VELROXThis Policy describes the principles and safeguards used by Velrox Limited, trading as Velrox, in relation to customer data, personal data, information security, data processing and artificial intelligence.
Purpose
The purpose of this Policy is to establish how Velrox:
- Protects Customer Data
- Processes personal data
- Controls access to data
- Protects business information
- Manages security incidents
- Uses third-party processors
- Handles backups
- Supports customer data rights
- Uses analytics and artificial intelligence
Roles of the Parties
Depending on the processing activity:
The business customer may act as the Data Controller for personal data that it enters into the Service and determines how and why to process.
Velrox may act as a Data Processor where it processes personal data on behalf of a business customer according to the customer’s instructions.
Velrox may separately act as a Data Controller for information it processes for its own purposes, including account management, billing, security, fraud prevention, legal compliance and service administration.
Processing Instructions
When acting as a processor, Velrox will process Customer Data primarily to:
- Provide the Service
- Store Customer Data
- Retrieve Customer Data
- Generate requested reports
- Provide customer support
- Maintain system availability
- Maintain security
- Perform backups
- Troubleshoot
- Prevent abuse
- Comply with lawful requirements
We will not intentionally process Customer Data for unrelated purposes.
Data Minimization
We seek to limit collection and access to information reasonably necessary for the intended business or operational purpose.
Users should not enter personal information that is unnecessary for their use of the Service.
Confidentiality
Personnel and contractors who are authorized to access Customer Data will be subject to confidentiality obligations.
Access to Customer Data will be limited according to role and operational necessity.
Tenant Isolation
Customer environments are designed to maintain logical separation between businesses.
A user belonging to one business must not be able to access another business’s Customer Data through normal application functionality.
Authorization checks must be applied to sensitive operations and data access.
Access Control
We use access controls designed to limit access to authorized users and personnel. Controls may include:
Administrative access should be limited to authorized personnel with a legitimate business or technical need.
Encryption
Where reasonably appropriate, we use encryption or encrypted communication to protect data:
- During transmission
- Within supported storage systems
- During backups
- When transferring sensitive information
Passwords must never be stored in plaintext. Sensitive authentication credentials must be protected using appropriate cryptographic mechanisms.
Logging and Monitoring
We may maintain logs relating to:
- Authentication events
- Administrative actions
- Security events
- Significant account activity
- Errors
- System performance
Logs may be used to investigate incidents, maintain security, diagnose failures and improve the Service.
Security Testing
We will use reasonable security practices appropriate to the size and nature of the Service. Depending on risk and resources, these may include:
- Dependency updates
- Vulnerability management
- Code review
- Security testing
- Access reviews
- Configuration reviews
- Monitoring
- Backup testing
- Incident-response exercises
Production security testing by customers or third parties requires prior written authorization unless otherwise expressly permitted.
Third-Party Processors
We may engage third-party providers for:
Where they process personal data on our behalf, we seek to apply appropriate contractual and security protections.
A current list of significant subprocessors may be made available upon request or published at:
SUBPROCESSOR PAGE
https://velrox.app/subprocessorsCross-Border Processing
Where Customer Data or personal data is processed outside Kenya, we will apply appropriate safeguards required under applicable law.
Relevant safeguards may include contractual protections, security measures, appropriate transfer mechanisms and other lawful bases applicable to the transfer.
Data Subject Requests
Where we process personal data as a processor on behalf of a customer, we will reasonably assist the customer in responding to valid data-subject requests, taking into account the nature of the processing.
Where we are acting as the controller, individuals may contact:
CONTACT
[email protected]Data Breach Management
A suspected personal-data or security incident will be assessed and handled according to our incident-response procedures.
Our process may include:
Detection
Containment
Investigation
Assessment of affected systems and data
Risk assessment
Remediation
Required notifications
Recovery
Post-incident review
Where the Data Protection Act requires notification to the ODPC, the applicable statutory requirements will be followed.
Under section 43, where personal data has been accessed or acquired by an unauthorized person and there is a real risk of harm, a data controller is required to notify the Data Commissioner without delay and within 72 hours of becoming aware of the breach. A processor must notify its controller without delay and, where reasonably practicable, within 48 hours.
Customer Notification of Incidents
Where an incident materially affects Customer Data and notification is appropriate, we will communicate relevant information to the affected customer within a reasonable period, subject to security, legal and investigative requirements.
Information may include:
- The nature of the incident
- Systems affected
- Categories of information affected
- Actions taken
- Mitigation measures
- Recommended customer actions
Backup and Recovery
We maintain backup and recovery processes appropriate to the Service. Backup measures may include:
- Automated backups
- Encrypted backup storage
- Access restrictions
- Backup monitoring
- Recovery testing
- Disaster-recovery procedures
Backups are intended to reduce the risk of permanent data loss but do not constitute an absolute guarantee against loss.
Data Retention
Customer Data will generally be retained while the customer’s account remains active and for a reasonable period following termination to allow for account administration, export, dispute resolution, security and recovery.
Unless otherwise required by law, contract or a specific service plan, we may delete Customer Data after the applicable post-termination retention period.
Backups may retain deleted information until their normal expiration cycle.
Customer Data Export
Where technically supported, customers may export their business information before account termination or deletion.
Customers should request export assistance before their account reaches the final deletion stage.
Deletion
Where deletion is required and legally permissible, information may be:
- Permanently deleted
- Anonymized
- Pseudonymized
- Rendered inaccessible through normal systems
Certain records may need to be retained because of legal obligations, disputes, security requirements or legitimate record-keeping purposes.
AI and Machine Learning
Velrox may provide AI-powered functionality, including:
AI systems will operate as an intelligence layer over data and calculations generated or retrieved by the platform.
Source of Truth
For financial and transactional information, the application’s structured business records remain the source of truth.
AI should not be treated as the authoritative accounting ledger.
For example, calculations such as revenue, expenses, payroll, outstanding invoices and profit should be generated by application logic and validated business rules. AI may interpret and explain those results.
AI Accuracy
AI-generated results can contain errors.
Customers are responsible for reviewing AI outputs before taking material action.
AI must not be represented as infallible.
Where an AI recommendation could materially affect an individual’s legal rights, employment, access to important services or financial position, the feature should be subject to additional assessment, safeguards and appropriate human oversight.
Use of Customer Data for AI
Customer Data should not automatically become training data for general-purpose AI models.
Where identifiable Customer Data is provided to an external AI service, Velrox will assess the applicable privacy, security, contractual and legal requirements and use appropriate controls.
Where practical, the platform should minimize the information sent to the AI service.
EXAMPLE — MINIMIZED AI PAYLOAD
“Revenue: KSh 1,850,000; previous period: KSh 2,100,000; expense growth: 22%.”Rather than transmitting an entire customer database, the platform may provide a controlled, relevant calculation.
Anonymized and Aggregated Data
Where lawful and technically appropriate, we may generate aggregated or anonymized information that does not reasonably identify a person.
Such information may be used for:
- Service improvement
- Security analysis
- Product analytics
- Usage trends
- Benchmarking
- Research
- Performance optimization
We will not intentionally use anonymized information to reconstruct the identity of individuals.
Privacy by Design
Privacy and security considerations should be incorporated into new features from the design stage.
Before launching higher-risk features, we may assess:
- What information is collected
- Why it is collected
- Who can access it
- Whether less intrusive alternatives exist
- Security risks
- Retention
- Third-party processing
- Cross-border processing
- AI risks
- Data-subject rights
Where processing is likely to result in high risk to data subjects, an appropriate Data Protection Impact Assessment will be considered and conducted where required.
Employee and Payroll Data
Employee information may contain confidential personal and financial information.
Access should therefore be restricted to authorized business users.
Customers must ensure that their employee and payroll-processing practices comply with applicable employment, tax and data-protection requirements.
Security Responsibilities of Customers
Customers must:
Security Incident Reporting
Customers should immediately report suspected unauthorized access, compromised credentials or data exposure to:
Where possible, reports should include:
- Business/account identifier
- Approximate time of incident
- Affected user
- Affected data
- Description of what happened
- Actions already taken
Policy Review
This Policy will be reviewed periodically and may be updated to reflect:
- Changes in technology
- New features
- Security risks
- Legal requirements
- Third-party processing arrangements
- AI capabilities