Last updated: 26 August 2026

Your Privacy Matters to Us

Activly ("we", "us") operates activly.co.ke, a platform for discovering and registering for running and fitness events. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. It applies to all users of our website and services, wherever you are located.

Activly is the data controller for the personal data described in this policy. We are based in Kenya and comply with the Kenya Data Protection Act, 2019. For users in the European Union, United Kingdom, and other jurisdictions with applicable privacy laws (such as the GDPR, UK GDPR, and US state privacy laws), the additional rights described below also apply.

Information We Collect

• Account data - name, email address, phone number, profile photo, and password (stored only as a secure hash). If you sign in with Google, we receive your name, email, and profile photo from Google.
• Event data - events you register for, tickets, and payment status. Payments are processed by our payment providers; we do not store card or M-Pesa credentials.
• Virtual challenge and Strava data - if you join a virtual challenge and connect Strava, we receive activity records (activity type, distance, duration, and date), and where a challenge includes rewards, your t-shirt size and shipping address. Strava access tokens are stored encrypted.
• Communication preferences - your email subscription choices and preferred messaging channel (email, SMS, or WhatsApp).
• Usage data - pages visited, and technical data such as IP address, collected for security and to understand how the platform is used. Analytics tracking only runs with your consent (see the Cookie Policy below).

How and Why We Use Your Information

We use your data on the following legal bases:

• To perform our contract with you - creating your account, processing event registrations and payments, tracking virtual challenge progress, and sending you essential updates about events you've registered for.
• With your consent - sending marketing emails (weekly and monthly digests you opt in to at signup or in your settings), publishing your name and challenge results on public leaderboards, connecting your Strava account, and analytics cookies. You can withdraw consent at any time.
• For our legitimate interests - keeping the platform secure, preventing fraud and abuse, and monitoring errors so we can fix them.
• To comply with legal obligations - retaining financial transaction records and honouring unsubscribe requests.

Virtual Challenges, Strava & Leaderboards

Some events on Activly are virtual challenges that are tracked using Strava. If you register for one of these challenges and connect your Strava account, we access activity data from Strava (such as activity type, distance, duration, and date) to calculate your progress and ranking. We only access this data with your authorisation, which you grant when you connect Strava, and you can disconnect Strava from a challenge at any time.

When you register for a virtual challenge, your name and activity results derived from Strava (such as total distance, rank, and completion status) are published on that challenge's public leaderboard, which may be visible to other participants and visitors. We record the time you give this consent. If you disconnect Strava, activities already counted towards the challenge remain on the leaderboard. If you would like your results removed from a leaderboard, please contact us at activly@outlook.com.

Who We Share Data With

We never sell your personal data. We share it only with service providers who process it on our behalf under contract, and only what each needs:

• Payments - IntaSend (M-Pesa and card payments) and PayPal.
• Email and SMS delivery - our email providers (e.g. Mailgun / Amazon SES / Postmark) and SMS providers (Africa's Talking, Twilio).
• Messaging - if you choose WhatsApp as a channel or join our WhatsApp groups, messages are delivered via WhatsApp (Meta).
• Sign-in and fitness data - Google (sign-in) and Strava (virtual challenges), each governed by their own privacy policies and only connected with your authorisation.
• Analytics (consent-based) - Google Analytics, Google Tag Manager, and Mixpanel, loaded only if you accept analytics cookies.
• Error monitoring - Sentry, to detect and fix technical errors. Session replay recordings are only enabled with your analytics consent.
• Infrastructure - cloud hosting and file storage providers (including Amazon Web Services) that store our data securely.
• Event organizers - when you register for an event, the organizer receives the registration details needed to run that event.

International Transfers

Some of our service providers store data outside your country, including in the United States. Where data of EU, UK, or Kenyan users is transferred internationally, we rely on appropriate safeguards such as the providers' standard contractual clauses and data processing agreements.

How Long We Keep Data

• Account and event data is kept while your account is active, and deleted when you delete your account.
• Page-visit logs are deleted, and IP addresses in email-open logs are removed, after 12 months.
• Financial transaction records are retained as required by law, even after account deletion.
• Unsubscribe records are kept so we can continue honouring your choice.

Your Rights

Wherever you are, you can exercise the following rights over your personal data:

• Access and portability - download a copy of your personal data in a machine-readable format from your account settings.
• Rectification - correct your details in your account settings.
• Erasure - delete your account and personal data yourself from your account settings, or by contacting us. Financial records we must keep by law are retained but unlinked from your profile.
• Withdraw consent - unsubscribe from marketing emails via the link in any email or in your settings, change your cookie choice at any time, and disconnect Strava from a challenge.
• Objection and restriction - object to or ask us to restrict processing based on legitimate interests by contacting us.

To exercise any right, use your account settings or email us at activly@outlook.com. We respond within 30 days. You also have the right to lodge a complaint with your supervisory authority - in Kenya, the Office of the Data Protection Commissioner (ODPC); in the EU/UK, your national data protection authority.

Marketing Communications

We only send marketing emails (such as our weekly and monthly event digests) if you opt in. Every marketing email includes an unsubscribe link, and you can change your subscription preferences in your account settings at any time. Essential emails about your account or events you've registered for are not marketing and are sent regardless.

When you register for an event, you can also choose to be told when that event returns or when a related event by the same organizer launches. We send at most one email per new event, each with an unsubscribe link, and you can manage these event follow-ups from your account settings at any time.

Data Security

We protect your data with measures including encrypted connections (HTTPS), hashed passwords, encrypted storage of third-party access tokens, and access controls on our internal systems. However, no method of transmission over the Internet is 100% secure.

Children

Activly is not directed at children under 18, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

Cookie Policy

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse site usage, and support our services. This policy explains what cookies we use and how you can control them.

What Are Cookies?

Cookies are small text files placed on your device by a website. They allow the site to remember your preferences and actions over time, so you don't have to re-enter them each visit.

Cookies We Use

Third-Party Services

We use the following third-party tools that may set their own cookies, and they only run if you accept analytics cookies:

• Google Analytics & Tag Manager - tracks page views and user interactions to help us improve the site.
• Mixpanel - product analytics to understand feature usage.
• Sentry Session Replay - records anonymised sessions when errors occur so we can fix them.

Your Choices

If you are visiting from outside Kenya, you will be shown a consent banner when you first visit. Analytics tools are only loaded if you accept; if you decline, they do not run. You can also:

• Clear your browser cookies and reload the page to reset your choice.
• Configure your browser to block or delete cookies - see your browser's help section for instructions.
• Opt out of Google Analytics tracking via Google's opt-out tool.

Kenyan users are not shown a cookie consent banner as Kenyan law does not currently require explicit cookie consent. This policy is primarily directed at visitors from the European Union, United Kingdom, and other jurisdictions with applicable privacy regulations (GDPR, UK GDPR, etc.).

Policy Updates

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. Continued use of the site after changes constitutes acceptance of the updated policy.

Contact Us

For any privacy question or to exercise your rights, email us at activly@outlook.com.