Kenya Data Protection Act 2019 Compliant

Privacy Policy

Last Updated: November 2024 • Effective Date: January 1, 2024

1. Introduction & Scope

Hillgan Innovations Ltd ("Hillgan", "we", "us", or "our") is committed to protecting your personal data and respecting your privacy rights. This Privacy Policy details how we collect, store, process, transfer, and safeguard personal data when you visit our website, communicate with us, or utilize our suite of business software platforms, including KaziDesk, KaziPOS, KaziAfya, KaziMatatu, KaziElimu, and KaziCom (collectively, the "Services").

Our data protection practices strictly adhere to the Data Protection Act, No. 24 of 2019 (Laws of Kenya), the regulations promulgated by the Office of the Data Protection Commissioner (ODPC), and international best practices including ISO/IEC 27001 guidelines.

2. Categories of Data We Collect

Depending on how you interact with our Services, we may collect the following categories of personal information:

  • Direct Identity & Contact Information: Full name, corporate email address, telephone and mobile money (M-Pesa) number, physical office address, job title, and organization name.
  • Account & Security Credentials: Passwords, role-based authorization tokens, single-sign-on (SSO) identifiers, and multi-factor authentication metadata.
  • Transactional & Financial Information: M-Pesa transaction reference codes, bank transfer metadata, billing address, and subscription service records. Note: We do not store raw payment card CVV numbers.
  • Technical & Telemetry Data: IP addresses, browser types, operating systems, session timestamps, device identifiers, and aggregated platform performance diagnostics.
  • Customer-Managed Content: Data uploaded or processed by organizational users within our platforms (e.g., patient EHR records within KaziAfya, student grades within KaziElimu, fleet vehicle registrations in KaziMatatu). For this customer data, Hillgan operates primarily as a Data Processor under contract with our enterprise clients.

3. Legal Bases for Processing

We only collect and process personal data where we have a lawful basis under Section 30 of the Kenya Data Protection Act 2019, including:

  • Contractual Performance: To provision our software platforms, deliver support, and execute subscription service level agreements (SLAs).
  • Consent: Where you have explicitly opted into newsletters, demonstration requests, or recruitment applications.
  • Legal & Statutory Compliance: To comply with tax obligations (KRA eTIMS), statutory labor requirements, and lawful court orders.
  • Legitimate Interests: To detect security threats, prevent fraudulent transactions, and ensure platform availability.

4. Data Sharing & Third-Party Disclosures

We do not sell, rent, or trade your personal information to third parties. We may share necessary data strictly with certified sub-processors required to operate the Services:

  • Telecommunications & Payment Gateways: Safaricom PLC for M-Pesa transactions and SMS delivery.
  • Cloud Hosting & Infrastructure: Microsoft Azure, Amazon Web Services (AWS), and Google Cloud for encrypted storage and compute workloads.
  • Security & PKI Providers: Sectigo for SSL/TLS certificates and cryptographic integrity.
  • Legal Authorities: Regulatory bodies where mandated by Kenyan statute or formal court order.

5. Data Security & Encryption Standards

We maintain rigorous technical, physical, and administrative safeguards designed to protect personal data against unauthorized access, destruction, loss, or alteration:

Cryptographic Protection & Access Controls
  • All network communication is encrypted using modern TLS 1.3 protocol.
  • Databases and backups are encrypted at rest using AES-256 bit keys.
  • Access to production infrastructure is restricted via zero-trust architecture, multi-factor authentication, and audited VPN bastions.
  • Automated vulnerability scans and periodic penetration testing are conducted on all public endpoints.

6. Your Statutory Rights

Under Part IV of the Kenya Data Protection Act 2019, you hold the following rights regarding your personal information:

  • Right to be Informed: To understand how your personal data is collected and processed.
  • Right of Access: To request a copy of the personal data held about you.
  • Right to Rectification: To correct inaccurate, outdated, or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): To request deletion of data no longer required for legitimate or statutory purposes.
  • Right to Object: To object to processing for direct marketing or automated profiling.
  • Right to Data Portability: To receive your personal data in a structured, commonly used machine-readable format.

To exercise any of these statutory rights, please submit a written request to our Data Protection Officer at dpo@hillganinnovations.co.ke.

7. Data Retention & Cross-Border Transfers

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, or to comply with statutory accounting and regulatory audit requirements (typically up to 7 years under Kenyan fiscal regulations).

Where data is transferred across borders (for example, cloud compute nodes outside Kenya), transfers are executed in strict accordance with Section 48 of the Act, requiring adequate data protection safeguards or certified contractual clauses.

8. Contact Our Data Protection Officer (DPO)

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our team:

Hillgan Innovations Ltd - Data Protection Office
Jimkan House, Westlands, P.O. Box Nairobi, Kenya
Email: dpo@hillganinnovations.co.ke / info@hillganinnovations.co.ke