Your Privacy Matters

The Craft Catalyst ("we", "us", "our") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our virtual internship platform ("Platform").

Last Updated: October 22, 2025

We comply with the Data Protection Act, 2019 of Kenya, the Constitution of Kenya (2010), and other applicable data protection laws. This policy applies to all users of our Platform, including Students, Companies, Universities, and visitors.

1. Information We Collect

1.1 Personal Information You Provide

For Students:

  • Full name, email address, phone number
  • University/institution, course of study, academic year
  • National ID number (for verification purposes)
  • Skills, experience, and portfolio information
  • Profile picture and resume/CV
  • Assignment submissions and project work
  • Application materials and cover letters

For Companies:

  • Company name, industry, business registration details
  • Contact person name, title, email, phone number
  • Company description, website, and location
  • Logo, branding materials, and company videos
  • Work experience postings and requirements
  • Employee count and company size

For Universities:

  • Institution name and registration details
  • Administrator contact information
  • Student enrollment and academic records
  • Partnership agreements and collaboration data

1.2 Automatically Collected Information

  • Technical Data: IP address, browser type, device information, operating system
  • Usage Data: Pages visited, time spent on Platform, click patterns, feature usage
  • Performance Data: Application response times, download errors, page load times
  • Security Data: Login attempts, security events, authentication logs

1.3 Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your login session and preferences
  • Analyze Platform usage and improve functionality
  • Provide personalized internship recommendations
  • Ensure Platform security and prevent fraud
  • Remember your language and regional settings

2. How We Use Your Information

2.1 Platform Operations

  • Facilitate internship matching between Students and Companies
  • Process applications and manage internship workflows
  • Provide AI-powered assignment reviews and feedback
  • Track progress and generate completion certificates
  • Enable communication between platform users

2.2 Account Management

  • Create and maintain user accounts
  • Verify identity and prevent fraudulent accounts
  • Provide customer support and technical assistance
  • Send important Platform updates and notifications

2.3 Improvement and Analytics

  • Analyze Platform usage to improve features and user experience
  • Generate insights on internship trends and success rates
  • Develop new features and educational content
  • Conduct research on virtual internship effectiveness

2.4 Legal and Security

  • Comply with legal obligations and regulatory requirements
  • Detect and prevent fraud, abuse, and security threats
  • Resolve disputes and enforce our Terms of Service
  • Protect the rights and safety of our users

3. Information Sharing and Disclosure

Important: We do not sell your personal information to third parties.

3.1 Within the Platform

  • Student Profiles: Basic profile information is visible to Companies and Universities for internship matching
  • Company Profiles: Company information is visible to Students and Universities
  • Assignment Work: Submitted work is shared with relevant Companies for evaluation
  • Progress Reports: Academic progress may be shared with Universities for student tracking

3.2 Service Providers

We may share information with trusted third-party service providers who assist us with:

  • Cloud hosting and data storage (with appropriate data processing agreements)
  • Email delivery and communication services
  • AI and machine learning services for assignment evaluation
  • Payment processing for premium features
  • Analytics and performance monitoring

3.3 Legal Requirements

We may disclose your information when required by law, including compliance with court orders, government requests, or investigations by Kenyan authorities. We will notify you of such requests unless legally prohibited.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4. Data Security and Protection

4.1 Security Measures

Technical Safeguards

  • SSL/TLS encryption for data transmission
  • Encrypted data storage
  • Regular security updates and patches
  • Multi-factor authentication options
  • Intrusion detection systems

Administrative Safeguards

  • Employee background checks
  • Limited access based on job roles
  • Regular security training
  • Incident response procedures
  • Data breach notification protocols

4.2 Data Retention

We retain your personal information for as long as necessary to:

  • Provide Platform services and maintain your account
  • Comply with legal obligations and regulatory requirements
  • Resolve disputes and enforce our agreements
  • Improve our services and conduct analytics

Typical retention periods: Active accounts - duration of use plus 3 years; Inactive accounts - 2 years; Assignment submissions - 5 years for educational records; Marketing communications - until you unsubscribe.

5. International Data Transfers

5.1 Cross-Border Processing

Your personal information may be processed outside Kenya for the following purposes:

  • Cloud storage and backup services
  • AI processing and machine learning services
  • Technical support and system maintenance
  • Analytics and performance monitoring

5.2 Safeguards for International Transfers

When transferring data internationally, we ensure appropriate safeguards including:

  • Data Processing Agreements with service providers
  • Standard Contractual Clauses (SCCs) where applicable
  • Adequacy decisions by Kenyan data protection authorities
  • Regular audits of international service providers

6. Your Rights and Choices

Under Kenyan data protection law, you have the following rights:

Right of Access

Request a copy of the personal information we hold about you, including how it's used and shared.

Right of Rectification

Request correction of inaccurate or incomplete personal information.

Right of Erasure

Request deletion of your personal information in certain circumstances.

Right to Object

Object to processing of your personal information for marketing or other purposes.

Right of Portability

Request transfer of your data to another service provider in a structured format.

Right to Restrict Processing

Request limitation of how we process your personal information.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days and may request additional information to verify your identity.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe your data protection rights have been violated.

7. Children's Privacy

Our Platform is not intended for children under 16. We do not knowingly collect personal information from children under 16 without parental consent. University students aged 16-18 may use the Platform with appropriate guardian consent and institutional oversight.

If you believe we have collected information from a child under 16 without proper consent, please contact us immediately at [email protected].

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes via email or Platform notification at least 30 days before the effective date.

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after changes become effective constitutes acceptance of the updated policy.

9. Contact Information

General Privacy Inquiries