1. Who we are
PastPapers Hub ("we", "us") operates the platform at this domain. We are the data controller for the personal information described below, and we process it in line with the Kenya Data Protection Act, 2019, and, where applicable, the EU/UK GDPR.
2. Data we collect
- Account data — name, email, phone number, password (hashed), verification status.
- Academic profile — country, university, programme, course, year of study.
- Content — material you upload, its metadata, and any related files.
- Transaction data — orders, purchases, reading passes, payouts, withdrawal requests.
- Payout data — payout phone number, M-Pesa B2C references.
- Usage data — page views, downloads, device type, IP address, browser, approximate location.
- Communications — support messages, content reports, reviews you leave.
3. Why we process your data
We use your data to:
- create and secure your account and verify your identity;
- deliver purchased material and reading passes;
- process payments and payouts;
- operate moderation, anti-fraud and duplicate-content detection;
- comply with legal, tax and copyright obligations;
- improve the platform and communicate service updates.
Where the law requires a legal basis, we rely on contract (to deliver what you've requested), legitimate interests (fraud prevention, security, improving the service) and consent (optional marketing).
4. Who we share data with
- Payment providers — Safaricom M-Pesa (C2B and B2C) and Paystack, to process payments and payouts.
- Cloud & infrastructure — hosting and storage providers that hold our servers and files.
- Communications providers — SMS and email delivery partners for OTPs and notifications.
- Authorities — where we are legally required to disclose data.
We do not sell your personal data. Payment card details are handled directly by Paystack and never stored on our servers.
5. How long we keep it
Account data is retained while your account is active and for a short period after closure for legal and financial records (typically 7 years for transaction records). Usage logs are retained for up to 24 months. You can request earlier deletion of non-financial data subject to legal retention obligations.
6. Security
We use HTTPS in transit, hashed passwords, access controls, audit logging and encrypted storage for sensitive fields. Withdrawals require OTP verification and a cool-down when the payout phone number changes. No system is perfectly secure — if you suspect your account is compromised, contact us immediately.
7. Your rights
Subject to applicable law, you can:
- access a copy of your personal data;
- correct inaccurate data;
- request deletion (with exceptions for records we are legally required to keep);
- object to or restrict certain processing;
- withdraw consent for optional communications;
- lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
To exercise any of these rights, email support@pastpapers.test.
8. Cookies & tracking
We use essential cookies to keep you signed in and to protect forms (CSRF tokens). We may use analytics cookies — always with consent where required — to understand which materials are popular and improve the library.
9. Children
The platform is not directed at children under 16. If you believe a minor has created an account without appropriate consent, contact us and we will take steps to remove it.
10. Changes
We may update this policy. Material changes will be announced by email or in-app notification before they take effect. The "Last updated" date at the top reflects the current version.
11. Contact & complaints
Data-protection enquiries: support@pastpapers.test.
You may also file a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.