Privacy Policy - VerityKe

VerityKe ("Verity", "we", "us", or "our") is committed to protecting your privacy and complying with the Kenya Data Protection Act, 2019. This Privacy Policy explains how we collect, use, store, and protect your personal and business data when you use our credit sales management platform.

This policy applies to all users of VerityKe, including business owners, team members, and any individuals whose data is processed through our platform.

1. Data Controller Information

Data Controller: VerityKe

Compliance: Kenya Data Protection Act, 2019

Contact Email: [email protected]

Phone: +254 707 018 623

Data Protection Officer: [email protected]

2. Information We Collect

2.1 Business Account Information

When you create a business account, we collect:

Business name
Business email address and phone number
Business physical address
Business owner/manager contact information

2.2 User Account Information

For team members accessing the platform:

Full name
Email address
Phone number (optional)
Role and permissions within the business

2.3 Customer Data

You (the business) input customer information into our platform, which may include:

Customer names
Contact information (email, phone number, address)
National ID or other identification numbers (if provided by you)
Purchase history and credit balance information

IMPORTANT: When you input customer data into our platform, you act as the Data Controller for that information. We act as a Data Processor on your behalf. You are responsible for obtaining appropriate consent from your customers and complying with data protection laws.

2.4 Transaction and Financial Data

Credit sales records (date, amount, items)
Payment records (date, amount, method)
Outstanding balances
Financial summaries and reports

2.5 Usage and Technical Data

IP addresses and device information
Browser type and operating system
Login times and activity logs
Features used and pages accessed
Error reports and diagnostic data

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

Providing and maintaining the credit sales management platform
Processing credit sales and payment records
Generating reports and analytics
Enabling team collaboration features

3.2 Account Management

Creating and managing user accounts
Authenticating users and preventing unauthorized access
Communicating about account status, billing, and service updates

3.3 Improvement and Development

Analyzing usage patterns to improve features
Troubleshooting technical issues
Developing new functionality
Conducting research to enhance user experience

3.4 Security and Fraud Prevention

Detecting and preventing security threats
Investigating suspicious activity
Protecting against fraud and unauthorized access

3.5 Legal Compliance

Complying with legal obligations under Kenyan law
Responding to lawful requests from authorities
Enforcing our Terms of Service

4. Legal Basis for Processing (Kenya Data Protection Act, 2019)

We process your personal data based on the following legal grounds:

Contractual Necessity: To fulfill our obligations under the service agreement with you
Consent: When you voluntarily provide information or agree to specific processing activities
Legitimate Interests: For improving our services, security, and fraud prevention
Legal Obligation: To comply with Kenyan laws and regulations

5. Data Sharing and Disclosure

We do NOT sell your personal data.

We may share your information in the following limited circumstances:

5.1 Service Providers

We engage third-party service providers to support our operations, including cloud hosting (e.g., AWS, Google Cloud), payment processing (e.g., M-Pesa integration), and email services. These providers are contractually obligated to protect your data and use it only for specified purposes.

5.2 Legal Requirements

We may disclose information when required by Kenyan law, court order, or government request, or to protect the rights, property, or safety of Verity, our users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you of any such change.

5.4 With Your Consent

We may share data with third parties when you explicitly consent to such sharing.

6. Data Storage and Security

6.1 Data Storage Location

Your data is stored on secure cloud servers. While our primary infrastructure may be hosted outside Kenya (in data centers operated by reputable providers like AWS or Google Cloud), we ensure that all data transfers comply with the Kenya Data Protection Act and that appropriate safeguards are in place.

6.2 Security Measures

We implement industry-standard security measures, including:

Encryption of data in transit (HTTPS/TLS) and at rest
Secure authentication mechanisms (passwords, OAuth)
Regular security audits and vulnerability assessments
Access controls limiting employee access to data
Automated backups and disaster recovery procedures

Disclaimer: While we strive to protect your data, no system is completely secure. You acknowledge that data transmission over the internet carries inherent risks, and we cannot guarantee absolute security.

6.3 Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account termination, we may retain certain data for up to 90 days for backup purposes, and longer if required by law (e.g., tax records for 7 years as per KRA requirements). You may request deletion of your data at any time, subject to legal retention obligations.

7. Your Rights Under the Kenya Data Protection Act, 2019

You have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your data (subject to legal obligations)
Right to Restriction: Limit how we process your data in certain circumstances
Right to Data Portability: Receive your data in a structured, commonly used format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Withdraw consent for processing where consent was the legal basis

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days as required by law.

8. Cookies and Tracking Technologies

We use cookies and similar technologies to maintain user sessions, remember preferences, and analyze usage patterns. You can control cookie settings through your browser. Disabling cookies may limit some functionality of the Service.

9. Third-Party Services and Links

Our platform may integrate with third-party services (e.g., payment gateways, analytics tools). We are not responsible for the privacy practices of these third parties. Please review their privacy policies before providing them with your information.

10. Children's Privacy

VerityKe is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, as required by the Kenya Data Protection Act.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Information and Complaints

13.1 Contact Us

For questions, concerns, or to exercise your rights:

Data Protection Officer: [email protected]

Privacy Inquiries: [email protected]

Phone: +254 707 018 623

Address: Nairobi, Kenya

13.2 Complaints to the Data Protection Commissioner

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner

Website: www.odpc.go.ke

Email: [email protected]

Telephone: +254 796 954 269 or +254752 896 867