Privacy notice

The data controller is Shebbytech Applications & Co. Ltd (registration no. PVT-7LU5K56B), a Sebbynexa Technologies Group company, of Milele Centre, 3rd Floor, Room 1014/47, Namanga Road, Kitengela, Kajiado County, Kenya (P.O. Box 561-00204, Nairobi). We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller under registration number [ODPC certificate no.].

Data Protection Officer: [name], dpo@shebbytechapplications.co.ke.

When we install or manage ZKTeco biometric devices for an organisation, that organisation is the controller of its staff's attendance and biometric data and we act as its data processor under a written data-processing agreement.

• Account data: name, email, mobile number, password (stored only as a one-way hash), account type, organisation details.
• Tax identifiers: KRA PIN where you provide it for tax services or invoicing.
• Booking data: the package, time, questionnaire answers, documents you upload and messages with your consultant. Depending on the service, documents may contain financial records and information about third parties.
• Payment data: amount, M-Pesa receipt or Pesapal confirmation code and the paying phone number. Card numbers and M-Pesa PINs are handled by Safaricom or Pesapal and never reach us.
• Live chat, enquiries and newsletter: your name, e-mail, optional phone number, messages and the page you were on; for the newsletter, your e-mail, language and the time you gave consent. We store a scrambled (hashed) form of your IP address to prevent abuse.
• Technical data: IP address, browser type, and security logs of sign-ins and administrative actions.

• To provide the service you asked for — accounts, orders, bookings, consultations and support (performance of a contract).
• To meet legal obligations — tax invoicing and record-keeping, anti-fraud and responding to lawful requests.
• To keep the platform secure — fraud prevention, access logging and incident investigation (legitimate interests).
• To send marketing — only if you opt in; you can withdraw at any time from your account, or by replying “unsubscribe” to any marketing e-mail.

We do not sell personal data and do not use it for automated decisions that have legal or similarly significant effects on you.

• Zoho Corporation (Zoho Books) — invoices, payments and customer contact details for our accounting.
• Safaricom PLC (M-Pesa) and Pesapal — to process your payment.
• hosting.com (A2 Hosting LLC) — hosts our website, database and e-mail in its London, United Kingdom data centre.
• Professional advisers, auditors and authorities such as the Kenya Revenue Authority, where the law requires.

Each service provider processes data only on our instructions and under contractual confidentiality and security obligations.

Our website, database and e-mail are hosted in the United Kingdom (London). Some other providers may also store data outside Kenya. Zoho Books stores data in the data centre selected for our account ([Zoho data centre, e.g. EU]). Where data leaves Kenya we rely on the safeguards allowed by sections 48–50 of the Data Protection Act, 2019 — including contractual protections and providers' security certifications — and we tell you where consent is required.

• Account data: while your account is open. If you delete your account, it is erased or anonymised within 14 days.
• Invoices, payments and related records: five years from the end of the relevant reporting period, as required by the Tax Procedures Act, 2015, or longer if a tax dispute is open.
• Consultancy files: [retention period, e.g. 7 years] after the engagement ends, to meet professional obligations, then securely destroyed.
• Security logs: [12 months].
• Live chats: 12 months after the chat is closed. Website enquiries: 24 months after they are closed. Newsletter: until you unsubscribe; unconfirmed sign-ups are deleted after 30 days.

• All traffic to our site is encrypted with TLS (HTTPS).
• KRA PINs, payment phone numbers, authenticator secrets, accounting-system tokens and every document you upload are encrypted at rest with AES-256-GCM. Passwords are stored only as bcrypt hashes.
• Staff access is limited by role, protected by two-factor authentication for administrators and finance, and every privileged action is written to a tamper-evident audit log.
• Consultancy documents are available only to you and the staff working on your booking, and only after the consultation fee is paid.
• If a personal-data breach creates a real risk of harm, we will notify the Data Protection Commissioner within 72 hours and inform affected people without undue delay, as the Act requires.

Under the Data Protection Act, 2019 you can: be informed of how your data is used; access your data; object to processing; correct inaccurate data; have data deleted; restrict processing; and receive your data in a portable format. You can do most of this yourself in Profile & privacy — download your data, correct your details, withdraw marketing consent or delete your account. For anything else, submit a request there or email the DPO. We respond within the time limits in the Data Protection (General) Regulations, 2021.

We use one strictly necessary cookie to keep you signed in securely (an HTTP-only, secure cookie) and store your light/dark theme choice in your browser. We do not use advertising or third-party tracking cookies. If we ever add analytics, we will ask for your consent first.

Questions or requests: dpo@shebbytechapplications.co.ke. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner, www.odpc.go.ke.

This service is not directed at children under 18.