4drawsPrivacy statement
4 DRAWS TICKET LTD · Version 1.0 · Effective 11 November 2026
Service status. 4draws is not yet licensed by Kenya's gambling regulator and does not operate real-money gambling: the service currently runs as a demonstration with M-Pesa's test environment. This document describes how the service works and takes full effect when the licence is granted.
1. About this statement
This statement explains how 4 DRAWS TICKET LTD ("4draws", "we", "us") collects, uses, shares and protects your personal data when you use the 4draws apps, website and support channels (the "Service"). 4 DRAWS TICKET LTD is a company incorporated in Kenya and is the data controller for the personal data described here. We handle personal data under the Data Protection Act, 2019 and its regulations.
It applies to everyone who opens an account, visits our website or contacts us. It should be read with our Terms and conditions. By opening an account you confirm that you have read it.
2. Definitions
- Personal data: any information about an identified or identifiable person.
- Processing: anything done with personal data, such as collecting, storing, using, sharing or deleting it.
- Sensitive personal data: data the law gives extra protection, such as health data or biometric data. We do not ask for it.
- The Regulator: the authority that licenses and supervises gambling in Kenya.
- ODPC: the Office of the Data Protection Commissioner.
3. The information we collect
| Information | Why we need it |
|---|---|
| Your M-Pesa phone number | Your account, signing in, top-ups and payouts to you |
| Your email address | Password reset links and notices about your account |
| Your names, national ID number and date of birth | Checking who you are and that you are 18 or older, as the law requires before you are paid |
| Your top-ups, plays, balance, withdrawals, prizes and the M-Pesa receipts for them | Running the game and your wallet, keeping the books, paying tax that is due |
| Your devices and sign-ins (device type, a per-install identifier, time, network address) | Keeping your account secure and limiting the devices that can use it |
| The country your connection comes from | Serving players in Kenya only |
| Your deposit limits, breaks and self-exclusions | Protecting you, as the law requires |
| If you sign in with Google or Apple: the link to that account, and the photo Google shares | Signing in; showing your photo on your account |
| What you tell our support staff, and our replies | Answering you and keeping a record of complaints |
We do not collect your contacts, your location from GPS, your messages or your M-Pesa PIN. We never ask for your PIN.
4. How we collect it
- From you, when you open an account, verify your identity, set limits or write to us.
- From your use of the Service, when you top up, play, withdraw or sign in.
- From Safaricom (M-Pesa), which confirms each payment, its receipt and the number it came from.
- From Google or Apple, if you choose to sign in with them.
5. How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Opening and running your account and wallet, taking plays, running draws, paying prizes and withdrawals | Performing our contract with you |
| Verifying your identity and age; keeping gambling, payment and tax records; reporting to the Regulator, the Financial Reporting Centre and the Kenya Revenue Authority | Legal obligation |
| Monitoring for fraud, money laundering and misuse of accounts; securing the Service | Legal obligation and our legitimate interest in a safe service |
| Applying your limits, breaks and self-exclusion | Legal obligation and protecting you |
| Answering your questions and complaints | Performing our contract with you; legal obligation |
| Marketing messages | Your consent, which you can withdraw at any time |
We use your data only for the purposes above. We do not sell it, and we do not use advertising or analytics trackers.
6. Who we share it with
- Safaricom PLC (M-Pesa), to make and confirm payments to and from you.
- Our hosting and network providers, who run the Service for us under contract and on our instructions.
- Google or Apple, only if you choose to sign in with them.
- Authorities the law requires us to report to: the Regulator, the Financial Reporting Centre, the Kenya Revenue Authority, and courts or law enforcement with a lawful request.
- Our professional advisers and auditors, under duties of confidence.
- A successor, if the business is sold or reorganised, under the same protections.
7. Transfers outside Kenya
Today the Service is hosted on servers in the United States, and it is moving to hosting in Kenya. Where personal data is processed outside Kenya, we rely on contracts with the provider that require the protections of the Data Protection Act, and we transfer only what running the Service needs.
8. How long we keep it
- While your account is open, for as long as you use the Service.
- After your account closes, we keep the records the law requires: identity checks and records of payments, plays, prizes and suspicious-activity reports for at least seven years, as the anti-money-laundering law requires, and tax records for at least five years.
- Self-exclusion records are kept for as long as the exclusion lasts, so that it keeps working.
- Support messages are kept for as long as they are needed to answer you and to show how a complaint was handled.
When a period ends we delete the data or make it anonymous. See Delete your account.
9. How we keep it safe
- Identity details are encrypted. Passwords are stored only as strong one-way hashes, never as text.
- All connections to the Service are encrypted.
- Staff see only what their role needs. Viewing identity documents and every staff action is recorded under the member's name.
- Payments, payouts and draws that matter most need two different members of staff.
No system is perfectly secure. If a breach puts your rights at real risk, we will tell you and the ODPC as the law requires.
10. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your data is used (this statement);
- see the data we hold about you and get a copy of it;
- have wrong or out-of-date data corrected;
- have your data deleted where the law allows (see Delete your account);
- object to, or ask us to restrict, a use of your data;
- receive your data in a form you can move to another service;
- withdraw a consent you gave;
- not be subject to a decision made only by a machine that significantly affects you.
To get a copy of your data, sign in and go to Account → Get a copy of your data. We email a report you can read in your browser, with the same data as a file for other services, to the address on your account, once a day at most. For your safety it shows only the last three digits of your ID number.
To use any other right, write to privacy@4draws.co.ke from the email address on your account. We will check that it is you and answer within the time the law sets. Using a right is free. Some rights have limits: we cannot delete records the law requires us to keep.
11. Automated checks
Our systems watch for patterns that may show fraud or money laundering, such as many failed payments or one ID number on several accounts. A match opens a case for a member of staff to review. A person, not a machine, decides whether anything is done to your account, and you can ask us to look again.
12. Cookies and storage on your device
We keep you signed in using secure storage on your device, and we remember a few choices you make (such as whether haptics are on). We use no advertising cookies and no third-party trackers. If you sign in with Google, Google's sign-in may set its own cookies under Google's policy.
13. Marketing
We send you messages about your account whether or not you want marketing: confirmations, security notices and changes to these documents. We send marketing only if you agree to it, and every marketing message will say how to stop. We never market to anyone who has self-excluded or is on a break.
14. Children
4draws is only for people aged 18 and over. We refuse sign-ups from anyone who says they are younger, we check identity before paying anyone, and we close any account found to belong to a child and delete its data, apart from the records the law requires.
15. Complaints
If you are unhappy with how we handled your data, write to privacy@4draws.co.ke first so that we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (odpc.go.ke).
16. Changes to this statement
We may update this statement when the Service or the law changes. The date at the top shows the latest version. If a change affects your rights, we will tell you in the app or by email before it takes effect.
17. How to contact us
The Data Protection Officer, 4 DRAWS TICKET LTD, Nairobi, Kenya.
Privacy: privacy@4draws.co.ke
Support: support@4draws.co.ke
4 DRAWS TICKET LTD, Nairobi, Kenya. Last updated 11 November 2026.