Draft for review by an advocate before go-live (pending input 9.1).
This notice explains how [the operator's legal name] ("we") handles personal data in Octonerv ERP, under the Data Protection Act, 2019 of Kenya and, where they apply, the laws of the other countries we serve.
Two roles
- For the data our customers keep in the service (their customers, staff, suppliers, patients and students), the customer is the data controller and we are its processor. We act only on its instructions, as set out in the data processing agreement. Requests about that data go to the customer, and we help it answer them.
- For our own customers' contacts and users (names, email addresses, phone numbers, sign-in records and billing), we are the controller. This notice is about that data.
What we collect and why
- Account details: name, email, phone and the organisation. We use them to provide the service, bill for it and contact you about it (the contract).
- Security records: sign-in times, failed attempts, devices and IP addresses. We use them to keep accounts safe and stop abuse (our legitimate interest, and our duty to secure the data).
- Support conversations: to help you.
- Marketing: only if you agreed, and you can stop it at any time from any of our emails.
We do not sell personal data, and we do not use it for advertising profiles.
Your age
The service is only for people aged 18 or over, or the age of majority where they live if that is higher. We do not knowingly collect the data of children as users.
IP addresses
- Raw IP addresses of sign-ins are kept for 30 days, for security, and then deleted.
- Our audit trail stores a keyed pseudonym in place of the address, so events can be linked without revealing it.
- An address recorded as evidence of an electronic signature is kept with the signed document, as part of that evidence.
How long we keep it
| Data | Kept for |
|---|---|
| Security events with IP addresses | 30 days |
| Sign-up requests that were never confirmed | 30 days |
| Expired invitations and access tokens | 30 days after they end |
| Notifications | 90 days |
| Copyright notices and their handling | 3 years |
| Billing records | 7 years (tax law) |
| A customer's data after its account ends | 30 days, then deleted |
| Encrypted backups | 35 days, then removed |
Who we share it with
- Hosting: [the hosting provider and country, pending input 9.7].
- Email delivery: [the mail provider, pending input 9.4].
- Payments: Safaricom (M-Pesa) and Airtel, for payments you make or ask us to make.
- WhatsApp (Meta), for messages a customer sends through it.
- Anthropic, for the assistant, only when a customer switches it on.
Where data goes outside Kenya, we rely on the safeguards the Act requires: [to be confirmed, pending input 9.7].
Your rights
You may ask to see, correct or delete your data, object to its use, withdraw consent, or ask for a copy to take elsewhere. Write to our data protection officer at [contact, pending input 9.3]. We answer within the time the law gives. You may also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
Breaches
If a breach puts your data at risk, we tell the Data Commissioner within 72 hours and tell you without undue delay where the risk to you is high.
Changes
We tell you of a material change by email and in the service before it takes effect.