1. Who we are
[Paysasa legal entity name] Limited (“Paysasa”, “we”) is the data controller for personal data of visitors, account holders and users of our wallets and checkout. When a merchant uses Paysasa to collect payments from its own customers, the merchant is the controller of its customers’ data and Paysasa acts as a processor. We are registered with the Office of the Data Protection Commissioner (ODPC) under no. [ODPC registration no.]. Our Data Protection Officer is reachable at [email protected].
2. Information we collect
- Identity and contact: name, phone number, email, date of birth, national ID or passport number, photo and selfie for verification.
- Business data: business name, registration documents, KRA PIN, directors and beneficial owners.
- Transaction data: amounts, counterparties, M-Pesa and Airtel numbers, reference codes, bank or card details handled by our payment partners, escrow history, chama, Lengo and Deni records.
- Device and usage data: IP address, device identifiers, log data and location derived from IP, used for security and fraud prevention.
- Communications: support chats, emails and call notes.
Card numbers are processed by PCI DSS-compliant partners and are not stored on Paysasa servers.
3. How we use information
We use personal data to open and secure accounts, verify identity, process and reconcile payments, hold funds in escrow, prevent fraud and money laundering, provide support, send service messages and statements, improve the product, meet legal obligations and, where you agree, send product updates. We do not sell personal data and we do not use wallet or transaction data for third-party advertising.
4. Lawful bases
Under the Data Protection Act, 2019 we rely on: performance of a contract with you; compliance with legal obligations (for example POCAMLA and NPS Act requirements); legitimate interests such as security and fraud prevention, balanced against your rights; and consent where required, for example for marketing messages and optional cookies. You may withdraw consent at any time.
6. International transfers
Some providers may process data outside Kenya. Where this happens we apply the safeguards required by the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, such as contractual protections or your consent. [State hosting regions and any localisation requirements for payment data.]
7. Retention
We keep transaction and verification records for at least [seven] years after an account closes, or longer where required by anti-money-laundering or tax law. Other data is kept only as long as needed for its purpose and then deleted or anonymised. [Confirm retention schedule.]
8. Your rights
You have the right to be informed; to access your personal data; to object to processing; to correct inaccurate data; to request deletion of data that is no longer needed; and to data portability, among others, subject to legal retention duties. To exercise a right email our Data Protection Officer at [email protected]. We respond within the time set by the Act (generally 30 days). You may also complain to the ODPC.
9. Security
We use encryption in transit and at rest, role-based access, multi-factor authentication, audit logs and monitored infrastructure. If a breach is likely to put individuals at risk we will notify the ODPC within 72 hours and affected users without unreasonable delay. See our Security page.
10. Children
Paysasa is for people aged 18 and over. We do not knowingly collect children’s data. If you believe a child has an account, contact us and we will act promptly.
11. Automated decisions
We use automated risk scoring to detect fraud and enforce limits. You may ask for a person to review a decision that significantly affects you.
13. Changes to this policy
We will post updates here and notify account holders of material changes.
14. Contact and complaints
Email [email protected] or write to [Registered office address], Nairobi, Kenya. You may also contact the Office of the Data Protection Commissioner, Kenya.