1. Introduction
ArosaPay Ltd ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
2. Information We Collect
Personal Information
- Full name
- Email address
- Phone number
- National ID or passport number (for KYC)
- Physical address
- Payment information (M-Pesa number, bank details)
Transaction Information
- Transaction history
- Items bought or sold
- Communication between parties
- Dispute records
Technical Information
- IP address
- Device type and browser
- Usage patterns and preferences
- Cookies and similar technologies
3. How We Use Your Information
We use collected information to:
- Provide and maintain the Service
- Process transactions and payments
- Verify your identity (KYC requirements)
- Communicate with you about transactions
- Send service updates and notifications
- Resolve disputes between users
- Prevent fraud and enforce our Terms
- Comply with legal obligations
- Improve our services
4. Information Sharing
We may share your information with:
- Transaction Partners: Limited information shared between buyers and sellers to complete transactions
- Payment Processors: Flutterwave, M-Pesa for payment processing
- Identity Verification: Third-party KYC providers
- Legal Authorities: When required by law or to prevent fraud
- Service Providers: Who assist in operating our platform
We do NOT sell your personal information to third parties.
5. Data Security
We implement security measures including:
- 256-bit SSL encryption for data transmission
- Encrypted storage of sensitive information
- Regular security audits and penetration testing
- Access controls and authentication requirements
- Secure data centers with physical security
6. Data Retention
- Account information: Retained while account is active plus 7 years
- Transaction records: Retained for 7 years per regulatory requirements
- Communication records: Retained for 3 years
- KYC documents: Retained as required by CBK regulations
7. Your Rights
You have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your data (subject to legal retention requirements)
- Object to certain processing activities
- Export your data in a portable format
- Withdraw consent where processing is based on consent
To exercise these rights, contact privacy@arosapay.com.
9. Third-Party Links
Our platform may contain links to third-party websites. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.
10. Children's Privacy
Our Service is not intended for users under 18. We do not knowingly collect information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information.
11. International Transfers
Your information may be transferred to and processed in countries other than Kenya. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses and data protection agreements.
12. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or platform notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
For privacy-related questions:
Email: privacy@arosapay.com
Data Protection Officer: dpo@arosapay.com