1. Who we are

CMIS (“we”, “us”) operates from Deloitte Place, Waiyaki Way, Westlands, Nairobi, Kenya. This policy applies to our apps and web apps and explains how we handle personal data as a data controller under Kenya’s Data Protection Act, 2019. Where we process data on behalf of a business customer, that customer is the data controller and we act as their processor.

2. Data we collect

• Account data: name, email, phone number and password you provide when you register.
• Content you enter: information, records and files you create or upload while using the app.
• Communication data: messages, support requests, and SMS or email we send at your instruction.
• Payment data: M-Pesa, card or bank transaction references used to process purchases and subscriptions. Full card numbers are handled by our payment providers, not stored by us.
• Device & usage data: IP address, device and browser type, operating system, app version, unique identifiers, crash logs, and the pages or features you use.
• Location: approximate location from your IP, or precise location only if a feature needs it and you grant permission.

3. How we use data

• Provide, maintain and secure the app and web app.
• Authenticate you and manage your account.
• Process payments and send transactional messages (receipts, reminders, alerts).
• Respond to support requests.
• Detect and prevent fraud, abuse and security incidents.
• Analyse usage to fix bugs and improve features.
• Send product or marketing updates where you have opted in, and meet legal obligations.

We do not sell personal data or use your content for advertising.

4. Legal basis

We rely on one or more of the following under the Data Protection Act, 2019: performance of our contract with you, your consent, our legitimate interests in running and improving the service, and compliance with the law.

5. Sharing

We share data only as needed, under contract, with:

• Cloud hosting, storage and backup providers.
• SMS and email delivery gateways.
• Payment processors, including Safaricom M-Pesa, card processors and banks.
• Analytics and crash-reporting tools.
• Professional advisers, and regulators or law enforcement where legally required.
• A successor entity in the event of a merger, acquisition or sale of assets.

6. Storage and cross-border transfer

Data is stored on secured servers with encrypted transmission (HTTPS), access controls and regular backups. Some providers may process data outside Kenya; where that happens we rely on safeguards permitted under the Data Protection Act, 2019.

7. Retention

We keep personal data for as long as your account is active, and for up to 90 days after closure to allow export and handle disputes, after which we delete or anonymise it unless a longer period is required by law. Backups age out on a rolling schedule.

8. Your rights

Under the Data Protection Act, 2019 you may request access to your personal data, ask us to correct or delete it, object to or restrict certain processing, request a copy in a portable format, or withdraw consent at any time. Contact us at info@cmis.ke. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

9. Children

Our apps are not directed at children under 18, and we do not knowingly collect their data without verified parental or guardian consent. If you believe a child has provided us data, contact us and we will remove it.

10. Cookies and similar technologies

Our web apps use essential cookies to keep you signed in and remember preferences, plus basic analytics to understand usage. Our mobile apps use similar local storage and device identifiers. You can control cookies in your browser settings.

11. Changes

We may update this policy as our apps or the law change. Material changes will be notified in the app or by email. Continued use after the effective date means you accept the updated policy.

12. Contact

Questions or data requests: info@cmis.ke  ·  Deloitte Place, Waiyaki Way, Westlands, Nairobi, Kenya