This Data Protection Policy sets out how Monifyx meets its obligations under the Kenya Data Protection Act, 2019 and its regulations. It complements our Privacy Policy, which describes in plain language what information we collect, why, and how long it is kept.
1. Controller and processors
[Legal entity name], [Registered business address], Kenya, is the data controller for personal data processed through Monifyx. We decide why and how personal data is processed and are responsible for complying with the Act.
We use service providers that process personal data on our behalf, only on our instructions and for the purposes in the Privacy Policy. Some services you choose to use, such as sign-in and payment providers, also act under their own terms.
Registration with the Office of the Data Protection Commissioner (ODPC): [Registration status / number, to be confirmed]. Data protection contact: [Data protection contact email].
2. Principles
We process personal data lawfully, fairly and transparently; collect it for specified, explicit purposes; limit it to what is necessary; keep it accurate; keep it no longer than needed; and protect it with appropriate security, in line with section 25 of the Act.
3. Lawful bases
| Processing | Lawful basis |
|---|---|
| Running your account and providing the service, including organising the financial information you bring in | Performance of our contract with you |
| Reading financial messages on your phone; optional features you switch on | Your consent, which you can withdraw at any time |
| Security, fraud prevention, fair use of free trials, fixing problems | Our legitimate interests in a safe and reliable service |
| Keeping payment and accounting records | Legal obligation |
Financial information is handled with particular care: it is used only to provide the service to the person it belongs to and is never sold or used for advertising.
4. Data minimisation and purpose limitation
We collect only the personal data needed to provide the service, share with service providers only what each task requires, keep it no longer than needed, and do not use it for purposes incompatible with those for which it was collected.
5. Security safeguards
We use technical and organisational measures appropriate to the risk and review them regularly. No system is completely secure, and we do not claim otherwise.
6. Retention and deletion
Personal data is kept only as long as needed for its purpose. The retention of each category, including what happens on account deletion and in backups, is set out in section 8 of the Privacy Policy. In summary: account and financial information is kept while the account exists and deleted when it is deleted; deleted records stay available for undo for up to 90 days; security records are kept for 90 days and technical logs for up to 60 days; payment records are kept as required by law; and backups are replaced in the normal cycle.
7. Third-party processing
We choose processors that provide appropriate guarantees for the security of personal data, and give them only what each task needs. See section 5 of the Privacy Policy.
8. International transfers
Some processors handle personal data outside Kenya. We transfer personal data abroad only in line with Part VI of the Act, relying on appropriate safeguards (such as the contractual commitments of our providers) and transferring only what is necessary.
9. Your rights
You have the rights set out in section 26 and related provisions of the Act: to be informed, to access your personal data, to object to processing, to have inaccurate data corrected, to have data deleted, to data portability, and to withdraw consent. You can exercise many of these directly in the app; otherwise contact us. We will respond within the time required by the Act and may ask you to verify your identity first.
10. Personal data breaches
If a personal data breach occurs that is likely to put your rights at real risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires, and inform affected users without undue delay, with information on what happened and what they can do to protect themselves. We keep a record of breaches and the steps taken.
11. Complaints and contact
If you have a concern about how your personal data is handled, please contact us first at [Data protection contact email] and we will try to resolve it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya.
12. Review
We review this policy when the service or the law changes. The date at the top shows when it was last updated.