Privacy Policy
Jitume Omoka · Dream Big Challenge portal
Overview
Jitume Omoka processes your personal data to administer the Dream Big Challenge competition, verify eligibility, communicate with entrants, and fulfil legal obligations under the Kenya Data Protection Act, 2019. Data is encrypted at rest, retained for two years from submission, then anonymised unless you have granted extended platform feature consent as a winner.
Data controller
Jitume Omoka is the data controller for personal data collected through the Dream Big Challenge portal. We process data in accordance with the Kenya Data Protection Act, 2019 (DPA).
What we collect
When you enter the competition we collect: full legal name, date of birth, National ID number, gender, county and sub-county, education status, sector interests, phone number(s), email, M-PESA details, video title and description, your uploaded video file, device fingerprint (if enabled in your browser), IP-derived signals for fraud prevention, and consent choices recorded in the wizard.
Why we process your data
We use your data to: verify eligibility and identity; administer the competition; communicate via SMS and email (confirmations, judging updates, winner notifications); process M-PESA payouts to winners; detect duplicate or fraudulent entries; comply with legal obligations; and enforce our retention schedule.
OTP & phone verification
Your primary phone number is verified via a one-time SMS code before submission. OTP codes are hashed and not stored in plain text. Session tokens allow you to complete the wizard and upload your video securely. Rate limits apply to prevent abuse.
Video & file storage
Raw video uploads are stored in encrypted cloud object storage (Cloudflare R2) during processing. Processed videos may be hosted on Cloudflare Stream for review. Upload URLs are single-use and expire after six hours. Only authorised admin staff can access submissions for judging.
Encryption & security
Sensitive fields (name, ID, phone, email, M-PESA details, date of birth) are encrypted at the application layer before storage. Dedup checks use irreversible HMAC hashes — we never store reversible phone or ID hashes for comparison. Admin access requires multi-factor authentication and is audit-logged.
Retention & deletion
Personal data is retained for 2 years from submission unless you hold extended platform feature consent as a winner. After expiry, PII is anonymised, raw video is deleted from storage, and consent records are minimised. You may request early deletion subject to legal and payout requirements.
Marketing & optional consent
Marketing release and platform feature consent are optional tiers selected in the wizard. You may withdraw marketing or extended feature consent via OTP-verified request. Core processing consent is required to enter the competition.
Sharing with third parties
We use subprocessors for SMS (Africa's Talking), email (Postmark), cloud storage (Cloudflare), and payment rails (M-PESA). Data is not sold. Sharing is limited to what is necessary to run the competition and fulfil legal duties.
Your rights (DPA 2019)
You have the right to access, rectify, erase, restrict processing, object, and data portability where applicable. Contact us to exercise these rights. You may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
Cookies & local storage
The entry wizard stores progress in your browser session storage so you can resume sections. We do not use third-party advertising cookies on this portal. Device fingerprinting, when collected, is used solely for fraud prevention.
Children
The competition is open only to entrants aged 18–35. We do not knowingly collect data from persons under 18.
Contact
Privacy enquiries and data subject requests: hello@jitumeomoka.co.ke.
See also our Terms & Conditions.