Privacy Policy

This Privacy Policy explains how Imaripay Limited (“Imaripay”, “we”) collects, uses, shares and protects personal data when you visit our website, use our dashboard or API, or pay or are paid by a business that uses Imaripay. We process personal data in accordance with the Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021 of Kenya.

1. Who we are

Imaripay Limited is incorporated in Kenya with its principal office in Nairobi, Kenya. We register with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor as the Act requires, before processing personal data in production. You can reach our Data Protection Officer at compliance@imaripay.com.

2. Our role

• Merchants and their team members: we are the data controller for data about you and your business.
• Customers paying or receiving funds from a merchant: we act as a data processor on behalf of the merchant for completing the Transaction, and as an independent data controller where we process data to meet our own legal obligations (for example, anti-money laundering, fraud prevention and record keeping).

3. Personal data we collect

We do not store full card numbers or security codes; card data is collected directly by PCI-DSS certified card processors. We do not intentionally collect sensitive personal data as defined in the Act, except where required for identity verification or to comply with law.

4. How we use personal data and our lawful bases

• To provide the Services — processing payments and payouts, routing Transactions, sending receipts and notifications (performance of a contract).
• To meet legal obligations — KYC, customer due diligence, sanctions screening, transaction monitoring, suspicious transaction reporting, tax and record keeping under the Proceeds of Crime and Anti-Money Laundering Act, 2009 and related laws (legal obligation).
• To prevent fraud and secure our platform — risk scoring, detecting unauthorised access, enforcing limits (legitimate interests and legal obligation).
• To improve and support the Services — analytics, troubleshooting and customer support (legitimate interests).
• Marketing — sending product updates to business contacts. We will only send direct marketing in accordance with section 37 of the Act, and you can opt out at any time (consent or legitimate interests, as applicable).

5. Sharing personal data

We share personal data only as necessary, with:

• Partner Institutions such as banks, mobile network operators, card processors and payment service providers that execute Transactions;
• the merchant you are paying or being paid by;
• identity verification, sanctions screening and fraud prevention providers;
• cloud hosting, email and infrastructure providers acting on our instructions under written data processing agreements;
• regulators, law enforcement and government bodies, including the Central Bank of Kenya, the Financial Reporting Centre and the Kenya Revenue Authority, where required by law;
• professional advisers and, in the event of a merger or acquisition, a prospective successor bound by confidentiality.

We do not sell personal data.

6. International transfers

Some of our service providers are located outside Kenya. Where we transfer personal data outside Kenya, we do so only in accordance with sections 48 to 50 of the Act — where there are appropriate safeguards, an adequacy determination, or another lawful basis — and we take steps to ensure your data receives an equivalent level of protection.

7. Retention

We keep personal data only for as long as needed for the purposes described above. Transaction and customer due diligence records are retained for at least seven (7) years after the end of the business relationship or the date of the Transaction, as required by anti-money laundering law. Marketing data is retained until you opt out. After the retention period, data is securely deleted or anonymised.

8. Security

We implement appropriate technical and organisational measures including encryption in transit and at rest, access controls, two-factor authentication, audit logging and regular security reviews. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commissioner within 72 hours and notify affected individuals as required by section 43 of the Act.

9. Your rights

Under section 26 of the Act, you have the right to:

• be informed of the use to which your personal data is to be put;
• access your personal data in our custody;
• object to the processing of all or part of your personal data;
• correction of false or misleading data, and deletion of false, misleading or unlawfully processed data;
• data portability, where applicable; and
• not be subject to a decision based solely on automated processing that significantly affects you, subject to the exceptions in the Act.

To exercise these rights, email compliance@imaripay.com. We will respond within the timelines set by the Act. Some rights are limited where we must retain data to comply with law. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke).

10. Children

The Services are not directed to children under 18, and we do not knowingly collect their personal data other than incidentally as part of a Transaction.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in the dashboard before they take effect.