Data protection compliance
If your compliance team has sent you a questionnaire about HabariChat, the answers are on this page. Registration numbers, who controls what, and how to get a signed DPA.
Our ODPC registrations
The Kenya Data Protection Act 2019 recognises two roles: the data controller, who decides why and how personal data is used, and the data processor, who handles it on the controller's instructions. Anyone doing either job in Kenya has to be on the ODPC register.
Habari Labs Limited does both jobs, in different situations, so it holds a registration for each.
| Registration | Certificate serial | Valid |
|---|---|---|
| Data Controller | 24634 | 28 Jul 2026 to 28 Jul 2028 |
| Data Processor | 24633 | 28 Jul 2026 to 28 Jul 2028 |
Both certificates carry the same ODPC Registration Identification: 291-998E-831F, issued by the Office of the Data Protection Commissioner under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. You can check them against the ODPC public register without contacting us.
Who you are contracting with
HabariChat is the product. Habari Labs Limited is the company behind it, and the party you contract with under our Terms of Service. If your procurement team is checking the registry, these are the details they need:
| Legal entity | Habari Labs Limited |
| Company number | PVT-BB1PA5W3 |
| Type | Private limited company, Companies Act 2015 |
| Incorporated | 28 April 2025 |
| Registered office | P.O. Box 43529, 00100 G.P.O. Nairobi, Kenya |
Habari Labs Limited is also the verified WhatsApp Business Platform Tech Provider on your account, which is the name you will see when you grant partner access to your WhatsApp Business Account. See WhatsApp partner access if that step is what brought you here.
Who controls what
This is the question compliance questionnaires ask first, and the answer is not the same for all the data on the platform. It splits in two.
| Data | You are | We are |
|---|---|---|
| Messages, contacts and phone numbers your customers send you | Data controller | Your data processor |
| Documents you upload to the AI Knowledge Base | Data controller | Your data processor |
| Your account, team logins and billing records | Data subject | Data controller |
| Your correspondence with our support team | Data subject | Data controller |
In practice this means your customers' data stays yours. We process it only on your instructions and only to deliver the service. It is never sold, never shared with advertisers, and never used to train external AI models.
It also means the obligations that sit with a controller sit with you for that data: having a lawful basis to message your customers, recording their consent, and answering their data subject requests. If one of your customers asks us directly, we will point them back to you and help you respond.
Getting a DPA or completing a vendor review
Email [email protected] and say which of these you need:
- Data Processing Agreement. We have a standard DPA ready to sign. If your legal team would rather use their own template, send it over and we will review it.
- Copies of both ODPC certificates. Sent as PDFs on request rather than published here, so you always get the current ones.
- Security questionnaire. Send it across and we will complete it. Most of what these ask about is already covered under Security & Privacy.
- Sector-specific terms. Our Terms and Privacy Policy already carry dedicated clauses for financial services, healthcare and education. Point your reviewer at Section 14 of the Terms and Section 11 of the Privacy Policy.
Enterprise plans also include data residency and SSO/SAML, which is usually the remaining blocker for regulated buyers. See SSO & data residency.
Data subject requests
Under the Data Protection Act your customers can ask to see the data held about them, correct it, or have it deleted. Because you are the controller for conversation data, those requests belong to you first.
You can action most of them yourself in the platform: open the contact in the Inbox to see their full history, and delete a contact to remove their records. Where you need our help to locate or export something, email [email protected] and we will assist within the timelines the Act sets.
For your own account data, where we are the controller, send the request straight to [email protected]. Our Data Protection Officer can be reached at [email protected] with the subject line "Attention: Data Protection Officer".
If you believe we have handled personal data in a way that breaches the Act, you can complain to the Office of the Data Protection Commissioner directly at [email protected] or via www.odpc.go.ke. We would rather you came to us first, but that is your right and you do not need to tell us before you use it.
Common questions
Yes. HabariChat is operated by Habari Labs Limited, which is registered with Kenya's Office of the Data Protection Commissioner as both a data controller (certificate serial 24634) and a data processor (certificate serial 24633), under ODPC Registration Identification 291-998E-831F. Both registrations run from 28 July 2026 to 28 July 2028.
You are. For the messages, phone numbers and contact records your customers send you, you are the data controller and Habari Labs Limited is your data processor, handling that data only on your instructions. We are a controller only for the data we need to run the business, such as your account, billing and support records.
Yes. Email [email protected] and we will send our standard Data Processing Agreement along with copies of both ODPC registration certificates. If your compliance team needs the DPA on your own paper instead, we will review it.
Habari Labs Limited, a private limited company incorporated in Kenya under the Companies Act 2015, company number PVT-BB1PA5W3, registered office P.O. Box 43529, 00100 G.P.O. Nairobi. HabariChat is the product name. The contracting party in our Terms of Service is Habari Labs Limited.
No. HabariChat routes and manages conversations. It does not store account balances, transaction records, clinical records, prescriptions, lab results, or academic and examination records. Only message content and communication metadata are processed.
No. Your conversation data is never sold, never shared with advertisers, and never used to train external AI models. The AI assistant is grounded in the knowledge base you upload for your own account only.