Privacy Policy

KAPUSH Ltd ("KAPUSH", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our salary advance platform ("Service"). This policy complies with the Kenya Data Protection Act, 2019 and applicable international data protection standards.

3.1 Service Delivery: Processing salary advances, facilitating M-PESA disbursements, managing payroll deductions, and maintaining your account.

3.2 Security & Fraud Prevention: Detecting fraudulent transactions, monitoring unusual activity, and enforcing platform policies.

3.3 Legal Compliance: Meeting tax obligations, complying with labor laws, and responding to legal requests.

3.4 Service Improvement: Analyzing usage patterns, conducting research and development, and generating analytics to improve our services.

3.5 Communication: Sending transactional notifications, service updates, and important account information.

We may share your personal data with the following parties:

• Employer Partners: For payroll processing, advance approvals, and deduction management
• Safaricom M-PESA: For payment processing and disbursement services
• Financial Institutions: For settlement and reconciliation purposes
• Service Providers: Cloud hosting, IT support, and analytics (under strict confidentiality agreements)
• Legal Authorities: When required by law, court order, or regulatory request
• Credit Reference Bureaus: In cases of default or non-payment (as permitted by law)

NOTE: We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

5.1 Encryption: AES-256 encryption for data at rest and TLS 1.3 for data in transit

5.2 Access Controls: Role-based access permissions and multi-factor authentication for all system access

5.3 Monitoring: 24/7 security monitoring with automated threat detection and incident response

5.4 Regular Audits: Quarterly security assessments, penetration testing, and vulnerability scans

5.5 Employee Training: Regular data protection and security awareness training for all staff

5.6 Incident Response: Documented procedures for data breach notification within 72 hours as required by law

6.1 Active Employees: Personal data retained throughout the employment relationship and active use of services

6.2 Former Employees: Seven (7) years after employment termination or final advance repayment, as required by Kenyan tax and employment laws

6.3 Transaction Records: Seven (7) years for audit, compliance, and legal purposes

6.4 Analytics Data: Indefinitely in anonymized and aggregated form for research and service improvement

6.5 Deletion: Upon request or after retention period expires, data is securely deleted or anonymized

Under the Kenya Data Protection Act, 2019, you have the following rights:

8.1 Essential Cookies: Required for platform functionality, authentication, and security

8.2 Performance Cookies: Anonymous usage statistics to improve service quality

8.3 Security Cookies: Fraud detection, prevention, and account protection

8.4 Cookie Management: You can control cookies through your browser settings, though disabling essential cookies may affect platform functionality

Your data is primarily stored and processed within Kenya. If we transfer data outside Kenya, we ensure adequate safeguards through:

• Standard contractual clauses approved by data protection authorities
• Transfers to countries with adequate data protection laws
• Your explicit consent for specific transfers

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated through email or prominent notice on our platform at least 30 days before taking effect. The "Last Updated" date at the top indicates when changes were last made.