Privacy Policy

1. Introduction

This Privacy Policy explains how CraftSales POS collects, uses, stores, and protects your information in accordance with the Kenya Data Protection Act, 2019.

2. Information We Collect

To provide our services efficiently, we gather various categories of data when you utilize our platform:

3. How We Use Information

We process collected information to:

• Provide, operate, and maintain the Platform.
• Process financial transactions and generate business reports.
• Improve security and detect fraudulent activity.
• Enhance platform services and user experience.
• Send system notifications and transactional updates.
• Provide customer support.
• Comply with legal and statutory obligations.

4. Cookies

We use essential cookies and tracking technologies to:

• Keep users securely signed in during active sessions.
• Improve performance and remember platform preferences.
• Secure user sessions against unauthorized access.
• Analyze usage patterns to improve functionality.

5. Sharing Information

We do NOT sell personal information. We share information only with authorized parties where strictly necessary:

• Payment processors, SMS providers, and Email service providers.
• Cloud hosting providers and infrastructure partners.
• Government agencies where legally mandated.
• Kenya Revenue Authority (KRA) for eTIMS integration.
• Auditors and professional advisers bound by confidentiality obligations.

6. Data Security

We implement strict administrative, physical, and technical safeguards, including:

• TLS encryption for data in transit and encryption at rest where appropriate.
• Role-based access controls (RBAC) and detailed audit logs.
• Regular automated backups and Firewall protection.
• Multi-Factor Authentication (MFA) and continuous system monitoring.

* Note: No system can be 100% secure; users are responsible for keeping their credentials confidential.

7. Data Retention

We retain your information while your account is active, as necessary for tax obligations under Kenyan law, to resolve disputes, and to satisfy legal requirements.

When statutory retention periods expire, information is securely deleted or anonymized.

8. Your Rights

Subject to the Kenya Data Protection Act, 2019, you have the right to:

• Access your personal information held by us.
• Request correction of inaccurate or incomplete information.
• Request deletion of data where legally permissible.
• Restrict or object to specific processing activities.
• Receive a copy of your data in a portable, structured format.
• Withdraw consent where processing relies upon consent.

9. International Transfers

Where data is processed outside Kenya, we implement appropriate safeguards consistent with applicable data protection laws to ensure your data remains secure.

10. Children's Privacy

Our Platform is strictly intended for business usage. We do not knowingly collect personal information from children. Businesses using the Platform remain responsible for ensuring legal compliance for any data entered.

11. Account Security

Users must take proactive measures to maintain security:

• Keep passwords confidential and unique.
• Enable Multi-Factor Authentication (MFA) where available.
• Log out after sessions, especially on shared devices.
• Notify us immediately if unauthorized access is suspected.

12. Data Breaches

In the event of a verified personal data breach, we will investigate promptly, take steps to contain and remediate the incident, and notify affected users and regulatory authorities as required by law.

13. Third-Party Services

The Platform may integrate with third parties like M-Pesa, Banks, Payment Gateways, Google, Microsoft, Email/SMS Gateways, and Delivery Providers. These entities process data according to their respective privacy policies.

14. Updates to this Policy

We may update this Privacy Policy periodically. Material updates will be communicated through the Platform or via direct notification.

15. Contact Information

For any privacy inquiries, data requests, or compliance questions, please contact our Data Protection Officer: