Privacy Policy

1. Who we are

Lipaware Africa Ltd is a company registered in Kenya. We provide a white-label platform that lets banks, fintechs, payment service providers, mobile money operators, microfinance institutions and enterprises offer payments, wallets, lending and business messaging to their own customers under their own brand.

We comply with Kenya’s Data Protection Act, 2019 and its regulations. Where we process personal data of people in the European Economic Area or the United Kingdom, we also comply with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Who this policy covers

This policy covers personal data that Lipaware controls, about:

• people who visit lipaware.com or contact us through it;
• staff of the banks, fintechs, payment providers, mobile money operators, microfinance institutions and enterprises that are our clients or prospects, including users of our client portal;
• suppliers, partners and job applicants.

Our clients’ own customers use products that run on our platform under the client’s brand. The client controls that data and its privacy notice applies. Section 5 explains our role as the client’s processor.

On-premise deployments. This policy covers Lipaware’s cloud platform. Some clients run the Lipaware platform on their own infrastructure. In those on-premise deployments the client hosts, operates and secures the platform, controls all data in it, and its own privacy policy applies. Contact that client for any question or request about your data. Lipaware has no access to an on-premise system unless the client grants it for support, and then acts only as the client’s processor under its contract.

3. Personal data we collect

We collect only the data needed for the service being used. The table lists each category and where it comes from.

Special categories. We do not collect special categories of personal data, such as health or biometric data, about our business contacts.

If you do not provide data. Contact, billing and due diligence details are needed to enter into and perform a contract, and some are required by law. Without them we cannot provide our services.

4. How we use personal data and our lawful basis

We use personal data only for the purposes below, each with a lawful basis under Kenya’s Data Protection Act and the GDPR.

Where we rely on legitimate interests, we have balanced our interests against your rights, and you can object at any time (section 10). Where we rely on consent, you can withdraw it at any time; this does not affect processing already carried out.

We do not sell personal data.

5. Data we process for our clients

Banks, fintechs, payment providers, lenders and other businesses use our cloud platform to run wallets, payments, payouts, lending and customer messaging under their own brand. For the personal data of their customers and message recipients, the client is the controller and we are its processor.

As processor, we:

• process the data only on the client’s documented instructions, under a data processing agreement;
• do not use it for our own purposes, except to keep the platform secure, prevent fraud and meet our own legal duties;
• share it only with the service providers in section 6 that the service needs, under equivalent obligations;
• delete or return it when the client’s contract ends, subject to legal retention periods (section 8);
• help the client respond to requests from its customers, and notify it promptly of any breach.

Customer messaging, including WhatsApp

Clients can connect their own WhatsApp Business accounts to our platform through Meta’s WhatsApp Business Platform, as well as SMS and email channels. We then receive the account identifiers and access credentials Meta issues. We store and process the messages, media, delivery status, phone numbers and profile names needed to send and receive messages for that client, and use them only to provide the messaging service to that client. A client can disconnect its account at any time (section 11).

If you are a client’s customer and want to exercise your privacy rights, contact that client first. If you contact us, we will pass your request to the client within 3 working days and help get a response.

6. Service providers and partners

We share personal data only with the parties below, only as much as each needs, and under written contracts that require them to protect it and use it only for the stated purpose.

Third-party platforms with their own terms. Some providers, such as Meta for WhatsApp messaging, card networks and mobile money operators, also process data as independent controllers under their own privacy policies. Messages sent through WhatsApp, for example, are subject to WhatsApp’s terms and policies and the WhatsApp Business Messaging Policy. We encourage you to read those policies.

Current list. A list of our current service providers and their locations is available on request from privacy@lipaware.com.

Business transfers. If Lipaware is involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner, which must keep protecting it under this policy. We will tell affected clients and users before this happens.

7. International transfers

We store platform data in Kenya, the United Kingdom, the European Union and South Africa. Some providers in section 6 process data in other countries. Meta, for example, processes WhatsApp messages on its global infrastructure.

We transfer personal data outside Kenya only where the Data Protection Act allows it, which means at least one of the following applies:

• the destination has adequate data protection safeguards, or the Data Commissioner has approved the transfer;
• we have a written contract with the recipient that includes appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or equivalent terms;
• the transfer is necessary to perform a contract with you or our client, for example to deliver a message or complete a cross-border payment;
• you have given your consent after being told of the risks.

For people in the EEA or the UK, transfers out of those regions rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures where needed.

We keep records of these transfers and their safeguards. You can ask for a copy of the safeguards that apply to your data by writing to privacy@lipaware.com.

8. How long we keep data

We keep personal data only as long as the purpose we collected it for requires, or as long as the law requires, then delete it or anonymise it. The main periods are:

Data subject to a legal hold or dispute is kept until the matter is resolved.

9. Security and breach notification

We protect personal data with technical and organisational measures suited to the risk, including encryption in transit and at rest, access controls with multi-factor authentication, separation of each client’s data, continuous monitoring and regular independent testing. Our cloud platform is certified to ISO/IEC 27001 and PCI DSS Level 1.

If a personal data breach creates a real risk of harm, we notify the Office of the Data Protection Commissioner within 72 hours, and the relevant authority where the GDPR applies. We tell affected people without undue delay, and notify affected clients promptly so they can meet their own duties.

10. Your rights and how to use them

You have the following rights over your personal data. Using them is free. We respond within the times below, which follow Kenya’s Data Protection (General) Regulations, 2021 and fall within the GDPR’s one-month limit.

How to make a request

1. Email privacy@lipaware.com with the subject line “Data request”, or use the form at lipaware.com/privacy-request. Say which right you want to use and which service it concerns.
2. Verify your identity. We reply within 2 working days asking you to confirm you are the account holder, usually by a code sent to the phone number or email we hold. We ask for an ID document only when we cannot verify you any other way, and we delete that copy once the request is closed.
3. We act on the request within the time in the table and confirm in writing what we did.
4. If we cannot fully comply, for example because the law requires us to keep transaction records for 7 years, we tell you which data we must keep, why, and until when. We stop using that data for any other purpose.

Someone can make a request on your behalf if they give us your written authority. If you are a customer of one of our clients, contact that client; see section 5.

Complaints

If you are unhappy with how we handled your data or your request, contact our Data Protection Officer at dpo@lipaware.com first; we aim to resolve complaints within 14 days. You can also complain directly to:

• Kenya: the Office of the Data Protection Commissioner, Britam Tower, 12th Floor, Hospital Road, Upper Hill, Nairobi.
• EEA or UK: the data protection authority in the country where you live or work, or where the issue happened.

11. Deleting your data and disconnecting integrations

You can ask us to delete your data at any time by emailing privacy@lipaware.com with the subject “Data deletion request”. To stop marketing emails, click “Unsubscribe” in any of them. We delete the data within 14 days and confirm by email.

Businesses that connected a messaging account, such as WhatsApp, can also disconnect it in the Lipaware portal or in Meta Business Settings. We then revoke our access and delete the stored credentials.

If you use a product offered by one of our clients, ask that client, which will instruct us to delete your data.

Records the law requires us to keep, such as KYC and transaction records, are kept for the required period, used for nothing else, and deleted when it ends. We tell you if this applies to your request. Step-by-step instructions are at lipaware.com/data-deletion.

12. Cookies

Our website uses strictly necessary cookies to run the site and keep it secure, and, only with your consent, analytics cookies to understand how it is used. You can accept, reject or change your choice at any time through the cookie banner. Our cookie policy lists each cookie, its purpose and how long it lasts.

13. Children

Our website and platform are for businesses and adults. We do not knowingly collect personal data from anyone under 18 except where a client offers a product for minors that the law allows, such as school fees payments. In that case the client is the controller and must obtain consent from a parent or guardian and verify their age. If you believe we hold a child’s data without that consent, contact privacy@lipaware.com and we will delete it.

14. Changes to this policy

We review this policy at least once a year. When we make a material change, we update the date at the top, post the new version here, and tell clients and registered users by email or in the portal at least 30 days before it takes effect. Previous versions are available on request.

15. Contact us