1. Introduction
AkibaPay Solution ("AkibaPay", "we", "us" or "our") respects your privacy and is committed to protecting personal information processed through the AkibaPay platform.
This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use AkibaPay, visit our website, communicate with us or use services provided through the Platform.
AkibaPay operates in Kenya and this Privacy Policy is intended to comply with applicable Kenyan data protection requirements, including the Data Protection Act, 2019 and applicable regulations and guidance.
2. Who We Are
AkibaPay Solution operates the AkibaPay platform.
Our contact details are:
AkibaPay Solution
Kenya
Phone: +254 716 327 828 | +254 723 947 679 | +254 726 860 901
Email: support@akibapay.africa
Website: akibapay.africa
3. Our Role in Data Processing
AkibaPay may act as both a Data Controller and a Data Processor, depending on the nature of the processing activity.
3.1 When AkibaPay Acts as a Data Controller
AkibaPay may determine the purposes and means of processing information relating to:
- Customer account administration;
- Subscription management;
- Billing and payment of subscription fees;
- Customer support;
- Platform security;
- Fraud prevention;
- Technical operations;
- Website visitors;
- Communications with AkibaPay; and
- Other activities where AkibaPay determines the purposes and means of processing.
3.2 When AkibaPay Acts as a Data Processor
A Chama or organization using AkibaPay may determine why and how its members' information is processed.
In such circumstances, the Chama or organization may act as the Data Controller while AkibaPay acts as a Data Processor processing information on the Chama's behalf.
This may include:
- Member records;
- Savings records;
- Contribution records;
- Loan records;
- Welfare records;
- Investment records;
- Expense records;
- Attendance records;
- Meeting minutes;
- Identification documents;
- Payment records; and
- Other information uploaded or entered by the Customer.
Where a Chama is responsible for determining the purpose and means of processing member information, requests relating to those processing activities may need to be directed to the relevant Chama or organization.
4. Information We Collect
Depending on how you use AkibaPay, we may process different types of information.
4.1 Identification Information
This may include:
- Full name;
- Member number;
- Identification information;
- Identification document details;
- Date of birth where required;
- Profile photograph where provided; and
- Other information provided for membership administration.
4.2 Contact Information
This may include:
- Telephone number;
- Email address;
- Postal or physical address where provided;
- Emergency contact information where configured by the Customer; and
- Other communication details.
4.3 Financial and Chama Information
AkibaPay may process information relating to a Member's participation in a Chama, including:
- Savings;
- Contributions;
- Monthly subscriptions;
- Loan applications;
- Loan balances;
- Loan repayments;
- Interest;
- Penalties;
- Welfare contributions;
- Investment records;
- Expenses;
- Income;
- Financial statements;
- Payment references;
- Transaction records; and
- Other financial records entered by the Customer.
4.4 Payment Information
AkibaPay may process information required to identify and reconcile payments.
This may include:
- Transaction references;
- Payment IDs;
- Account references;
- Transaction amounts;
- Transaction dates;
- Payment status;
- Receiving account information;
- M-PESA transaction information; and
- Other information returned by payment providers.
AkibaPay does not hold Customer funds. Payments are directed to receiving accounts designated by the Customer, such as a bank account, M-PESA PayBill or M-PESA Till.
4.5 Documents and Uploaded Content
Customers and Members may upload documents through AkibaPay, including:
- Meeting minutes;
- Identification documents;
- Receipts;
- Agreements;
- Financial documents;
- Reports;
- Supporting records; and
- Other documents relating to Chama activities.
Users should only upload documents where they have the authority or lawful basis to do so.
4.6 Technical Information
When you use AkibaPay, we may automatically process technical information such as:
- IP address;
- Browser type;
- Operating system;
- Device information;
- Login timestamps;
- Session information;
- Security logs;
- Audit logs;
- Error logs;
- Approximate location derived from technical information where necessary; and
- Other information required to operate and secure the Platform.
5. How We Collect Information
We may collect information:
- Directly from you;
- From your Chama or organization;
- When you create or use an AkibaPay account;
- When you make or receive a payment through an integrated service;
- When you upload documents;
- Through SMS or other communications;
- Automatically through your use of the Platform; and
- From third-party service providers where necessary to provide the Services.
6. How We Use Personal Information
We may process personal information to:
- Create and manage accounts;
- Provide AkibaPay Services;
- Manage subscriptions;
- Process billing;
- Provide customer support;
- Manage Chama members;
- Record savings and contributions;
- Record and administer loans;
- Manage welfare activities;
- Manage investments;
- Manage expenses;
- Reconcile payments;
- Send SMS notifications;
- Send service communications;
- Authenticate users;
- Maintain security;
- Detect and prevent fraud;
- Investigate unauthorized activity;
- Maintain audit trails;
- Back up information;
- Improve system performance;
- Diagnose technical problems;
- Comply with legal obligations;
- Resolve disputes; and
- Protect our legal rights.
7. Lawful Basis for Processing
Depending on the circumstances, personal information may be processed where:
- Processing is necessary for performance of a contract;
- Processing is necessary to comply with a legal obligation;
- You have provided consent where consent is required;
- Processing is necessary to protect vital interests;
- Processing is necessary for legitimate interests where permitted by law; or
- Another lawful basis under applicable Kenyan law applies.
8. Consent
Where AkibaPay relies on consent, consent will be requested in an appropriate manner and may be withdrawn subject to applicable law.
Withdrawal of consent does not invalidate processing that occurred before the withdrawal.
Where a Chama is responsible for obtaining consent from its members, the Chama is responsible for ensuring that consent is appropriately obtained where required.
Not all processing requires consent. Certain information may be processed because it is necessary to provide a service, comply with a legal obligation, maintain security or for another lawful purpose.
9. Sharing Personal Information
We may disclose personal information to third parties where reasonably necessary to provide the Services or comply with legal obligations.
9.1 Payment Providers
We may share or receive relevant information from payment providers, including M-PESA, for payment initiation, processing, confirmation and reconciliation.
9.2 SMS Providers
We may use third-party SMS service providers to deliver notifications, alerts, reminders and other service messages.
9.3 Hosting and Infrastructure Providers
We use third-party infrastructure and hosting providers, which may include Contabo, to host systems and store or process information.
9.4 Professional Advisers
Where reasonably necessary, information may be disclosed to legal, accounting, auditing, insurance or other professional advisers, subject to appropriate confidentiality obligations.
9.5 Government and Regulatory Authorities
Information may be disclosed where required by law, court order, regulatory requirement or another lawful authority.
9.6 Security and Fraud Prevention
Information may be processed by service providers assisting with security monitoring, fraud detection, technical operations or other functions necessary to protect the Platform.
We do not sell Customer financial records or Member information as a commercial product.
10. Payment Providers
AkibaPay may integrate with payment providers such as M-PESA.
When you make or receive a payment through an integrated payment service, the payment provider may independently process personal information under its own terms and privacy policies.
AkibaPay may receive information from payment providers necessary to:
- Confirm payments;
- Reconcile transactions;
- Identify transactions;
- Update payment status;
- Detect failed transactions; and
- Provide transaction records.
AkibaPay does not control the independent processing activities of third-party payment providers.
11. SMS Communications
AkibaPay may send SMS messages relating to:
- Contributions;
- Payments;
- Loan repayments;
- Loan reminders;
- Welfare contributions;
- Membership;
- Account activity;
- Subscription status;
- Security notifications;
- System notifications; and
- Other Chama-related activities.
Some SMS messages may be delivered through third-party SMS providers.
12. Data Storage and Security
We implement reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure.
Depending on the information and system involved, safeguards may include:
- Access controls;
- Authentication;
- Role-based permissions;
- Password protection;
- Audit logging;
- Server security;
- Network security;
- Backups;
- Monitoring;
- Security updates; and
- Other reasonable technical and organizational measures.
However, no electronic system, internet connection or method of data transmission can be guaranteed to be completely secure.
Users are responsible for protecting their login credentials, authentication information and devices.
13. Data Retention
We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including:
- Providing Services;
- Maintaining Customer records;
- Meeting contractual obligations;
- Complying with legal requirements;
- Resolving disputes;
- Preventing fraud;
- Maintaining security;
- Enforcing agreements; and
- Maintaining appropriate business records.
Retention periods may vary depending on the type of information, the purpose for which it was collected and applicable legal requirements.
When information is no longer required, it may be deleted, anonymized or securely disposed of, subject to applicable legal and operational requirements.
14. Customer-Controlled Information
Where a Chama uploads Member records to AkibaPay, the Chama may determine:
- What information is collected;
- Why it is collected;
- Who should have access;
- How it is used within the Chama; and
- How long it should be retained.
Customers are responsible for ensuring that their collection and use of Member information complies with applicable law.
AkibaPay provides technical tools but does not determine the Chama's internal governance decisions.
15. Data Subject Rights
Subject to applicable law, individuals have rights relating to their personal information, including the right:
- To be informed about the use of their personal information;
- To request access to personal information;
- To request correction of inaccurate information;
- To object to certain processing;
- To request deletion where applicable;
- To restrict certain processing where applicable;
- To request portability where applicable; and
- To exercise other rights provided by Kenyan data protection law.
16. How to Exercise Your Rights
For information controlled directly by AkibaPay, privacy and data-protection requests may be submitted to:
Email: info@akibapay.africa
Requests should provide sufficient information for us to identify the requester and understand the request.
We may need to verify the identity or authority of the requester before providing, correcting or deleting information.
Where the relevant information is controlled by a Chama, we may direct the request to the relevant Chama Administrator or Data Controller.
17. Accuracy of Information
We expect personal information stored in AkibaPay to be accurate and current.
Users and Customers should notify the relevant Administrator or AkibaPay where information is inaccurate.
Where a Chama controls the relevant information, the Chama may be responsible for correcting its records.
18. Children's Data
AkibaPay is primarily intended for adults and organizations managing Chamas and similar groups.
Customers must not knowingly provide information relating to children unless there is a lawful basis and appropriate authority to do so.
Where children's personal information is processed, additional safeguards may apply under applicable Kenyan law.
19. International Data Transfers
Some service providers used by AkibaPay may process or store information outside Kenya.
Where personal information is transferred outside Kenya, AkibaPay will take reasonable steps to ensure that the transfer and subsequent processing comply with applicable Kenyan data protection requirements.
20. Cookies and Similar Technologies
The AkibaPay website or Platform may use cookies or similar technologies to:
- Maintain user sessions;
- Authenticate users;
- Improve security;
- Remember preferences;
- Understand how the Platform is used; and
- Improve performance.
Where required by applicable law, users will be provided with appropriate information and choices regarding cookies.
21. Data Breaches
AkibaPay maintains procedures designed to detect, assess and respond to personal data security incidents.
Where a security incident occurs, AkibaPay may take steps to:
- Investigate the incident;
- Contain the incident;
- Assess potential impact;
- Take corrective action;
- Notify affected parties where required; and
- Notify relevant authorities where legally required.
22. Third-Party Websites and Services
AkibaPay may contain links or integrations to third-party websites and services.
We are not responsible for the privacy practices of third-party websites or services that are not controlled by AkibaPay.
Users should review the privacy policies of third-party services before providing personal information directly to them.
23. Marketing Communications
AkibaPay may send service-related communications necessary to operate the Platform.
Where we send promotional communications, we will provide appropriate means to opt out where required by law.
Opting out of marketing communications does not necessarily stop essential service, security, transaction or account communications.
24. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
The updated version will be published through the AkibaPay website or Platform.
The "Last Updated" date at the beginning of this Privacy Policy indicates when the policy was most recently revised.
Where required by applicable law, we will provide additional notice or obtain consent for material changes.
25. Complaints
If you believe that your personal information has been handled unlawfully or that your privacy rights have been violated, you should first contact us:
AkibaPay Solution
Kenya
Email:
info@akibapay.africa
You may also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya.
26. Contact Us
For privacy and data protection matters:
AkibaPay Solution
Kenya
Phone: +254 716 327 828 | +254 723 947 679 | +254 726 860 901
Email: support@akibapay.africa
Website: akibapay.africa
27. Applicable Law
This Privacy Policy is governed by the applicable laws of the Republic of Kenya, including the Data Protection Act, 2019 and applicable regulations.