VELROXThis Privacy Policy explains how Velrox Limited, trading as Velrox (“we”, “us”, “our”), collects, uses, stores, protects and otherwise processes personal data when you access or use our website, application, software and related services (collectively, the “Service”).
Who We Are
For information that we collect and determine the purposes and means of processing ourselves, we may act as a data controller.
Where a business customer uses our Service to store or process personal data belonging to its customers, employees, suppliers or other individuals, that business customer may determine the purposes and means of processing and may therefore act as the data controller. In those circumstances, we may act as a data processor on the customer's behalf, subject to the applicable agreement.
Information We Collect
Depending on how you use the Service, we may collect the following categories of information.
Account Information
- Name
- Email address
- Phone number
- Username
- Password credentials or authentication information
- Business name
- Business address
- Business contact information
Business Information Entered Into the Service
Customers may use the Service to store information relating to their businesses, including:
- Sales records
- Purchase records
- Expense records
- Customer information
- Supplier information
- Employee information
- Payroll information
- Invoices
- Quotations
- Service-fee records
- Payment-related records
- Business reports
- Attachments and documents uploaded by the customer
Some information entered by customers may constitute personal data belonging to their customers, employees, suppliers or other individuals.
Technical Information
We may collect information such as:
- IP address
- Browser type
- Device type
- Operating system
- Login information
- Session information
- Application activity
- Error logs
- Security logs
- Approximate usage information
We collect technical information primarily to operate, secure, troubleshoot and improve the Service.
How We Use Personal Data
We may process personal data for purposes including:
- Creating and managing user accounts
- Providing and maintaining the Service
- Authenticating users
- Processing subscriptions and payments
- Providing customer support
- Maintaining security
- Preventing fraud, abuse and unauthorized access
- Diagnosing technical problems
- Maintaining backups
- Improving reliability and performance
- Communicating important service information
- Complying with applicable legal obligations
- Responding to lawful requests from competent authorities
- Protecting our legal rights
- Maintaining business and security records
We will not use personal data for purposes that are incompatible with the purpose for which it was collected unless permitted by applicable law or a valid additional lawful basis exists.
Lawful Basis for Processing
Depending on the circumstances, we may process personal data on the basis of:
- Performance of a contract
- Compliance with a legal obligation
- Consent
- Legitimate interests, where applicable
- Protection of vital interests
- Other lawful grounds permitted by applicable law
We will not treat consent as the lawful basis where another lawful basis is more appropriate.
Where processing is based on consent, the consent may be withdrawn subject to applicable legal and contractual limitations.
Customer Responsibilities
Where a business customer enters personal data relating to its customers, employees, suppliers or other individuals into the Service, the business customer is responsible for:
- Having an appropriate lawful basis for collecting and processing the information
- Providing required privacy notices to affected individuals
- Ensuring the information entered into the Service is accurate and lawful
- Avoiding the collection of unnecessary personal information
- Responding to requests from its customers, employees or other data subjects where required
- Complying with applicable employment, tax, accounting, privacy and other laws relevant to its activities
We do not determine why a customer chooses to collect personal information from individuals unless separately stated.
Data Subject Rights
Subject to applicable law, individuals may have rights including:
- The right to be informed about the processing of their personal data
- The right to request access to their personal data
- The right to object to processing in appropriate circumstances
- The right to request correction of inaccurate or misleading personal data
- The right to request deletion of false or misleading personal data
- The right to data portability where applicable
- Other rights provided by applicable data-protection law
Requests concerning information controlled by a business customer may need to be directed to that business customer.
Requests concerning personal data for which Velrox is the controller may be submitted to:
We may take reasonable steps to verify the identity of the person making a request before responding.
Data Sharing
We do not sell personal data to third parties.
We may disclose or provide access to personal data where reasonably necessary to:
- Provide the Service
- Use infrastructure, hosting, authentication, payment, communication, monitoring, analytics or other service providers
- Comply with legal obligations
- Respond to lawful requests from competent authorities
- Protect users, our Service or our legal rights
- Investigate fraud, abuse or security incidents
- Complete a merger, acquisition, restructuring or sale of assets, subject to applicable law
Service providers processing personal data on our behalf will be required to handle the data under appropriate contractual and security safeguards.
Third-Party Service Providers
Our Service may depend on third-party infrastructure or service providers. These may include providers for:
Where a third party processes personal data on our behalf, we seek to use appropriate contractual, technical and organisational safeguards.
International and Cross-Border Transfers
Some service providers may operate infrastructure or process information outside Kenya.
Where personal data is transferred outside Kenya, we will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Kenyan data-protection requirements, including applicable safeguards, contractual protections, adequacy requirements, necessity or consent where applicable.
We maintain appropriate records relating to relevant cross-border processing activities.
Data Security
We use appropriate technical and organisational safeguards designed to protect personal data against:
- Unauthorized access
- Unauthorized disclosure
- Unauthorized modification
- Accidental loss
- Destruction
- Misuse
- Other unlawful processing
Depending on the nature and sensitivity of the information, safeguards may include:
- Encryption in transit
- Encryption or protected storage at rest where appropriate
- Authentication controls
- Role-based access controls
- Access logging
- Secure password practices
- Backup mechanisms
- Monitoring
- Security updates
- Vulnerability management
- Staff confidentiality obligations
- Incident-response procedures
No internet-based system can be guaranteed to be completely secure.
Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, to provide the Service, to satisfy contractual or legal obligations, to resolve disputes, enforce agreements, maintain security and for legitimate operational requirements.
When information is no longer required, we may delete, anonymize or otherwise securely dispose of it subject to legal, contractual and backup requirements.
Business customers remain responsible for retaining records they are legally required to retain.
Backups
We may maintain encrypted or otherwise protected backups to support business continuity, disaster recovery and service restoration.
Deleted data may therefore remain temporarily within backup systems before being permanently removed in accordance with our backup and retention procedures.
Artificial Intelligence and Business Analytics
We may introduce artificial-intelligence, analytics and automated-processing features into the Service.
Where such features are used:
- AI outputs may be generated from information supplied by the customer
- AI-generated information may contain errors
- AI outputs should be reviewed before being relied upon for important business decisions
- AI features are not a substitute for professional legal, tax, accounting, medical or financial advice
- We will apply appropriate privacy and security safeguards to AI-related processing
- We will not knowingly use identifiable customer data to train general-purpose AI models without an appropriate lawful basis and, where required, customer authorization or consent
Where technically and commercially appropriate, we may use aggregated, anonymized or de-identified information to understand product performance, security, usage trends and service improvements, provided that the resulting information does not identify individuals.
Children's Data
The Service is designed primarily for businesses and is not intended to be a service directed at children.
Business customers must not knowingly enter children's personal data into the Service unless they have a lawful basis to do so and have implemented any safeguards, notices, consents or authorizations required by applicable law.
Where our processing is likely to create a high risk to the rights and freedoms of individuals, we may conduct an appropriate Data Protection Impact Assessment.
Cookies and Analytics
We may use cookies and similar technologies to:
- Keep users signed in
- Maintain security
- Remember preferences
- Understand Service usage
- Diagnose technical problems
- Improve performance
Where required, we will request appropriate consent for non-essential cookies or similar technologies.
Data Breaches
Where a personal data breach occurs, we will follow our incident-response procedures and applicable law.
Where the Data Protection Act requires notification to the ODPC because of unauthorized access or acquisition presenting a real risk of harm, we will take appropriate steps to make the required notification without delay and within the applicable statutory period.
Where required, affected individuals will also be communicated with within the applicable period.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Service, technology, legal requirements or business practices.
Where appropriate, we will notify users of material changes.
The updated policy will state its effective date.
Contact and Complaints
Questions, privacy requests and complaints should first be submitted to:
Where an individual believes their data-protection rights have not been adequately addressed, they may have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya.
Governing Law
This Privacy Policy is governed by the laws applicable in Kenya, subject to any mandatory rights or protections applicable to an individual under the law.