This policy explains how iTach Technologies ("we") processes personal data through iTach BizPOS, in line with the Data Protection Act, 2019 of Kenya and guidance from the Office of the Data Protection Commissioner (ODPC).

1. Our roles

For account holders (business owners and their staff) we are the data controller. For records that a subscribing business keeps about its own customers and suppliers, the business is the data controller and we act as its data processor, processing that data only on its instructions to provide the service.

2. Data we collect

Account data: names, phone numbers, e-mail addresses, business details, KRA PIN.
Usage and security data: login times, IP addresses, audit logs of actions in the system.
Business records entered by subscribers: products, sales, customers, suppliers, payments and related details.
Payment confirmation messages forwarded by a subscriber for reconciliation.

3. Why we use it

To provide, secure and support the service;
To bill subscriptions and send service messages;
To meet legal, tax and audit obligations.

We do not sell personal data and we do not use subscribers' business records for advertising.

4. Security

Data is transmitted over HTTPS, each business's data is logically separated, passwords are hashed, privileged actions are logged and backups are taken regularly. Support staff access a business account only when requested, for a limited time, and the access is recorded and notified to the owner.

5. Retention

We keep account and business data for as long as the subscription is active and for a reasonable period afterwards as agreed or as required by law. Data is not deleted merely because a subscription lapses; owners can export their data at any time and may request deletion subject to legal retention duties.

6. Your rights

You have the right to be informed, to access, to correct, to object, to data portability and to request deletion of your personal data, and to lodge a complaint with the ODPC. Contact us using the details on our Contact page.

7. Third parties & transfers

We use carefully selected providers for hosting, e-mail and SMS delivery. Where data is processed outside Kenya, we take the safeguards required by the Act.

8. Changes

We will post updates to this page and notify account holders of material changes.

Privacy Policy