Privacy notice
What we collect, why, who sees it, and what you can do about it.
This notice covers everything section 29 of the Data Protection Act, 2019 requires a data controller to tell you before collecting your personal data. Each heading below answers one paragraph of that section.
Your rights
Under section 26 of the Data Protection Act, 2019 you have the right to be told how your data is used, to see the data held about you, to object to it being processed, to have false or misleading data corrected, and to have false or misleading data deleted.
To exercise any of these, write to the contact address below. We answer within the periods the Regulations set, which is fourteen days for most requests.
What we collect
About the person being reported: their name, position, organisation, county, the sector they work in, and the qualification in question.
About you, only if you choose to give it: your name, email address and phone number. Every one of these is optional and a report is treated the same without them.
Any file you attach. Photographs have their location and device data removed before they are stored.
We do not store your IP address against your report. The rate limit uses a one-way hash with a salt that is destroyed after two days, held in a separate table that has no link to any report. We use no analytics, no advertising pixels and no third-party scripts of any kind.
Why we collect it
To let COFEK assess allegations that a person in public office holds an academic qualification they did not earn, and to pass credible cases to the bodies that can check and act on them.
We also publish counts by county and by sector. Those counts never identify anyone: any figure below five is withheld, and where only one figure would be withheld a second is withheld with it.
Who else sees it
Credible reports are sent to five bodies at the same time: the Consumers Federation of Kenya, Elimika Mashinani Trust, the Commission for University Education, the Ethics and Anti-Corruption Commission, and the Kenya National Qualifications Authority.
A report is always passed on as an allegation, never as a finding. Reviewers are instructed to forward what the reporter said and nothing more.
Nobody else receives report data. It is not sold, not shared for marketing, and not given to the person being reported.
The site runs on Vercel and stores data with Supabase. Both act only on our instructions under a written agreement.
Who is responsible, and how to reach them
The data controller is named below, with the contact address for the data protection officer. Write to that address with any question, request or complaint about how your data is handled.
The bodies listed above are the only entities that may receive report data.
How it is protected
Reports are held in a private database that the public site cannot read. Only named COFEK reviewers have access, each signs in with a second factor, and every time a reviewer opens a report it is written to a log that cannot be edited or deleted.
Your reference number is never stored. We keep only a keyed hash of it, and the key is held outside the database, so a stolen copy of the database yields no working reference numbers.
Attached files are stored privately and are never publicly reachable. Links to them expire within a minute and each download is logged.
If there is a breach, we notify the Data Commissioner within 72 hours of becoming aware of it, as section 43 requires.
Whether you have to give this
Nothing here is mandatory. No law requires you to make a report, and no law requires you to identify yourself when you do.
Our lawful basis for processing is section 30(1)(b)(vi) of the Act: the exercise, by any person in the public interest, of a function of a public nature.
We do not tell the person you report that a report exists. We rely on regulation 56(b) of the Data Protection (General) Regulations, 2021, which permits collection, use and disclosure of personal data for taking appropriate action in relation to suspected unlawful activity or serious misconduct.
What happens if you leave things out
If you leave out your name, email and phone, nothing changes. Your report is assessed in exactly the same way.
If you leave out an email, we cannot send you your reference number, so you must write it down from the screen. Without it you cannot check progress or answer a question, and we cannot issue a replacement.
If you leave out detail about the qualification, such as the institution or the year, KNQA may not be able to check it, and the report may be closed without action.
Your rights in full
Section 26 of the Act gives you the right:
- to be informed of the use to which their personal data is to be put
- to access their personal data in custody of the data controller or data processor
- to object to the processing of all or part of their personal data
- to correction of false or misleading data
- to deletion of false or misleading data about them
If you are not satisfied with how we answer, you may complain to the Office of the Data Protection Commissioner. We would rather you came to us first, and our complaints procedure explains how.
How long we keep reports
Reports are deleted 24 months after they are made. The exception is a report that has been forwarded to one of the five bodies named above, which is kept until that body confirms its own process is closed, because their work outlives ours.
Rate limiting counters and the salts used to hash IP addresses are deleted after two days. Once a salt is gone, the hash cannot be traced back to an address by anyone, including us.
Who the controller is
The data controller is COFEK (Consumers Federation of Kenya). This is pending written confirmation and will be updated before the site opens to the public.
Data protection officer: dpo@reportfakedegrees.co.ke
If you have been reported
We do not tell people that a report has been made about them, for the reason given under “Whether you have to give this” above. If you believe you have been wrongly reported and you have learned of it another way, you can put your side through the right of reply form, and it is placed on the file.