Privacy Policy

1. Who we are and what this policy covers

Efikas ERP for SME ("Efikas", "we", "us") is business software for small businesses in Kenya: selling, stock, customers, expenses, invoices, projects, payroll and accounting, on the web and in a mobile app that keeps working without internet.

This policy explains what personal data we handle, why, who sees it, how long we keep it and what choices you have. It follows the Kenya Data Protection Act, 2019. It covers the Efikas website, the web app and the mobile app.

There are two roles. For the details of the people who sign up and use Efikas (you and your staff), Efikas is the data controller. For the records a business keeps about its own customers, suppliers, employees and sales, the business is the controller and Efikas is its processor: we store and process those records only to run the service for that business.

2. The information we collect

We collect only what is needed to run the service. Depending on how you use it, that includes:

• Account details: your first and last name, email address, phone number, and a password (kept only as a one-way hash, never in plain text).
• Business details: the business name, type, branches, logo, address and tax settings, your role and the permissions your business gives you.
• Business records you enter: products and services, prices and stock, sales and payments, expenses, purchases, suppliers, invoices, quotations, projects, tasks and documents, payroll and employee details, and accounting entries.
• Customer and client details entered by a business: names, business names, phone numbers, email addresses, addresses, a logo, and a contact person for business clients. A business should only record what it needs and has a lawful reason to hold.
• Files you upload: logos, signatures, product photos, receipt photos and project documents.
• Payment information: M-Pesa phone numbers and transaction references for payments made through the app, and the status of your Efikas subscription and SMS credits. We do not collect or store card numbers; card and mobile-money payments are handled by our payment partners.
• Device and usage information: a device identifier, app version, the time the device last connected, sign-in and security events, and an audit trail of who changed what. This helps us keep accounts secure, sync work from offline devices and investigate problems.
• Messages: the SMS and email messages we send for you (such as receipts, invoices, reminders and sign-in codes), and whether they were delivered.
• Support information: what you tell us when you ask for help.

3. How we use your information

We send marketing messages to a business's customers only where the business has their consent, and you can ask us to stop at any time. We do not sell personal data, and we do not use your business records for advertising.

We use personal data to:

• create and secure your account, and sign you in (including with your fingerprint or face on a phone that supports it);
• provide the features you use, such as recording sales, issuing receipts and invoices, running payroll and producing reports;
• sync work done offline on a device with the server, and prevent duplicate or conflicting records;
• send receipts, invoices, reminders, security notices and service messages by SMS or email;
• process your subscription and SMS-credit payments, and referral rewards;
• keep the service safe: detecting misuse, fraud and unauthorised access, and keeping an audit trail;
• fix problems, support you, and improve the service using aggregate information about how features are used;
• meet legal obligations, for example keeping accounting and tax records.

4. Our legal basis

We handle personal data because it is needed to provide the service you asked for (contract), because you agreed to it (consent, for example for marketing messages or for using your phone's camera), because the law requires it (for example keeping financial records), or because we have a genuine interest in running a secure and reliable service that does not override your rights.

5. Who we share information with

Within a business, people see what their role allows. Owners decide which staff can view, create, edit, delete or export each kind of record, and who can see balances and profit.

We do not sell personal data to anyone. We may disclose information when the law requires it, such as to a court or a government authority, or to protect the rights, safety and property of Efikas, our users and others. If Efikas is ever sold or merged, personal data may transfer to the new owner, who must honour this policy.

We use trusted service providers to run Efikas. They may only handle data on our instructions and to deliver their service:

• cloud hosting and a managed database, where your records are stored;
• Cloudflare R2 for private file storage (logos, photos, receipts and documents);
• Safaricom (M-Pesa Daraja) and Paystack for payments;
• TextSMS for sending SMS messages;
• an email delivery service for sending email.

6. Working offline, and your phone

The mobile app keeps a copy of the data you need (your catalogue, customers and recent work) in an encrypted database on the phone, so you can keep selling without internet. It syncs with our servers when you are back online.

Fingerprint or face sign-in is checked by your phone. Your fingerprint or face data never leaves the phone and is never sent to us; we only learn that your phone confirmed it was you. You can turn it off in Settings.

The app asks permission to use the camera and photos only when you choose to take or attach a picture or scan a barcode, and to open files only when you attach a document. You can withdraw a permission in your phone's settings. We do not track your location.

7. How long we keep information

We keep account and business data while your account is active. If you delete your account, sign-in is blocked immediately and the data is kept for a 30-day grace period in case you change your mind, and is then deleted permanently.

Some records have to be kept longer by law, such as accounting and tax records, and sales history that other records depend on. Where that applies, we keep what the law requires and remove personal details that are no longer needed. Backups are overwritten on a regular cycle, so deleted data can remain in a backup for a short time before it disappears.

A business can anonymise a customer's personal details on request: their name, phone, email and address are removed for good while the sales and accounting records stay, so the books still add up.

8. How we protect information

We protect data with encryption in transit (TLS) and encrypted storage for sensitive secrets, hashed passwords, a permission check on every request, separation between businesses, rate limiting, verified payment callbacks, an encrypted database on the phone, and an audit trail. We back up the database daily. No system is perfectly secure, so please use a strong password, keep your phone locked, and tell us at once if you think your account was misused. If a breach affects your personal data, we will tell you and the Data Protection Commissioner as the law requires.

9. Your rights

You can edit your profile and delete your account in the app. If you are a customer or employee of a business that uses Efikas, please ask that business first, because it controls your records; we will help it respond. To exercise any right with us, write to us at the address at the end of this policy.

Under the Data Protection Act you have the right to:

• be told how your data is used, and to see the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, where we no longer need it or have no legal reason to keep it;
• object to, or ask us to limit, certain uses of your data, including direct marketing;
• receive your data in a usable format (businesses can export their records from the app where their role allows it);
• withdraw consent you gave us, without affecting what happened before;
• complain to the Office of the Data Protection Commissioner of Kenya if you think we have mishandled your data.

10. Cookies and similar technologies

The web app uses cookies that are necessary to keep you signed in and secure (session tokens that cannot be read by scripts on the page), and your browser storage for small conveniences such as your last payment method. We do not use advertising cookies or third-party advertising trackers.

11. Children

Efikas is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, tell us and we will delete it.

12. Where data is processed

Our providers may process data on servers outside Kenya. When that happens we make sure the provider protects it to a standard that matches this policy and the law, for example through contracts and security commitments.

13. Changes to this policy

We may update this policy as the service or the law changes. When we make an important change we will tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.

14. Contact us

Questions, requests or complaints about privacy: write to us at privacy@efikas.co.ke. Please say which business and account it is about so we can find it. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner, Kenya (www.odpc.go.ke).