Protech Concepts Limited is the data controller for information collected through the Protech cloud platform.
We are registered in Kenya. Contact: legal@protechconcepts.co.ke
2. What We Collect
Account data: business name, owner name, phone number, email address.
Billing data: M-Pesa phone number and transaction references (not card numbers).
Business data: the records you enter — products, sales, customers, invoices.
This data is yours and we process it only to operate the Service.
Usage data: log files, error reports, and API call timestamps for operating
and improving the Service.
3. How We Use It
To provision and operate your workspace.
To process subscription payments via M-Pesa (Safaricom Daraja API).
To transmit tax invoices to KRA via the eTIMS API (required by law).
To send billing and operational SMS/email notifications.
To diagnose technical issues and improve the Service.
4. Who We Share It With
We do not sell your data. We share it only with:
Safaricom — to process M-Pesa payments.
Kenya Revenue Authority — tax invoice data required by the Tax Procedures Act.
Africa's Talking — to deliver SMS notifications (message body only, no financial data).
Our hosting provider — servers located in Kenya.
5. Retention
We retain your business data for the duration of your subscription plus 90 days after
termination (during which you can request an export). Billing records are kept for 7 years
as required by Kenyan tax law.
6. Your Rights
Under the Kenya Data Protection Act 2019 you have the right to access, correct, delete, and
port your personal data. Requests: legal@protechconcepts.co.ke.
We will respond within 21 days.
7. Security
All data is encrypted in transit (TLS 1.2+). Tenant database passwords and API credentials
are encrypted at rest using AES-256. Access to production systems is restricted to authorised
staff with multi-factor authentication.
8. Cookies
The control panel uses a session cookie for authentication only. No tracking or advertising
cookies are set.
9. Changes
Material changes to this policy will be notified by email at least 30 days in advance.