Privacy Policy
1. Introduction
This Privacy Policy explains how UniSale Systems ("we", "us", or "our") collects, uses, stores, discloses, and protects personal data in connection with our cloud-based point-of-sale software and related services (the "Service").
We are committed to handling personal data responsibly and in accordance with applicable Kenyan law, including the Data Protection Act, 2019, and applicable regulations.
This Policy applies to our website, merchant accounts, POS application, customer support services, subscription management, and related business operations.
Our Service enables businesses ("Merchants") to manage sales, inventory, employees, suppliers, customer records, and other business activities.
Depending on the activity, we may act as a data controller or a data processor. The Merchant will generally determine why its business records are collected and used, while we process those records to provide and maintain the Service. We act as a controller for personal data we independently process for purposes such as managing our own accounts, billing, and security.
2. Personal Data We Collect
The categories of personal data we collect depend on how the Service is used.
2.1 Merchant account information
We may collect:
- Merchant or business name.
- Account holder's name.
- Email address and telephone number.
- Business address and other business details provided during registration.
- Login identifiers and account preferences.
- Subscription status and account administration records.
2.2 Sales and transaction records
Depending on the Merchant's use of the Service, records may include:
- Transaction dates and times.
- Products, quantities, prices, discounts, and totals.
- Receipts, invoices, and transaction references.
- Payment method and payment status.
- Refunds, voids, and adjustments.
- Cashier or employee identifiers associated with transactions.
2.3 Customer information
Merchants may enter information about their customers, including:
- Names and contact details.
- Purchase histories and transaction records.
- Loyalty or customer account information, where supported.
- Delivery or billing details, where supported.
Merchants are responsible for ensuring they have an appropriate legal basis to collect and use customer information through the Service.
2.4 Employee and user information
We may process:
- Employee names and usernames.
- Role and permission assignments.
- Login and access records.
- Actions recorded in audit logs.
- Work-related information entered into the Service.
Merchants are responsible for managing their employees' access and providing appropriate notices to employees whose information is processed.
2.5 Supplier information
Supplier records may include names, business contact details, addresses, order histories, invoices, payment references, and related procurement information.
2.6 Payment and subscription information
We may process subscription amounts, billing dates, payment status, transaction references, invoices, and payment confirmation information.
Where payments are made through M-Pesa or another payment provider, the information received will depend on the integration and the provider's processes.
We will not intentionally collect or retain payment authentication secrets, such as M-Pesa PINs, unless a specific lawful and secure arrangement expressly requires it. Users should never provide their PINs or account passwords to our support team.
Payment processing may also be subject to the payment provider's privacy policy and terms.
2.7 Technical and security information
We may collect information necessary to operate and secure the Service, including:
- IP addresses and access timestamps.
- Browser, device, and session information.
- Authentication events and failed login attempts.
- Application errors and diagnostic information.
- Administrative actions and security events.
We will seek to limit this information to what is reasonably necessary for the relevant purposes.
3. How We Use Personal Data
We process personal data for the following purposes, as applicable:
- Creating and administering merchant accounts.
- Providing POS, sales, inventory, reporting, and other subscribed functionality.
- Processing subscription payments and maintaining billing records.
- Providing customer support and resolving technical issues.
- Maintaining the integrity, availability, and security of the Service.
- Detecting unauthorized access, fraud, and abuse.
- Maintaining appropriate transaction, accounting, and business records.
- Complying with legal obligations and responding to lawful requests.
- Communicating important service announcements, security notices, and contractual changes.
- Improving reliability and performance using appropriately limited and, where appropriate, aggregated or anonymized information.
We will not use personal data for a new, incompatible purpose without an appropriate legal basis and any notices or consent required by law.
We will not sell personal data to third parties as a commercial data-broker service.
4. Lawful Basis for Processing
Where we act as a data controller, we will identify and document an applicable lawful basis for the processing activity.
Depending on the circumstances, these bases may include:
- Contract: Processing necessary to provide a requested service or administer a subscription.
- Legal obligation: Processing necessary to meet applicable accounting, tax, regulatory, or other legal requirements.
- Legitimate interests: Processing necessary for proportionate purposes such as security, fraud prevention, and service protection, where permitted by law and not overridden by individuals' rights.
- Consent: Processing based on valid consent where consent is the appropriate legal basis.
Where we process personal data as a Merchant's data processor, we will generally do so under the Merchant's documented instructions and the applicable Data Processing Agreement.
We will not treat acceptance of this Policy as blanket consent to every form of personal data processing.
5. Our Role and the Merchant's Responsibilities
Merchants generally act as data controllers for personal data they enter into the POS in connection with their own business operations.
In these circumstances, we act as a data processor to the extent that we process the information on their behalf.
Merchants are responsible for:
- Establishing a lawful basis for collecting and using their customers', employees', and suppliers' personal data.
- Providing appropriate privacy notices.
- Collecting only information reasonably necessary for their business purposes.
- Managing employee permissions and account access.
- Responding to requests from individuals concerning their data, with our assistance where appropriate.
- Meeting applicable tax, accounting, and recordkeeping requirements.
We will provide reasonable assistance with data protection requests and compliance matters to the extent required by law and our contractual obligations.
6. Sharing and Disclosure of Personal Data
We may disclose or permit access to personal data in the following circumstances:
6.1 Service providers
We may use third-party providers for cloud hosting, databases, email delivery, payment processing, monitoring, technical support, backups, and related infrastructure.
These providers will be given access only as reasonably necessary for their functions and subject to appropriate contractual and security safeguards.
6.2 Merchants and authorized users
Merchant data may be accessible to the Merchant and its authorized employees according to assigned roles and permissions.
We are not responsible for a Merchant's decision to grant access to its own authorized users, but we will implement appropriate access controls within the Service.
6.3 Legal and regulatory requirements
We may disclose information where required by applicable law, a valid court order, or a lawful regulatory request.
6.4 Business transfers
If the business or Service is transferred, restructured, or acquired, personal data may be disclosed as part of that transaction, subject to applicable law and appropriate safeguards.
We will not disclose personal data to unrelated third parties for their independent marketing purposes without an appropriate legal basis.
7. Storage and International Data Transfers
Personal data is stored using the infrastructure and service providers selected to operate the Service.
Current hosting provider: Render
Primary hosting region: Europe
Although our initial target market is Kenya, a hosting, backup, email, or payment provider may process information outside Kenya.
Where personal data is transferred outside Kenya, we will assess and implement the safeguards required by applicable Kenyan data protection law. We will provide relevant information about recipients and transfer safeguards where required.
We will not claim that all data is stored exclusively in Kenya unless this is factually accurate and maintained in practice.
8. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal obligations and other lawful grounds for retention.
Our retention decisions may take into account:
- The duration of the Merchant's subscription.
- The purpose of the data and whether it remains necessary.
- Applicable tax, accounting, and statutory recordkeeping requirements.
- Security, fraud prevention, and dispute-resolution needs.
- Legal claims and regulatory obligations.
- Backup rotation and deletion capabilities.
When personal data is no longer required, we will delete it, anonymize it, or otherwise handle it in accordance with applicable law.
Certain transaction, billing, or accounting records may need to be retained after an account closes. Such retention will be limited to the relevant purpose and applicable requirements.
We will maintain a separate internal retention schedule and update it as our services and legal obligations evolve.
9. Data Security
We implement technical and organizational safeguards appropriate to the nature of the data and the risks associated with processing.
Depending on the Service and its infrastructure, safeguards may include:
- Access controls and role-based permissions.
- Authentication and password security.
- Secure communications using HTTPS/TLS.
- Protection of application secrets and credentials.
- Restricted administrative access.
- Security logging and monitoring.
- Backups and recovery procedures.
- Software maintenance and vulnerability remediation.
- Procedures for responding to security incidents.
No online service or storage system can be guaranteed to be completely secure. We will take reasonable measures to protect personal data and address identified risks.
Merchants are responsible for maintaining the confidentiality of their credentials, promptly revoking access for former employees, and notifying us of suspected unauthorized access.
10. Data Breaches
If we become aware of a personal data breach affecting information we process, we will investigate and take reasonable steps to contain and mitigate the incident.
Where we act as a processor, we will notify the relevant Merchant without undue delay and in accordance with applicable law and our Data Processing Agreement.
Where we act as a controller, we will assess whether notification to the Office of the Data Protection Commissioner or affected individuals is legally required and comply with the applicable deadlines.
We will document incidents and implement appropriate corrective measures.
11. Your Data Protection Rights
Subject to applicable law and any lawful exceptions, individuals may have rights to:
- Be informed about the use of their personal data.
- Request access to personal data.
- Request correction of inaccurate or misleading data.
- Object to certain processing.
- Request deletion of personal data where legally applicable.
- Exercise any additional rights provided by applicable law.
Requests should be sent to collinsgitonga296@gmail.com.
We may request reasonable information to verify the identity and authority of the requester before disclosing or changing personal data.
Where the data is held by us on behalf of a Merchant, we may direct the request to the relevant Merchant or assist that Merchant in responding.
We will handle requests within the timeframes and according to the procedures required by applicable law.
12. Account Closure and Data Deletion
Merchants may request account closure or deletion through Support Email.
Before processing a request, we may verify the requester's identity and authority over the account.
We will delete or anonymize eligible personal data in accordance with applicable law, contractual obligations, and our retention schedule.
We may retain specific records where required by law or where another lawful basis justifies continued retention. Where appropriate, retained data will be restricted from ordinary use.
Data in backups may remain temporarily until the applicable backup rotation and expiry process completes. We will apply appropriate safeguards to such copies during that period.
Account closure may affect access to reports, sales history, and other business records. Merchants should export records they need before closure, subject to available Service functionality and applicable law.
13. Children's Data
The Service is intended for business use and is not designed to collect children's personal data unnecessarily.
Merchants must not enter children's personal data unless they have a lawful and appropriate reason to do so and meet applicable requirements for processing children's data.
If we discover that personal data has been collected unlawfully, we will assess the circumstances and take appropriate action.
14. Cookies and Similar Technologies
Our website or application may use essential cookies or similar technologies required for authentication, session management, security, and functionality.
If we introduce analytics, advertising, or other non-essential tracking technologies, we will provide appropriate notices and obtain consent where required by applicable law.
Users may be able to control certain cookies through their browser or available preference settings. Disabling essential cookies may prevent parts of the Service from functioning correctly.
15. Marketing and Communications
We may send service-related communications concerning account security, billing, maintenance, outages, and important contractual changes.
Where we send promotional communications, we will comply with applicable privacy and electronic communications requirements, including consent or other lawful-basis requirements where relevant and appropriate unsubscribe or objection mechanisms.
A Merchant may continue to receive essential service communications even after opting out of promotional messages.
16. Changes to This Policy
We may update this Policy to reflect changes in our Service, processing activities, security practices, or legal obligations.
We will update the "Last updated" date when appropriate. Where required by law or the nature of the change, we will provide additional notice or seek consent.
Material changes will not be applied in a manner that unlawfully removes existing rights.
17. Complaints and Contact
For questions, concerns, or requests concerning personal data, contact:
Business: UniSale Systems
Data protection contact: Munene Collins Gitonga
Email: collinsgitonga296@gmail.com
Address: 970-60100 Embu, Kenya
Telephone: +254 790 342 156
Individuals may also lodge a complaint with the Office of the Data Protection Commissioner in Kenya:
Website: https://www.odpc.go.ke/
We encourage individuals to contact us first where appropriate so we can understand and address their concerns.
18. Governing Law
This Policy is intended to operate in accordance with applicable Kenyan law, including the Data Protection Act, 2019, and applicable regulations.
Nothing in this Policy is intended to exclude or limit a right or obligation that cannot lawfully be excluded or limited.