Privacy Policy
Effective date: 9 July 2026
This policy is made in compliance with the Data Protection Act, 2019 (Kenya) and the regulations published thereunder by the Office of the Data Protection Commissioner (ODPC).
1. Who We Are (Data Controller)
Sisimizi Technologies ("Sisimizi", "we", "us") is the data controller for personal data processed through the WakLog platform. WakLog is a multi-tenant SaaS platform serving Kenyan service businesses.
Contact for data protection matters:
Data Protection Contact
Email: privacy@sisimizi.co.ke
Postal: P.O. Box [registered address], Nairobi, Kenya
We are registered with / in the process of registering with the Office of the Data Protection Commissioner (ODPC) as a data controller in accordance with Section 18 of the Data Protection Act, 2019.
2. About This Policy
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use WakLog. It applies to:
- Tenant administrators and staff — individuals who register and manage a WakLog workspace.
- End customers — clients of WakLog tenants whose data is entered into the platform by the tenant (e.g. customer name, phone number).
WakLog tenants also act as data controllers in relation to their customers' data. By using WakLog to process customer data you acknowledge your own obligations under the Data Protection Act, 2019.
3. Personal Data We Collect
3.1 Tenant account data (collected directly from you when you register):
- Business name and URL handle (slug)
- Administrator full name and email address
- Business phone number
- Subscription and payment records (plan type, payment dates, M-Pesa transaction references)
- Safaricom Daraja API credentials you provide for M-Pesa integration (stored AES-256 encrypted at rest)
3.2 Staff data (entered by the tenant):
- Staff names, email addresses, phone numbers, and roles
- Commission rates and service logs attributed to each staff member
- Work schedules
3.3 Client/customer data (entered by the tenant for their clients):
- Customer name (optional, encrypted at rest using AES-256-GCM)
- M-Pesa phone number (encrypted at rest; used solely to initiate STK Push at the tenant's direction)
- Service or goods purchased, amounts charged, and payment status
3.4 Technical data (collected automatically):
- IP addresses and server access logs (retained for up to 90 days for security purposes)
- Session identifiers and cookies necessary for login
- Application error logs (do not contain customer PII)
4. Legal Basis for Processing
We process personal data on the following bases under the Data Protection Act, 2019:
| Processing activity | Legal basis (DPA 2019, Section 30) |
|---|---|
| Creating and managing your account | Performance of a contract (s.30(1)(b)) |
| Processing subscription payments | Performance of a contract (s.30(1)(b)) |
| M-Pesa STK Push to client phones | Legitimate interest of the tenant; consent given by the client to the tenant at point of service (s.30(1)(a) & (f)) |
| Service and sales records | Performance of a contract; legitimate interest in business record-keeping (s.30(1)(b) & (f)) |
| Security logging and fraud prevention | Legitimate interests (s.30(1)(f)) |
| Compliance with Kenyan tax and accounting law | Legal obligation (s.30(1)(c)) |
5. How We Use Personal Data
- To provide, operate, and improve the WakLog platform.
- To process subscription payments and send billing communications.
- To facilitate M-Pesa STK Push payments on behalf of tenants.
- To generate financial reports and analytics for tenant use.
- To respond to support requests and investigate issues.
- To detect, prevent, and investigate fraud, abuse, or security incidents.
- To comply with legal and regulatory obligations.
We do not sell personal data to third parties. We do not use customer data for advertising or profiling beyond the operational purposes above.
6. Data Processors and Third-Party Sharing
We share personal data with the following categories of third-party processors under data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| DigitalOcean LLC | Cloud hosting and infrastructure (UAT and production servers) | Netherlands / USA |
| Amazon Web Services (AWS S3) | Storage of tenant logo images | USA (us-east-1) |
| PotePay (Sisimizi payment gateway) | Processing M-Pesa STK Push and card payments | Kenya |
| Safaricom PLC (M-Pesa Daraja API) | Initiating M-Pesa payment prompts to clients | Kenya |
We may disclose personal data to law enforcement or regulatory bodies (including the ODPC) where required by Kenyan law.
7. Cross-Border Data Transfers
Some of our third-party processors operate outside Kenya (DigitalOcean, AWS). Where personal data is transferred outside Kenya we ensure appropriate safeguards are in place — including standard contractual clauses or adequacy determinations — in compliance with Section 49 of the Data Protection Act, 2019.
8. Data Security
We implement technical and organisational measures to protect personal data, including:
- AES-256-GCM encryption at rest for all personal identifiers (names, emails, phone numbers, M-Pesa credentials).
- HMAC blind-index technique for email uniqueness checks without storing plaintext emails in searchable form.
- Schema-level data isolation — each tenant's data is stored in a separate PostgreSQL schema, preventing cross-tenant access.
- HTTPS/TLS for all data in transit.
- Role-based access controls within each tenant workspace.
- Regular security reviews and dependency updates.
No system is perfectly secure. In the event of a personal data breach we will notify the ODPC within 72 hours and affected data subjects without undue delay, in accordance with Section 43 of the Data Protection Act, 2019.
9. Data Retention
| Data type | Retention period |
|---|---|
| Tenant account and staff data | Duration of active subscription + 7 years (Kenyan accounting legislation) |
| Customer names and phone numbers | Same as above; deleted on tenant account closure after 30-day export window |
| Payment transaction records | 7 years from transaction date (tax compliance) |
| Application security logs | 90 days |
| Backup snapshots | 30 days rolling |
10. Your Rights as a Data Subject
Under the Data Protection Act, 2019 (Sections 26–34) you have the following rights regarding your personal data:
- Right of access — to obtain a copy of personal data we hold about you.
- Right to rectification — to correct inaccurate or incomplete data.
- Right to erasure — to request deletion of your data where there is no overriding legal basis for retention.
- Right to restriction of processing — to limit how we use your data in certain circumstances.
- Right to data portability — to receive your data in a machine-readable format.
- Right to object — to object to processing based on legitimate interests.
- Right not to be subject to automated decision-making — WakLog does not make automated decisions with legal or significant effects on individuals.
To exercise any of these rights, contact us at privacy@sisimizi.co.ke. We will respond within 21 days as required by the Data Protection (General) Regulations, 2021.
If you believe your rights have been violated you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
11. Cookies
WakLog uses only technically necessary cookies:
- Session cookie — maintains your login session. Expires when you close your browser or after 30 days if "remember me" is selected.
- CSRF token cookie — prevents cross-site request forgery attacks.
- Tenant cookie — remembers which workspace you last accessed.
We do not use analytics, advertising, or third-party tracking cookies.
12. Children's Privacy
WakLog is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.
13. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated by email and via an in-app notice at least 14 days before they take effect. The effective date at the top of this page will always reflect the latest version.
14. Contact and Complaints
For any privacy-related queries or to exercise your data subject rights:
Sisimizi Technologies — Data Protection Contact
Email: privacy@sisimizi.co.ke
To escalate to the regulator:
Office of the Data Protection Commissioner (ODPC)
Website: www.odpc.go.ke
Email: info@odpc.go.ke