Data Protection

1. Our commitment

Fortpesa is committed to protecting personal data in accordance with the Data Protection Act, 2019 (Kenya) and the regulations made under it. This page explains how we handle personal data across the platform in practice: who controls what, what we process and why, how we protect it, and how to exercise your rights. It complements our Privacy Policy.

2. Roles: controller and processor

• We are a data controller for the personal data of our registered users (merchant owners, staff and administrators): account details, business and verification information, device and log data, and support communications.
• We act as a data processor for personal data of customers (payers) — such as the phone number and payment details processed through an STK Push or payment link — where we process that data only to carry out collections on your (the merchant's) instructions as controller.
• Mobile money networks and payment partners act as independent controllers for the data they process under their own legal obligations (for example transaction records they must keep).

3. Personal data we process

• Identity and contact data: names, emails, phone numbers, business names.
• Verification data: information supplied during merchant verification (KYC), including business registration details and M-Pesa channel identifiers.
• Transaction data: payer phone numbers, amounts, references, descriptions, timestamps, results and platform fees.
• Technical data: IP addresses, browser/device information, access logs, cookies and analytics identifiers.
• Communications: support requests and our replies.

4. Purposes and lawful bases

• Providing the service (contract): creating accounts, provisioning channels, processing collections and top-ups, showing balances and histories.
• Compliance with legal obligations (legal obligation): merchant verification, anti-money-laundering checks, responding to lawful requests, record-keeping.
• Security and abuse prevention (legitimate interests): monitoring for fraud, unauthorised access and platform misuse.
• Service improvement and analytics (legitimate interests or consent where required): understanding usage, debugging, improving features.
• Communications (contract or legitimate interests): transaction notices, security alerts, support responses; marketing messages are sent only with consent and can be opted out of.

5. Sharing

We share personal data only with: payment partners and mobile money operators that process collections; subprocessors (hosting, email delivery, analytics) bound by data-protection terms; professional advisers under confidentiality; and authorities where lawfully required. We never sell personal data. A fuller description is in the Privacy Policy.

6. Transfers outside Kenya

Some of our service providers may process data outside Kenya. Where we transfer personal data abroad we take steps required by the Data Protection Act — including ensuring an adequate level of protection or appropriate safeguards — and we only transfer what is necessary for the stated purpose.

7. Security and breach notification

We apply technical and organisational measures appropriate to the risk: encryption in transit, access control and least-privilege internal access, secret-signed callbacks, API-key authentication, session security and activity monitoring. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner (ODPC) within the time required by law (72 hours where the requirements of the Act apply) and notify affected individuals without undue delay where the risk is high.

8. Retention

We retain personal data only for as long as needed for the purposes described here and to meet legal, accounting and security requirements. Account data is kept while your account is active; transaction records are kept for reconciliation, dispute and legal purposes; logs are kept for shorter security windows. After that, data is deleted or irreversibly anonymised.

9. Your data subject rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• require correction or deletion of inaccurate or unwanted data;
• require restriction of processing, or object to processing (including profiling);
• receive your data in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent;
• not be subject to decisions based solely on automated processing that significantly affect you.

Exercise these rights by emailing [email protected]. We respond within the time required by law. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

10. Cookies

We use essential cookies (sign-in, security, preferences) and, when enabled, analytics to understand site usage. You can manage cookies in your browser. See the cookies section of our Privacy Policy.

11. Contact and complaints

For any question or request about this page or about personal data generally, email [email protected]. If you are unsatisfied with our response you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya.