Privacy Policy

This Privacy Policy explains how KopaAlert ("we", "us") collects, uses, and protects information when organisations ("you", "the business") use the Service. This includes shops and other businesses, SACCOs, chamas, and schools. It also covers information that organisations enter about the people they serve: customers who owe them money ("debtors"), SACCO and chama members, and school students and their parents or guardians.

We handle personal data in line with the Kenya Data Protection Act, 2019 and its regulations.

• For business account and billing data, KopaAlert is the data controller: we decide how that data is used.
• For the people an organisation enters (customers, members, students, parents/guardians), the organisation is the data controller and KopaAlert is its data processor. We process that data only to provide the Service on the organisation's instructions. The organisation is responsible for having a lawful reason to collect it, telling those people how it is used, and getting consent where the law requires it.

• Business account information: business name, owner and staff names, phone numbers, email addresses, and login credentials.
• Customer (debtor) information: names, phone numbers, debt amounts, due dates, payment history, and credit ratings.
• SACCO and chama member information: names, member numbers, phone numbers, groups, contributions, loans (amounts, interest, instalments, penalties), and repayment history.
• School student information: student names, registration numbers, class and stream, day or boarding status, fee charges and payments, and a parent or guardian's phone number.
• Billing information: subscription tier, price, payment records (amount, method, reference), recorded by KopaAlert administration.
• Usage and audit data: login activity and administrative actions taken within the platform, for security and support purposes.

• To operate the Service: managing accounts, customers, members, students, debts, loans, fees, and payments.
• To send SMS and email reminders on an organisation's behalf to the phone numbers/emails the organisation provides.
• To bill businesses for paid subscriptions and send invoices/receipts.
• To communicate with businesses about their account, approvals, or support requests.
• To maintain security, prevent fraud, and enforce our Terms of Service.

We do not use anyone's data for advertising, and we do not send them marketing messages.

For businesses that lend to customers, KopaAlert works out a credit rating from the customer's repayment history with that business. It can also mark a customer as blacklisted automatically when a debt is more than 10 days overdue. These ratings are only visible within that one business. They are not shared with other businesses or with credit reference bureaus. Students are never rated or blacklisted.

A rating is a guide for the business, which makes the final decision. A business can review a customer's record and take them off the blacklist at any time. If you think a rating about you is wrong, ask the business to review it. You can also ask us to help.

We share information only as needed to operate the Service:

• Africa's Talking - our SMS gateway provider, to deliver reminder messages.
• Resend - our email provider, to deliver account and billing emails.
• Supabase - our database and authentication infrastructure provider, which stores platform data securely.
• The organisation's own systems - when an organisation sets up exports, the API, or webhooks, data goes to the destination it chooses. That organisation is responsible for it from there.

We do not sell anyone's data to third parties. We disclose data to authorities only when the law requires it.

Some of our providers store or process data on servers outside Kenya. We use only established providers that protect data with encryption and access controls, and we share with them only what they need to provide their service.

KopaAlert uses cookies required to keep you signed in and to operate the platform securely. We do not currently use cookies for advertising or third-party tracking.

We retain account, customer, member, and student data for as long as a business account is active. If a business account is permanently deleted (by request or by KopaAlert administration), associated customer, member, student, debt, payment, and notification records are deleted along with it. Organisations can also delete individual records themselves.

Under the Data Protection Act, 2019, you have the right to:

• be told how your personal data is used;
• get a copy of your personal data;
• have wrong or misleading data corrected;
• have data deleted when there is no longer a lawful reason to keep it;
• object to your data being processed;
• receive your data in a format you can move elsewhere;
• not be subject to a decision made only by automated means that significantly affects you.

Businesses can make these requests by contacting support. If an organisation entered your information as its customer, member, student, or parent/guardian, contact that organisation first, because it controls that data. We will help it respond. If you can't reach the organisation, contact us and we will pass your request on.

If you are not satisfied with how your data has been handled, you can complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

We use industry-standard measures (encrypted connections, access controls, and role-based permissions) to protect data. No system is completely secure, and we encourage businesses to keep login credentials confidential.

If a data breach puts people at real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it. We will also notify the affected organisations so they can inform the people concerned, as the law requires.

KopaAlert accounts are for adults running organisations. Children do not sign in or use the Service.

Schools using KopaAlert enter information about their students, who are usually children. Each school is responsible for processing that data in the child's best interests and with the consent of a parent or guardian, as section 33 of the Data Protection Act requires. We use student data only to provide the Service to the school: tracking fees, and sending fee and term reminders to the parent or guardian's phone number. Reminders are never sent to students. Student data is never used for credit ratings, blacklisting, or marketing.

We may update this Privacy Policy from time to time. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions about this Privacy Policy or a data request? Contact us at solutiontechcampany@gmail.com or +254740305253.