Privacy Policy

1. Overview

Fortpesa ("we", "us") provides an online payment collection platform for Kenyan businesses: merchant accounts, M-Pesa collection channels, STK Push collections, payment links, transaction records and developer APIs. This Privacy Policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. It applies to our website, dashboard, mobile app, APIs and support channels.

By using Fortpesa you agree to the collection and use of personal data as described here. We process personal data in accordance with the Data Protection Act, 2019 and other applicable Kenyan law.

2. Information we collect

We collect the following categories of personal data:

• Account information — your name, email address, phone number, business name and role (owner or staff) when you register or manage your account.
• Verification information — business and identity details you provide during merchant verification (KYC), such as registration details and M-Pesa paybill or till numbers.
• Transaction information — amounts, references, timestamps, status and the M-Pesa phone numbers involved in collections and top-ups, together with the platform fees shown on each transaction.
• Technical information — IP address, browser and device type, approximate location, pages visited and access logs, used for security, debugging and understanding how the service is used.
• Cookies and similar technologies — see the Cookies section below.
• Communications — messages you send to our support team and responses we send back.

3. How we use your information

We use personal data to:

• Provide, operate and maintain the Fortpesa platform, including creating your account, provisioning collection channels and processing collections and top-ups.
• Calculate, display and record platform fees and transaction history.
• Verify merchants and meet our legal and regulatory obligations, including fraud prevention and anti-money-laundering checks.
• Send service communications — account notices, transaction confirmations, security alerts, password resets and support replies.
• Monitor, secure and improve the platform, including debugging, analytics and understanding feature usage.
• Protect our users and the platform from abuse, fraud and unauthorised access.

4. Legal bases for processing

Under the Data Protection Act, 2019 we rely on one or more of the following legal bases: performance of our contract with you (or steps you take before entering it), your consent, our legitimate interests in operating and securing the platform, and compliance with legal obligations we are subject to.

5. When we share your information

We do not sell personal data. We share it only with:

• Payment partners — licensed payment service providers and mobile money operators that process collections, top-ups and provider confirmations on our instructions.
• Service providers — hosting, email delivery and analytics providers who process data on our behalf under contracts that limit their use of it.
• Authorities — regulators, courts or law enforcement where required by law or where necessary to protect the rights, safety or property of our users and the platform.
• Business transfers — a successor entity in the event of a merger, acquisition or sale of assets, subject to this policy or an equivalent one.

6. Data retention

We keep personal data for as long as your account is active and for as long as afterwards as is necessary to meet legal, accounting and security obligations — for example, keeping transaction records that both you and we need for reconciliation and dispute resolution. When data is no longer needed we delete it or anonymise it.

7. Security

We protect personal data with technical and organisational measures appropriate to the risk: encryption of data in transit, access controls and least-privilege internal access, signed and secret-protected callback endpoints, API-key authentication, and monitoring of platform activity. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

8. Your rights

Subject to law, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data, subject to legal retention requirements;
• object to, or restrict, certain processing;
• withdraw consent where processing is based on consent;
• receive your data in a portable, machine-readable format.

To exercise any of these rights, email [email protected]. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.

9. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences (such as your dashboard theme) and understand how the site is used, including via privacy-focused web analytics when enabled. You can control cookies through your browser settings; blocking essential cookies may prevent parts of the dashboard from working.

10. Children

Fortpesa is a business service and is not directed at children. You must be at least 18 years old and acting for a business to create an account.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide additional notice through the dashboard or by email.

12. Contact us

Questions, requests or complaints about privacy can be sent to [email protected]. Please include enough detail for us to identify you and your request.