2.1Who we are
Edhafu Technologies, Shankardass House, Moi Avenue, Nairobi, runs Edhafu Payroll and Edhafu Ledgers. We comply with the Kenya Data Protection Act 2019 and its Regulations. Privacy contact: admin@edhafu.com.
2.2Our two roles
- Controller for Subscriber and Authorised User account data, payment data and usage data. This policy covers that data.
- Processor for Customer Data you upload about your employees, members or clients. Your organisation is the controller of that data and must give those people its own privacy notice. Our obligations as processor are in the Data Processing Agreement.
2.3Data we collect and why
| Data | Examples | Purpose | Lawful basis |
|---|---|---|---|
| Identity and contact | Name, email, phone, organisation, role, KRA PIN of the business | Create and manage your account | Contract |
| Payment | M-Pesa phone number, transaction code, amount, date, account number | Collect and reconcile subscriptions, issue receipts | Contract, legal obligation (tax records) |
| Consent and acceptance records | Document version accepted, timestamp, IP address, device/browser | Prove what you agreed to and when | Legitimate interest, legal obligation |
| Usage and security logs | Logins, IP address, actions in the app, error logs | Security, fraud prevention, audit trail, support | Legitimate interest |
| Support communication | Emails and messages to us | Resolve your requests | Contract |
| Marketing preferences | Opt-in to product news | Send updates you asked for | Consent (withdraw any time) |
If you do not provide required account or payment data, we cannot provide the Service.
2.4How we share data
We do not sell personal data. We share it only with service providers who process it for us under contract:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union: Edhafu Payroll in Ireland (eu-west-1), Edhafu Ledgers in Frankfurt, Germany (eu-central-1) |
| Netlify | Application hosting | Global content delivery network |
| Resend | Transactional email | United States (Resend default region) unless an EU region is selected |
| Safaricom PLC (M-Pesa Daraja) | Payment processing | Kenya |
We may also disclose data where required by law, a court order, or a regulator such as KRA or the ODPC.
2.5Transfers outside Kenya
Our databases are hosted in the European Union (Ireland and Germany), and email delivery may pass through the United States, both outside Kenya. We transfer data only where the Data Protection Act allows, using contractual safeguards and providers with recognised security certifications. You may ask us for details of these safeguards.
2.6How long we keep data
| Data | Retention |
|---|---|
| Account data | Life of the account, then deleted within 90 days of closure |
| Payment and invoice records | 7 years (tax and limitation periods) |
| Acceptance and consent records | Life of the account plus 7 years |
| Security and usage logs | 12 months |
| Customer Data | As set out in the Terms and the Data Processing Agreement |
2.7Security
We use encryption in transit (HTTPS) and at rest, role-based access, row-level security separating each organisation's data, multi-factor authentication for our administrators, daily backups and access logging.
2.8Your rights
Under the Data Protection Act you may: be informed how your data is used; access it; have it corrected; have it deleted where there is no legal reason to keep it; object to processing; receive it in a portable format; withdraw consent; and not be subject to decisions based solely on automated processing. Email admin@edhafu.com. We reply within 7 days where possible and in any case within the time the Regulations allow. We may ask you to verify your identity.
For employee or member records held in a Subscriber's account, contact that organisation first. We will help them respond.
2.9Data breaches
If a breach is likely to risk your rights, we notify the Office of the Data Protection Commissioner within 72 hours of becoming aware, and notify affected people without undue delay.
2.10Cookies
See the Cookie and Local Storage Notice.
2.11Children
The Service is for businesses and organisations. We do not knowingly collect account data from anyone under 18.
2.12Complaints
Contact us first at admin@edhafu.com. You may also complain to the Office of the Data Protection Commissioner at odpc.go.ke.
2.13Changes
We will notify you of material changes by email and in-app, and record your acknowledgement of the new version.