Privacy policy

1. Introduction

We respect your privacy and handle personal data in line with the Kenya Data Protection Act, 2019 (the “DPA”) and other applicable law. This policy covers personal data relating to our customers (the businesses that use LipaPOS), their staff, and visitors to our website. Where you use LipaPOS to hold data about your own customers, you are the controller of that data and we act as a processor on your instructions — see section 2.

2. Who is responsible for your data

BD Computing Limited, the company that develops and operates LipaPOS (bdcomputing.co.ke), is the data controller for the personal data described in this policy — the data of our customers, their staff accounts, and website visitors. We are based in Eldoret, Kenya (Khetia’s Building, 4th floor). Our contact details are in section 14.

For the customer and transaction records you keep inside the Service (for example your shoppers' names and phone numbers), you are the controller and we process that data only to provide the Service and on your instructions.

3. Information we collect

• Account and profile data: your name, business name, email address, phone number, role and login credentials.
• Billing data: your plan, invoices and the payment details needed to collect subscription fees.
• Service data: the products, prices, sales, payments, stock, staff and customer records you enter, and the configuration of your tills, printers and integrations.
• Usage and device data: log-in events, IP address, device and browser type, and how you use the Service, collected to keep it secure and improve it.
• Support data: the messages and files you send us when you ask for help.

Some of this data is provided directly by you, some is generated as you use the Service, and some may come from a third party you connect (such as a payment provider confirming a payment).

4. How we use information

• to create and administer your account and provide the Service;
• to take payment, issue invoices and manage your subscription;
• to secure the Service, prevent fraud and abuse, and keep an audit trail;
• to provide support, respond to your requests and send service messages;
• to monitor, troubleshoot and improve the Service, and to develop new features;
• to send you product or marketing messages where you have agreed or where the law allows, which you can opt out of at any time; and
• to meet our legal, tax and regulatory obligations.

We do not sell your personal data, and we do not use your business data to advertise to your customers.

5. Our legal bases

Under the DPA, we rely on one or more of the following:

• Performance of a contract: to provide the Service and administer your account.
• Legitimate interests: to secure and improve the Service, prevent fraud and run our business, balanced against your rights.
• Consent: for optional marketing and any other purpose where we ask for your consent, which you may withdraw at any time.
• Legal obligation: to keep records for tax, accounting and regulatory purposes.

6. Sharing and third parties

We share personal data only as needed, and with parties who are bound to protect it. These include:

• Payment providers such as M-Pesa (Safaricom) and card processors, to take and reconcile payments;
• Infrastructure and service providers who host, store, back up, print, send messages or otherwise support the Service;
• Professional advisers such as auditors and lawyers; and
• Authorities where we are required by law or where it is necessary to protect rights, safety and the integrity of the Service.

We may also share data with a buyer or successor in the event of a reorganisation, merger or sale of our business, subject to this policy.

7. How long we keep data

We keep personal data for as long as your account is active and for as long as we need it for the purposes above, after which we delete, de-identify or archive it. Some records — for example invoices, payment reconciliation and tax data — are kept for the periods required by law. When you close your account, we will make Your Data available for export for a reasonable period before deletion.

8. How we protect data

We use technical and organisational measures to protect personal data, including encryption in transit, access controls and role-based permissions, authentication, audit logging, and regular review of our practices. No system is completely secure, so we cannot guarantee absolute security; we will notify you and the relevant authority of a personal-data breach where the law requires it.

9. Your rights

Subject to the DPA, you have the right to:

• be informed how your data is used, and to access it;
• request correction of inaccurate or out-of-date data;
• request erasure of data that is no longer needed;
• object to, or restrict, certain processing;
• receive your data in a portable format, or ask us to transfer it;
• withdraw consent where we rely on it; and
• lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

To exercise a right, contact us using the details in section 14. We may need to verify your identity, and we may not be able to act where the law requires us to keep a record.

10. Cookies and similar technologies

On our website and in the Service we use cookies and similar technologies that are necessary to sign you in, keep your session secure and remember your preferences. We may also use limited analytics to understand how the Service is used. You can control cookies through your browser settings; blocking essential cookies may stop parts of the Service from working.

11. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from children, and we do not intend for them to use the Service.

12. International transfers

Some of our service providers may store or process data outside Kenya. Where we transfer personal data across borders, we take steps to ensure it receives an adequate level of protection as required by the DPA, including through contractual safeguards with those providers.

13. Changes to this policy

We may update this policy from time to time. Where a change is material we will give reasonable notice — for example by email or an in-app notice — and the updated policy takes effect from the date we publish it.

14. Contact us

For any privacy question or to exercise a right, contact us at [email protected] or [email protected], or call 0725 270 930 or 0719 155 083. Our address is:

LipaPOS
Khetia’s Building, 4th floor
Eldoret, Kenya

You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) of Kenya.