Privacy Policy

This Privacy Policy explains how Samba360 ("we") collects and processes personal data in line with the Kenya Data Protection Act, 2019. It covers our website and the Samba360 platform (the "Service").

1. Who we are

We are the data controller for the account and billing data of the businesses that subscribe to the Service. For the customer and staff data you enter into your workspace, your business is the data controller and we act as a data processor on your instructions.

2. Data we collect

• Account data: your name, work email, business name, business type and password (stored hashed).
• Billing data: plan, invoices, payment references and M-Pesa receipt details. We do not store your M-Pesa PIN or full card numbers.
• Usage data: log data such as IP address, device/browser, and actions taken in the Service, used for security and support.
• Business content: the products, sales, customers, suppliers and records you enter, which may include personal data of your customers or staff.

3. How we use it

• To provide, secure and support the Service and your workspace.
• To bill you, issue invoices and process M-Pesa payments.
• To send service messages, receipts and important account notices.
• To comply with legal obligations and prevent fraud or abuse.

4. Lawful basis

We process account and billing data to perform our contract with you, usage data on the basis of our legitimate interests in security and reliability, and other data to comply with the law or with your consent where required.

5. Sharing

We share data only as needed to run the Service, including with:

• payment providers and Safaricom/M-Pesa for processing payments;
• hosting, email and infrastructure providers who store data on our behalf;
• professional advisers or authorities where the law requires it.

We do not sell your personal data.

6. Data location and retention

Data is hosted on servers we control or that our providers operate. We keep personal data for as long as your account is active, and afterwards only as long as needed for legal, tax and accounting purposes, after which it is deleted or anonymised.

7. Security

We use access controls, tenant isolation, encrypted connections and backups to protect data. No system is perfectly secure; please keep your credentials safe and tell us promptly about any suspected breach.

8. Your rights

Under the Data Protection Act you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and request portability. To exercise a right, contact us. If you are our customer's end customer or employee, please contact that business first, as they control that data.

9. Cookies

Our website uses only the cookies needed to operate and secure the Service, such as session and security tokens. We do not use them to sell your data.

10. Complaints

You may complain to the Office of the Data Protection Commissioner (ODPC) in Kenya if you are unhappy with how we handle your data. We would appreciate the chance to resolve it with you first.

11. Changes and contact

We may update this policy and will post the new date above. Questions or requests: .