Last updated: 16 September 2026 · Applies to panarun.com and every tenant instance of the PANARUN platform.
1. Who we are
PANARUN is a multi-tenant public investment intelligence platform used by national and county governments, development partners, and implementing organizations to plan, deliver, and verify public infrastructure and service projects. This policy explains what we collect across the platform and the panarun.com website, and the choices available to you.
2. What we collect
2.1 Institutional account data. When a government or partner institution (a "tenant") onboards, we collect staff names, work email addresses, roles, and institutional affiliation, so accounts can be created and access can be scoped correctly under that tenant.
2.2 Field and evidence data. Field teams and contractors submit GPS-tagged photos, drone imagery, route footage, progress updates, inspection forms, and milestone records through the PANARUN Field app and web dashboards. This data belongs to the tenant institution that captured it.
2.3 Public and citizen-engagement data. Where a tenant enables public features, citizens can browse project information and, if they choose, leave comments, follow a project, or report a concern via the web map, WhatsApp, SMS, or USSD. We collect only what is needed to route and display that engagement — typically a message, an optional contact channel, and a project reference.
2.4 Information we collect automatically. Standard web log data (IP address, browser type, pages visited, referring URL) is collected when you use panarun.com or a tenant's public portal, for security and basic usage analytics.
3. How we use it
- To operate the platform: authenticate users, enforce role-based access, and keep each tenant's data isolated from every other tenant.
- To build the evidence-verified project record: linking field submissions, financial data, and inspections to a public status that carries its own proof.
- To route citizen engagement to the correct institution and project.
- To maintain security, investigate misuse, and keep an audit trail of material changes.
- To communicate with institutional users about their account, onboarding, or support requests.
4. Legal basis (for GDPR & equivalent laws)
Where applicable data-protection law requires a legal basis, we rely on: performance of the agreement with the tenant institution (account and platform data), legitimate interest in operating a secure, auditable public-accountability platform (security logs, integrity checks), and consent (optional citizen engagement submissions, analytics cookies — see our Cookies Policy).
5. Sharing & processors
We do not sell personal data, and we do not use tenant or citizen data for advertising. Data may be shared with: the tenant institution that owns the project data (that is the platform's purpose), infrastructure and hosting processors who run PANARUN's servers under a data-processing agreement, and authorities where disclosure is required by law.
6. Data residency & tenant isolation
Each government tenant is provisioned its own isolated database. One tenant's project, financial, or field data is never visible to another tenant. Where a tenant's agreement specifies a data-residency requirement, PANARUN accommodates it as part of onboarding.
7. Security
Access to tenant data is enforced by role-based permissions checked on the server, not just the interface. Secrets are encrypted, backups are automated, and material changes are recorded in an audit trail. No system is completely immune to risk, and we treat security as an ongoing responsibility rather than a one-time claim.
8. Retention
Institutional and field data is retained for the duration of the tenant's engagement with PANARUN and for a reasonable period afterward to satisfy audit, legal, and public-accountability obligations, after which it is deleted or anonymized in line with the tenant's own records-retention requirements. Citizen engagement submissions are retained only as long as needed to route and resolve them.
9. Your rights
Depending on where you are and which law applies, you may have the right to access, correct, or request deletion of your personal data, and to object to certain processing. Institutional staff should raise requests through their tenant administrator; citizens can use the contact details below.
10. Children
PANARUN's institutional tools are built for government and organizational staff. The public-facing features are general-audience civic information and are not directed at children; we do not knowingly collect personal data from children through those features.
11. Changes
We may update this policy as the platform evolves. Material changes will be reflected in the "Last updated" date above.
12. Contact us
Questions about this policy or a request concerning your data: [email protected].