Privacy Policy

This document has not been formally versioned yet.

1. About this policy

This Privacy Policy explains how Eleso Solutions ("ifinsta", "we", "us") handles personal data in connection with the ifinsta platform. It covers our websites, web application, mobile and desktop applications, and APIs.

2. Two different roles, and why it matters

We handle personal data in two distinct capacities, and your rights differ depending on which applies.

As a controller, for data about the people who hold ifinsta accounts — merchants, directors, staff and visitors to our sites. We decide why and how that data is processed, and this policy governs it.
As a processor, for data a merchant puts into the platform about their own customers, suppliers and employees. The merchant decides why and how; we act on their instructions under our Data Processing Agreement.

If you are a customer of a business that uses ifinsta and you want to exercise rights over your data, contact that business first. We will support them in answering you, but we cannot act on their data without their instruction.

3. What we collect

We classify personal data into the following categories:

Identity data — name, date of birth, national identification, passport, driving licence or alien identification number and the document type, and the results of identity checks.
Contact data — email address, telephone number, postal and business address.
Business and professional data — business name, registration number and date, entity type, tax identifier, business category, role, directorship and signing authority.
Financial data — subscription and billing records, payment method references, transaction and settlement records, and the payment provider credentials you configure.
Behavioural and technical data — device and browser information, IP address, session records, feature usage, diagnostic logs and error reports.
Communication data — messages, support tickets, and the content of prompts and responses in AI-assisted features.
Location data — approximate location derived from IP address, and store or device location where you configure it.
Administrative data — consent and acceptance records, audit trails of actions taken on an account, and correspondence with us.

Where an identity verification provider returns a biometric result — for example a facial match against an identity document — we record the outcome of that check and do not retain the biometric template ourselves.

4. Where it comes from

Directly from you, when you register, configure your business, contact us, or use the platform.
From the business you work for, when it invites you to its ifinsta account.
Automatically, from your use of the platform and from your device.
From identity verification providers, registries and revenue authorities we use to confirm the details you give us.
From payment providers, in the records they return about payments initiated through the platform.

5. Why we process it, and our lawful basis

To provide the platform, open and operate your account and deliver the features you use — performance of a contract.
To verify identity, screen for fraud and meet know-your-customer and anti-money-laundering duties — legal obligation, and our legitimate interest in a trustworthy platform.
To take payment for subscriptions and to recover sums due — performance of a contract, and legitimate interest.
To secure the platform, investigate incidents, and keep audit trails — legitimate interest in security, and legal obligation.
To support you and answer your questions — performance of a contract, and legitimate interest.
To improve the platform, diagnose faults and develop features — legitimate interest, using aggregated or pseudonymised data wherever it will do.
To send service messages about your account — performance of a contract. To send marketing — consent, which you may withdraw at any time.
To keep accounting, tax and statutory records — legal obligation.

Where we rely on legitimate interest, we have weighed that interest against your rights and freedoms, and we will tell you more about that assessment on request.

6. Identity verification

To open and maintain a merchant account we may verify identity and business details through licensed providers and public registries, including national identity registries, revenue authority systems and commercial identity verification services. We send only the data needed for the check, and we record the result, the provider, the time and the status.

National identification numbers are stored in a form designed to allow matching without keeping the number readable in our systems where the feature does not require it. Where a check cannot be completed automatically, a member of our team may review the submitted documents.

7. Who we share it with

We do not sell personal data. We share it only as follows:

Infrastructure and hosting providers that run our servers, storage, backups and content delivery.
Identity verification and fraud prevention providers, as described in section 6.
Payment and fiscal providers you connect, acting on your own credentials and instructions.
Communication providers that deliver email, SMS and messaging on our behalf.
AI model providers, where you use an AI-assisted feature, limited to the data that feature needs.
Third-party integrations you enable, limited strictly to the scopes and fields you grant, and revocable by you at any time.
Professional advisers, auditors and insurers, under duties of confidence.
Authorities, regulators and courts, where we are legally required to disclose. We will tell you unless we are prohibited from doing so.
An acquirer, in a merger, acquisition or sale of assets, subject to this policy continuing to apply.

A current list of our sub-processors, naming each provider and the purpose it serves, is available on request from privacy@ifinsta.com and is published with the Data Processing Agreement. Every sub-processor is bound by written terms no less protective than ours.

8. International transfers

We are based in Kenya and process data primarily there. Some providers operate outside Kenya. Where personal data is transferred out of Kenya, or out of any other jurisdiction whose law applies to you, we rely on an appropriate safeguard — an adequacy decision, standard contractual clauses, or another lawful transfer mechanism — and we carry out a transfer impact assessment where one is required. You may ask us for details of the safeguard used for a particular transfer.

9. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. Our operating defaults are:

Account and merchant records — for as long as the account is open, and then as set out below.
Deleted records — held in a recoverable state for 30 days before permanent deletion, so an accidental deletion can be undone.
Inactive merchant accounts — flagged as inactive after 90 days without activity, and eligible for deletion after 180 days.
Security audit logs — 365 days.
Expired session records — 90 days.
Consent and document acceptance records — for the life of the account and for as long afterwards as a limitation period could require us to evidence them.
Accounting, tax and statutory records — for the period the applicable law requires, which in Kenya is generally seven years.
Backups — overwritten on their own cycle, so a deleted record may persist in backup for a limited period after live deletion.

Where we no longer need data but cannot delete it immediately, we restrict access to it. Where we can meet a purpose with anonymised data, we anonymise rather than keep an identifiable record.

10. How we protect it

Encryption of traffic in transit, and encryption at rest for sensitive and financial fields.
Credentials you configure for third-party providers are stored encrypted and used only to act on your instructions.
Role-based access control, tenant isolation between merchants, and field-level permissions for integrations.
Multi-factor and step-up authentication for sensitive actions, session management and device controls.
Audit logging of significant actions, with tamper-evident sequencing.
Redaction controls intended to keep secrets and internal details out of logs, error messages and AI inputs and outputs.
Least-privilege access for our staff, granted on need and reviewed periodically.
Backups, recovery testing, and monitoring for anomalous activity.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where the risk is high, the people affected, within the time the law requires.

11. Your rights

Subject to the conditions in the applicable law, you have the right to:

be informed about how your data is used;
access a copy of the personal data we hold about you;
have inaccurate data corrected and incomplete data completed;
have data erased where we no longer have a basis to keep it;
restrict processing while a dispute about accuracy or lawfulness is resolved;
receive data you gave us in a portable, machine-readable format, and have it transmitted to another controller where technically feasible;
object to processing based on legitimate interest, and to direct marketing at any time;
withdraw consent at any time, without affecting processing already carried out;
not be subject to a decision producing legal or similarly significant effects based solely on automated processing.

To exercise a right, email privacy@ifinsta.com. We will respond within the statutory period, which under the Kenya Data Protection Act, 2019 is seven days for a request to access or correct, and within one month under the General Data Protection Regulation where it applies. We may ask you to verify your identity first. We do not charge for a request unless it is manifestly unfounded or excessive.

12. Automated decisions and AI

We use automated checks in identity verification, fraud screening and risk scoring. Where such a check would produce a legal or similarly significant effect — for example refusing to open an account — a person reviews the outcome before it is acted on, and you may ask for that review, express your point of view and contest the decision.

AI-assisted features send the data a feature needs to a model provider to generate a response. We contract for that data not to be used to train third-party models. AI output can be wrong; it is a suggestion, not advice, and you remain responsible for decisions you take on it.

13. Cookies and similar technologies

We use cookies and similar storage that are strictly necessary to sign you in, keep your session secure and remember your preferences. Where we use analytics or other non-essential storage, we ask for your consent first and you can change that choice at any time. Your browser also lets you block or delete cookies, though the platform may not work correctly without the necessary ones.

14. Children

The platform is for business use and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact privacy@ifinsta.com and we will delete it.

15. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@ifinsta.com so we can put it right. You also have the right to complain to a supervisory authority — in Kenya, the Office of the Data Protection Commissioner (ODPC); in the European Economic Area or the United Kingdom, your local data protection authority.

16. Changes to this policy

We may update this policy. Each version carries a version number and an effective date. We will give reasonable notice of a material change, and where the law requires it we will ask for your consent again.

17. Contact us

Data protection enquiries and rights requests: privacy@ifinsta.com. General enquiries: info@ifinsta.com or +254 765 111 110. ifinsta is a product of Eleso Solutions. Our data protection contact can be reached at the same address.