Privacy Policy — Partner Programme
This policy explains how Creswave Limited, trading as Ecare Africa ("we"), handles personal data in connection with the Partner Programme: when you apply, when you use the partner portal, and when a business is introduced to us through a partner.
1. Who is responsible
Creswave Limited (Ecare Africa), Metropolitan Hospital Buruburu, 7th Floor, TMG Offices, Nairobi, Kenya, is the data controller. Contact: [email protected].
2. What we collect
- Partner applications: name, email, phone / WhatsApp, country, profession and job title, company details, website, the healthcare organisations you work with, a description of your network, how you heard about us, and your consents.
- Partner portal: login details (your password is stored only as a secure one-way hash), your referral code, activity such as referral submissions and commission records.
- Referred businesses: organisation name and type, contact person, email, phone, country / county, website, the products they are interested in, and any notes they or the partner provide.
- Technical data: a hashed (not raw) form of your IP address, browser type, the page you landed on, referring page and campaign (UTM) parameters, and the referral cookie described below.
We do not collect patient information, and you must never submit it through any Partner Programme form. We do not collect banking details through the public application form; payout details are requested only through a secure process after approval.
3. Why we use it
- To assess and manage your application and partnership (contract / steps before entering a contract).
- To record referrals, attribute them correctly, follow up with referred businesses and calculate and pay commission (contract and our legitimate interests).
- To contact you about your application and referrals (your consent), and to send partner news and resources if you opted in (consent — you can withdraw at any time).
- To keep the service secure, prevent fraud and spam, and meet legal and tax obligations (legitimate interests and legal obligation).
4. Cookies and attribution
When someone visits through a partner's referral link we set a first-party cookie (ecare_ref, and ecare_ref_last) that records the partner's referral code for up to 90 days so we can credit the right partner. We also use session cookies to keep partners and staff signed in. We do not use these cookies for advertising.
5. Who we share it with
We share data only with service providers who help us run the Programme (such as hosting, email delivery and spam protection), with our staff who need it, with a referring partner (who can see the organisation name, type, stage and commission status of their own referrals — not the referred business's contact details), and where required by law. We do not sell personal data.
6. How long we keep it
We keep partner and referral records for as long as the relationship continues and for a reasonable period afterwards for accounting, tax, dispute and audit purposes. Declined applications are kept for a limited period to handle re-applications and fraud prevention. Technical click records are kept for reporting and then deleted or anonymised.
7. Your rights
Under the Kenya Data Protection Act, 2019 you may ask to access, correct or delete your personal data, object to or restrict certain processing, withdraw consent, and receive a copy of your data. To exercise a right, email [email protected]. You may also lodge a complaint with the Office of the Data Protection Commissioner.
8. Security
We protect data with encrypted connections, hashed passwords, access controls by role, audit logs and rate limiting. No system is perfectly secure, so please use a strong, unique password and tell us promptly if you suspect misuse.
9. Marketing choices
Partner news and marketing resources are sent only if you opted in. Every such message includes a way to opt out, or you can email us at any time.
10. Updates
We may update this policy and will post the latest version on this page.