Privacy Policy
Draft for review. Complete the bracketed items and have a Kenyan lawyer check it against the Data Protection Act, 2019 before you rely on it, including whether you must register with the Office of the Data Protection Commissioner.
1. Roles
For the data your organization enters about its own staff, customers, suppliers and sales, your organization is the data controller and [Company legal name] ("we") is its processor, acting on your instructions. For account and sign-in details and for our own website, we are the controller.
2. What we hold
- Account data: name, email address, role, and sign-in records (time and device information) for each user.
- Business data you enter: sales, meter and tank readings, cash counts, customer and supplier details (names, contacts, vehicle registrations, credit balances), staff records and attendance, invoices, receipts and accounting entries.
- Technical data: logs needed to run and secure the service. If your station's connection drops, unsent entries are kept on the device until they sync.
3. Why we use it
To provide and secure the service you asked for, to send you service messages such as account invitations and customer balance notices you have switched on, to meet legal obligations, and to fix faults. We do not sell personal data and do not use your business data for advertising.
4. Who can see it
Within your organization, access follows the roles your owner assigns. Different organizations' data is separated in the database and one organization cannot read another's. Our staff access data only to support or secure the service. We use infrastructure providers to host and deliver the service, currently Supabase (database and authentication) and Cloudflare (web hosting), and an email provider to send messages. They process data on our behalf under their own security commitments. Data may be stored outside Kenya; where it is, we rely on those providers' safeguards.
5. Security
Data is encrypted in transit, access is controlled by role, platform administrator accounts can be protected with multi-factor authentication, and changes to key configuration are recorded in an audit trail. No system is perfectly secure; we will notify the affected organization without undue delay if we learn of a breach affecting its data, as the law requires.
6. How long we keep it
For as long as your organization has an account, plus any period the law requires for financial records. After termination we export and delete your data on request, as set out in our Terms of Service.
7. Your rights
Individuals have rights to be informed, to access their data, to correct it, to object, and to have it deleted where the law allows. For data held by an organization using VaultraFMS, contact that organization first; we will help it respond. For our own records, contact us at the address below.
8. Cookies
This website uses no tracking or advertising cookies. The application stores a session and a few preferences, such as your last station, in your browser so it works.
9. Contact
[Company legal name], [registered address], Kenya. Email: [email protected]. Complaints can also be made to the Office of the Data Protection Commissioner.