Effective date: 27 August 2026
This Privacy Policy applies specifically to the Crown Team Kubwa mobile app (Android package com.crown.crownmobile, "the app"), Crown Paints' loyalty programme for painters and dealers. It does not apply to the crownpaints.co.ke website, which has its own privacy statement.
The app is operated by Crown Paints Kenya PLC ("Crown Paints", "we", "us").
[CONFIRM: address/phone below are taken from the public corporate site — verify before publishing.]
Crown Paints is the data controller for personal data collected through the app.
Data protection contact. In accordance with the Data Protection Act, 2019, we have designated a data protection contact who oversees compliance with this policy and can help with any data protection query, concern, or complaint.
We process personal data in accordance with Kenya's Data Protection Act, 2019, and are accountable to the Office of the Data Protection Commissioner (ODPC).
We rely on the following legal bases, as recognised under the Data Protection Act, 2019, depending on what we're doing with your data:
| What we do | Legal basis |
|---|---|
| Creating and authenticating your account | Performance of a contract (the programme's Terms & Conditions, which you accept at sign-up) |
| Recording banked points and processing redemptions, including fulfilment | Performance of a contract |
| KYC, KRA PIN, and eTIMS invoice details for direct redemption | Compliance with a legal obligation (Kenyan tax law) |
| Sharing your name, membership number, and mobile number with a dealer to fulfil a redemption | Performance of a contract |
| Customer support | Performance of a contract |
| Detecting and preventing fraudulent redemptions | Our legitimate interest in protecting the programme and its members, balanced against your rights |
| Notifying the ODPC and affected members of a personal data breach | Compliance with a legal obligation |
We do not rely on consent as the general basis for operating your account — providing this data is necessary to participate in the programme. Where the law requires your specific, separate consent (for example, for a communication unrelated to your account or a redemption), we will ask for it at that time.
We only collect what the app needs to run your Team Kubwa account, redeem points, and meet our tax and compliance obligations. Nothing below is used for advertising or sold to third parties.
Provided by you when you register or edit your profile: first and last name, national ID number, mobile number(s), email address, date of birth, sex, physical and postal address, shop/business name ("duka"), and business details you choose to share (monthly product consumption, preferred brand, purchase frequency, architect name, team size).
Your account's membership number and, if you're a dealer, your dealer code, identify you within the programme.
Why we need your national ID number: to verify your identity, confirm you are eligible to join the programme (including that you are at least 18 years old), and prevent duplicate or fraudulent accounts. It is not shared with dealers, and is only used internally and, where legally required, with regulators.
Location: the app never accesses your device's GPS or precise location. The "location" field on your profile is a town or county you select yourself from a list — it is not automatically detected.
Your points balance, banking and redemption history, and — if you redeem directly with Crown Paints — the eTIMS invoice details you provide (invoice number, invoice date, invoice amount, device number) required by Kenyan tax law.
Why we need your KRA PIN: only if you choose to redeem points directly with Crown Paints, rather than at a dealer counter. A direct redemption constitutes a taxable supply of goods, and Kenyan tax law requires the recipient's KRA PIN to be recorded on the eTIMS (Electronic Tax Invoice Management System) invoice for it. We do not collect your KRA PIN for dealer-counter redemptions, where it is not required.
If you choose to change your profile photo, the app opens your device's built-in photo picker (which does not require us to request a storage permission) so you can select one image. The photo is resized to under 2 MB, uploaded to our servers, and the temporary copy on your device is deleted immediately afterwards.
Loyalty barcodes you scan when banking points from Crown Paints product packaging (only the decoded code is sent to us — the app does not keep or upload any camera image), and your redemption and banking transaction history.
Standard technical information sent with any network request (such as basic device/network status), used only to make the app work correctly. We do not use crash reporting, analytics, or advertising SDKs of any kind — the app contains none.
We do not collect precise or background location, contacts, SMS/call logs, calendar data, health or fitness data, or web browsing history. The app requests no permission to read your contacts, files, or messages.
| Permission | Why the app requests it |
|---|---|
| Internet / network state | To connect to our servers and check connectivity |
| Call phone | Used only when you tap to call your assigned Crown Paints sales representative or the call centre from the Contact screen |
| Camera, flashlight | Used only when you scan a loyalty barcode to bank points |
| Read phone state | Included by a telephony library the app uses for the call feature above; the app does not read or store your phone state |
The app does not request camera-roll/gallery, storage, location, contacts, or SMS permissions.
We do not use your information for advertising, do not build advertising profiles, and do not sell your personal data.
Dealer confidentiality obligations. Dealers may only use the member information they see to fulfil and reconcile that specific redemption. They must keep it confidential, must not use it for marketing or any other purpose, must not share it with a third party, and must not retain it for longer than needed to complete and account for the transaction. This obligation is part of a dealer's agreement with Crown Paints to operate a Team Kubwa redemption counter.
[CONFIRM: Crown Paints to confirm where the app's servers are physically hosted, and whether any processor (e.g. hosting or SMS/OTP provider) is located outside Kenya.]
Where your data is transferred to, or stored in, a country outside Kenya — for example if a service provider we use hosts data outside the country — we will only do so where that country has data protection laws recognised as adequate under the Data Protection Act, 2019, where appropriate safeguards are in place (such as contractual data protection clauses with that provider), or where you have given your consent to the transfer, consistent with sections 48–50 of the Act.
We apply the following measures to protect your data:
[CONFIRM: this section describes app-side and organisational measures visible from the app codebase. Crown Paints should confirm and, if appropriate, add server-side measures (e.g. encryption at rest, backup policy, vulnerability management) that this document can't verify from the app alone.]
Your data is stored on Crown Paints' own secure servers.
[CONFIRM: the retention periods below are drafted against general Kenyan recordkeeping and tax practice and must be confirmed by Crown Paints' legal/finance/tax team before publishing.]
| Data | Retention period |
|---|---|
| Account and profile data (name, national ID, contact details, KYC/KRA PIN) | For as long as your account is active; deleted or anonymised within 90 days of account closure or a verified deletion request, except where we must keep it longer for a reason below |
| Banking, redemption, and eTIMS invoice records | At least 5 years from the date of the transaction, in line with Kenyan tax and company recordkeeping requirements |
| Fraud investigation or dispute records | For the duration of the investigation or dispute, and a reasonable period afterwards to allow follow-up action |
| On-device session and cache data | Expires automatically within 1 hour, and is fully cleared when you log out |
If a breach of your personal data occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of it, as required by section 43 of the Data Protection Act, 2019. Where the breach is likely to result in a real risk of harm to you, we will also notify you directly without undue delay, describing the nature of the breach and the measures taken or recommended to mitigate its effects.
Under the Data Protection Act, 2019, you have the right to:
To exercise any of these rights, contact us using the details in Section 1 or Section 16.
To request deletion of your Team Kubwa account and the personal data associated with it, email callcentre@crownpaints.co.ke from the email address or mobile number registered on your account. We will action your request within 30 days.
We may retain limited information beyond deletion where required by law — for example, tax records relating to completed redemptions (eTIMS invoice data) that we are legally obliged to keep, and records needed to investigate fraud or resolve a dispute already in progress. We will delete or anonymise everything else.
The Team Kubwa programme is intended for adult painters, dealers, and tradespeople, and registration requires you to be at least 18 years old. We do not knowingly collect personal data from anyone under 18; age is self-declared and checked against the national ID number provided at registration. If we become aware that we have collected data from someone under 18, we will delete the account and the associated data promptly. If you believe a minor has registered for a Team Kubwa account, please contact us using the details in Section 1 so we can investigate and remove it.
We may update this policy from time to time, for example when the app's features, our data practices, or the law change. For minor or clarifying changes, we will update the effective date above. For a material change — for example, a new category of data we collect, a new party we share it with, or a new purpose we use it for — we will notify you in advance through the app before the change takes effect and, where the law requires it, ask you to re-confirm your consent before we begin the new processing. Earlier versions of this policy are available on request. Continued use of the app after a non-material change means you accept the updated policy.
Questions about this policy or your data can be sent to Crown Paints using the details in Section 1.