How we handle your data

DIGIPOINT ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our point-of-sale platform, website, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service. We'll keep this policy updated - check the "last updated" date at the top of this page.

2.1 Personal information

When you register for an account, we collect:

• Business name
• Admin/owner full name
• Email address
• Phone number
• Account password (stored in encrypted form using PBKDF2)

2.2 Business data

As you use the Service, we collect and store:

• Product inventory and pricing data
• Sales transaction records and payment methods
• Customer purchase history (anonymised references only)
• Expense and financial records you enter
• Staff/employee information you register
• Receipt and invoice data

2.3 Technical data

We automatically collect certain information when you visit our website or use the Service:

• IP address and browser/user-agent string
• Device type and operating system
• Pages visited and features used
• Session duration and interaction patterns
• Performance and error logs

2.4 Cookies and tracking

We use cookies and similar tracking technologies to operate and improve the Service. See Section 8 for details.

We use the collected information for the following purposes:

• To provide, maintain, and improve the Service
• To process transactions and generate receipts
• To authenticate users and secure accounts
• To communicate with you about your account, billing, and support
• To detect, prevent, and address technical issues and fraud
• To comply with legal obligations, including tax and regulatory requirements
• To aggregate anonymised analytics for product improvement

We do not sell your personal information. We may share your data only in the following circumstances:

• Service providers: With third-party vendors who help us operate the Service (e.g., cloud hosting, SMS delivery, payment processing). These providers are contractually bound to protect your data.
• Legal requirements: If required by law, court order, or governmental regulation, we may disclose your information.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.
• Consent: With your explicit consent for any other purpose.

We retain your personal information and business data for as long as your account is active or as needed to provide the Service. After account deletion, we retain anonymised transaction records for tax and legal compliance for the period required by Kenyan law (typically 7 years). You may request deletion of your data by contacting us.

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit: All traffic is served over TLS/SSL (HTTPS)
• Encryption at rest: Sensitive credentials are encrypted using AES-256 via Fernet
• Password hashing: Passwords are hashed using Django's PBKDF2 algorithm
• Regular backups: Automated daily backups with point-in-time recovery
• Access controls: Role-based permissions and strict authentication requirements
• Tenant isolation: Row-level security ensures data is strictly partitioned between tenants

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Under Kenyan data protection law (Data Protection Act, 2019), you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your data, subject to legal retention requirements.
• Restriction: Request restriction of processing in certain circumstances.
• Portability: Request transfer of your data to another service provider.
• Objection: Object to processing of your data for certain purposes.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Our website uses cookies and similar technologies to enhance your experience. We use:

• Essential cookies: Required for the Service to function (session management, authentication, security). These cannot be disabled.
• Functional cookies: Remember your preferences and settings.
• Analytics cookies: Help us understand how you use the Service so we can improve it.

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

The Service integrates with the following third-party services:

• Safaricom Daraja API: For M-Pesa STK push payment processing
• Paystack: For card and mobile money payment processing, including subscription billing
• SMS providers: For sending transaction notifications and OTP codes
• Cloud hosting: For infrastructure and data storage

Each third party has its own privacy policy governing the use of your data. We recommend reviewing their policies.

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a child has provided us with personal data, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: [email protected]
Phone: +254 741 784 011
Address: Kakamega, Kenya