Escrow Safe Trade is live: protect your next high-value deal Learn more
ProductsPayment links & checkoutM-Pesa, cards, invoices, split payoutsEscrow Safe TradeMilestone and release-based escrowWallets & P2PPersonal and business walletsChama, Lengo & DeniGroup savings, goals and IOUsBusiness toolkitAccounting, payroll, POS, ticketingBulk payments & payrollPay many people in one uploadSubscriptions & billingRecurring plans and renewalsRent, loans & donationsCollections and campaignsAll products
SolutionsMerchantsBuyersChama groupsBusiness solutionsIndustries
Pricing
DevelopersDeveloper overviewQuickstart, auth and sandboxREST APIsCheckout, invoices and requestsWebhooksSigned, real-time eventsWallet-as-a-ServiceVirtual sub-accountsDocumentationGuides and API reference
Security
CompanyAbout usCareersPartnersBlogHelp centreContact us
Log in Get started Talk to sales
Legal

Data Protection

How Paysasa protects personal data as controller and processor under Kenya’s Data Protection Act, 2019.

Last updated: 28 October 2026 · Applies to users in Kenya and across Africa · Version [1.0]

Template: not legal advice. This document is a starting template drafted with Kenyan law and the Central Bank of Kenya (CBK) payments framework in mind. It must be reviewed and adapted by a qualified Kenyan advocate before you publish or rely on it. Replace every [bracketed placeholder], confirm licensing statements and check each statutory reference against the current law.

1. Our commitment

[Paysasa legal entity name] Limited designs Paysasa to meet its obligations under the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, and to help businesses that use Paysasa meet theirs.

2. Controller and processor roles

For our own customers and users we are the data controller. When a merchant or platform uses Paysasa to collect or pay its customers, partners or staff, the merchant is the controller and Paysasa is its processor, acting on documented instructions under a written agreement. Where we process data for our own fraud, AML or legal-compliance duties, we act as an independent controller.

3. Principles we follow

  • Lawfulness, fairness and transparency
  • Purpose limitation and data minimisation
  • Accuracy and storage limitation
  • Integrity and confidentiality
  • Accountability, including records of processing and data protection impact assessments for high-risk processing

4. Registration with the ODPC

Paysasa is registered as a data controller and processor with the Office of the Data Protection Commissioner, registration no. [ODPC registration no.]. Merchants should check whether they must register and keep their registration current.

5. Supporting data-subject requests

We provide tools and a process so merchants can respond to access, correction, deletion and portability requests that relate to data held in Paysasa. Requests concerning our own data can be sent to our Data Protection Officer at [email protected].

6. Breach response

We maintain an incident response process. We notify the ODPC within 72 hours of becoming aware of a breach likely to risk individuals’ rights, and notify affected merchants without undue delay so they can meet their own duties.

7. Cross-border processing and localisation

Where data is processed outside Kenya we apply the safeguards required by the Act and Regulations. Some payment data may need to be processed in Kenya under the Data Protection (General) Regulations and sector rules. [Lawyer to confirm localisation requirements and list hosting regions and sub-processors.]

8. Sub-processors

We use sub-processors for hosting, messaging, identity verification and support under written agreements that impose equivalent protections. Merchants can request the current list and we give notice before adding material new ones.

9. Data processing agreement

Merchants and platforms can request our data processing agreement (DPA). It sets out the subject matter and duration of processing, instructions, security measures, sub-processor controls, assistance with data-subject requests, breach notification and return or deletion of data at the end of the services.

10. Data protection contact

Data Protection Officer: [email protected]. Address: [Registered office address], Nairobi, Kenya.