1. Our Commitment
SawaPOS is committed to protecting the privacy of our users. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights under the Kenya Data Protection Act, 2019 and other applicable laws.
2. Data We Collect
2.1 Information you provide
- Account: business name, owner name, email, phone number, KRA PIN (if provided)
- Payment: M-Pesa phone number, transaction IDs (we never store M-Pesa PINs)
- Business data: products, prices, customers, sales, inventory, staff, receipts
2.2 Information collected automatically
- Device and browser information
- IP address and approximate location
- Usage logs (pages visited, features used, timestamps)
- Crash and error logs
3. How We Use Your Data
- To provide and improve the SawaPOS service
- To process subscription payments via M-Pesa and Kopokopo
- To send transactional emails (receipts, payment confirmations, password resets)
- To provide customer support
- To comply with legal obligations (KRA, CBK, court orders)
- To detect fraud and abuse
4. Legal Basis for Processing
We process your data under the following legal bases:
- Contract: to deliver the Service you signed up for
- Legitimate interest: to improve our product and prevent fraud
- Consent: for marketing communications (which you can opt out of at any time)
- Legal obligation: where required by Kenyan law
5. Sharing Your Data
We never sell your data. We share data only with:
- Safaricom (M-Pesa) — to process payments
- Kopokopo — to process Till payments
- Cloud infrastructure providers — to host the Service (data is encrypted at rest and in transit)
- Email and SMS providers — to send transactional notifications
- Law enforcement — only when legally compelled by a Kenyan court order or KRA notice
6. Data Retention
We retain your business data for as long as your account is active and for up to 90 days after account closure, after which it is permanently deleted from our active systems. Financial records may be retained longer where required by Kenyan tax law (typically 7 years).
7. Security
We protect your data using industry-best practices:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for data at rest
- Role-based access controls and least-privilege principles
- Daily encrypted backups
- Regular security audits and penetration testing
- Multi-factor authentication available for all accounts
8. Your Rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your data (subject to legal retention obligations)
- Export your data in a portable format (CSV, JSON)
- Object to processing for marketing
- Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya
To exercise these rights, email privacy@sawapos.com.
9. Cookies
We use essential cookies to keep you logged in and analytical cookies to understand how SawaPOS is used. You can disable non-essential cookies in your browser settings without affecting core functionality.
10. International Transfers
Where data is processed outside Kenya (e.g. cloud infrastructure providers), we ensure appropriate safeguards including Standard Contractual Clauses and only work with providers compliant with global data protection standards.
11. Children's Privacy
SawaPOS is not intended for users under 18 years of age. We do not knowingly collect data from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email at least 14 days before they take effect.
13. Contact
Data Protection Officer:
- Email: privacy@sawapos.com
- WhatsApp: +254 7XX XXX XXX
- Address: Nairobi, Kenya