when required.

Where processing relies on consent, individuals will be provided with an appropriate choice and a means of withdrawing consent. Withdrawal does not automatically invalidate processing previously carried out lawfully.

Account registration and essential booking information may be necessary to deliver the requested services. Failure to provide required information may prevent account creation, booking confirmation, invoicing or another requested service.

6. Company Accounts and Authorized Users

Company administrators and other authorized representatives may submit information relating to their organizations and personnel. Such representatives are responsible for ensuring they are authorized to provide the information and manage the relevant accounts.

Access to company information is governed by assigned user roles and permissions. Authorized company representatives may have access to information needed to administer membership, bookings, usage and billing.

7. Bookings, Memberships and Contracts

The platform processes reservation details, room selection, scheduled dates and times, booking status, company membership entitlements, complimentary-hour balances and relevant contractual information.

These records support booking availability checks, operational reporting, membership administration, customer communication and dispute resolution.

8. Billing, Taxation and Payments

Business billing details, including KRA PIN information where applicable, may be collected to prepare invoices and support lawful accounting and tax compliance.

Payment transactions may involve third-party payment service providers. The information shared depends on the selected payment method and the provider's integration requirements.

External payment providers may apply their own privacy notices. The platform operator should disclose which payment providers are enabled for its site.

9. Customer Support and Communications

Communications made through customer support, Unified Inbox, Live Chat, email or WhatsApp may be recorded and associated with customer accounts or support cases.

Such information may be accessible to authorized centre personnel and technical service providers where necessary to resolve enquiries, maintain service continuity, investigate issues or comply with legal obligations.

Where WhatsApp services are enabled, relevant information may be processed through Meta's WhatsApp infrastructure subject to the applicable service arrangements and safeguards.

10. Cookies and Similar Technologies

Cowork Portal may use essential cookies and similar technologies for authentication, session management, security and functionality necessary to deliver requested services.

Additional analytics, preference or marketing technologies may be used only where configured and supported by an appropriate lawful basis, including consent where required.

Where optional-cookie consent controls are provided, rejecting optional cookies will not prevent access to essential registration, login and booking functions.

Cookie categories, providers and retention periods will be identified based on the technologies actually enabled on the relevant site.

11. Information Sharing and Service Providers

Personal information may be shared with authorized personnel, the platform hosting and maintenance provider, payment processors, email delivery services, communication providers, professional advisers and competent authorities where lawfully required.

Information will not be disclosed for unrelated purposes without an appropriate lawful basis.

Service providers processing information on behalf of the operator must be subject to appropriate contractual and security arrangements.

12. Hosting and International Data Transfers

Cowork Portal uses technical infrastructure and may integrate with service providers whose systems are located in Kenya or other jurisdictions.

Where personal information is transferred outside Kenya, the responsible organization must ensure that the transfer complies with applicable Kenyan data protection requirements, including appropriate safeguards or another legally recognized basis for transfer.

Hosting locations, international service providers and applicable safeguards should be verified and documented by the relevant responsible parties.

13. Information Security

The operator and its service providers are responsible for implementing appropriate technical and organizational security measures according to their respective roles.

These measures may include authenticated access, role-based permissions, protected communications, access monitoring, updates, backups and security incident management.

Users are responsible for safeguarding account credentials and promptly reporting suspected unauthorized access.

No internet-connected system can be guaranteed to be entirely free from security risks.

14. Personal Data Breaches

Suspected or confirmed personal data breaches will be assessed, investigated and managed according to applicable legal requirements and the responsibilities of the relevant organizations.

Where notification is legally required, the responsible party will notify the Office of the Data Protection Commissioner and affected individuals as applicable.

15. Data Retention and Deletion

Personal information will be retained only for as long as reasonably necessary for the purposes for which it was collected, subject to legal, contractual, accounting, tax, security and dispute-resolution requirements.

Different categories of information may have different retention requirements. Financial records, booking records, communications and security logs are assessed according to their respective purposes and legal obligations.

When information is no longer required, it should be securely deleted or anonymized where appropriate, taking account of backup retention and other applicable requirements.

16. Individual Privacy Rights

Subject to applicable law, individuals may have rights to be informed about processing, access their personal information, object to certain processing, seek correction of inaccurate information and request deletion where legally applicable.

Additional rights and remedies may apply depending on the processing circumstances and relevant law.

Requests may require reasonable identity verification to protect personal information against unauthorized disclosure.

17. Requests, Complaints and Contact Details

Requests concerning personal information collected by the coworking centre should be directed to:

Belphy Technologies
Email: admin@belphy.com
Address: 6th Floor, Reliable Towers
Mogotio Road, Westlands,
P.O Box 2417 (00606) Nairobi, Kenya.

Technical requests may be referred to Belphy Technologies where assistance with the Cowork Portal infrastructure is necessary.

Individuals may also lodge complaints with Kenya's Office of the Data Protection Commissioner through its official website at www.odpc.go.ke.

18. Changes to this Privacy Policy

This Policy may be revised to reflect changes in legislation, operational requirements, technical functionality or data processing practices.

Updated versions will display the applicable effective date and document version. Where required, individuals will receive appropriate notice of material changes.