Privacy policy

This policy explains what personal data ComplyScope Kenya collects, why, how long we keep it and the rights you have under the Data Protection Act, 2019 of Kenya. Pentarch Systems Solutions is the data controller for account data and a data processor for the business records you enter.

What we collect

• Account data: your name, email address, optional mobile number and a securely hashed password.
• Business data you enter: business name, legal form, KRA PIN and registration number if you add them, activities, employee count, turnover band, branch names and counties, permit and certificate dates, filing references and documents you upload.
• Usage data: sign-in times, actions taken in the workspace (for your audit trail) and technical logs needed to keep the service secure.
• Payment data: when paid plans start, the M-Pesa number used, the amount and the M-Pesa receipt. We never see or store your M-Pesa PIN.

Why we use it

• To provide the service: work out which obligations apply, calculate due dates, send reminders and produce your dossier (performance of our contract with you).
• To keep accounts secure and prevent misuse (legitimate interest).
• To process payments and keep tax records (legal obligation).
• To send service emails such as confirmations, reminders and important changes. We do not send marketing without your consent.

Who we share it with

We do not sell personal data. We share it only with service providers that help us run ComplyScope, under contract: our hosting provider, our email provider, Safaricom (for M-Pesa payments) and, if you turn on SMS reminders, our SMS provider. Team members you invite can see the business data of businesses they belong to. We disclose data to authorities only where Kenyan law requires it.

Where it is stored

Data is stored on servers operated by our hosting provider. Where data is held outside Kenya, we rely on safeguards required by the Data Protection Act and its regulations.

How long we keep it

We keep account and business data while your account is active. If you delete a business or close your account, we delete or anonymise the data within 90 days, except records we must keep by law (for example payment records, kept for the period required by the Tax Procedures Act).

Your rights

You may ask to be informed about how your data is used, to access it, to correct it, to delete it, to object to processing and to receive a copy in a portable format. Write to pentarchsytemssol@gmail.com. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Security

Passwords are hashed, connections are encrypted, documents are private to your team and every change is logged. No system is perfectly secure; if a breach affects your data we will tell you and the ODPC as the law requires.

Contact

Pentarch Systems Solutions, Nairobi, Kenya · pentarchsytemssol@gmail.com