Who is responsible
CitaTech decides how your account data is used and is its data controller [ODPC registration details to be confirmed].
When a business uses CitaPay to take payments from its customers, that business decides why it collects its customers' data, and we process that data on its behalf.
What we collect
Account details: your name, email, phone number and password (stored only in a form we cannot read back), and passkeys if you add them.
Verification details: identity and business documents, KRA PIN and similar details needed for know-your-customer checks.
Payment details: the payments, refunds, payouts and wallet movements on your account, including the phone numbers and names of the people who pay or are paid.
Usage details: the device and browser you use, your IP address, and how you use the app, to keep it secure and working.
What you tell us: messages to support, and questions you ask the in-app assistant.
Why we use it
To provide CitaPay: run your account, move money and show your history (performing our contract with you).
To meet legal duties: identity checks, anti-money-laundering and fraud controls, tax and record keeping.
To keep CitaPay secure: detect fraud and abuse and protect accounts (our legitimate interests).
To improve CitaPay and tell you about changes to it. You can turn off optional emails and notifications in Settings.
Data outside Kenya
Some of our service providers store or process data outside Kenya. Where they do, we use safeguards the Data Protection Act requires [transfer basis to be confirmed by legal review].
How long we keep it
We keep account and payment records for as long as your account is open and afterwards for as long as the law requires for financial and tax records [retention periods to be confirmed by legal review]. Other data is deleted or anonymised when no longer needed.
Your rights
Be told how your data is used, and get a copy of it.
Have wrong data corrected, and ask for data to be deleted where we are not required to keep it.
Object to or restrict some uses of your data, and withdraw consent you have given.
To use these rights, email support@citatech.cloud. If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner.
Keeping it safe
We protect data with encryption in transit, access controls, passkey sign-in and monitoring. If a breach affects you, we will tell you and the Data Protection Commissioner as the law requires.
Changes to this policy
We will tell you about material changes before they take effect. Questions about privacy: support@citatech.cloud.