Privacy Policy

This Privacy Policy explains how Webpinn collects, uses, and protects personal data when you use the WebpinnPOS platform, in compliance with the Kenya Data Protection Act 2019. It covers two audiences: merchants and staff who use the platform, and guests who book appointments through a merchant's booking page.

AMerchant & User Account Data

A1. Data We Collect

• Registration data: Full name, email address, phone number, and hashed password.
• Business data: Shop name, subscription plan, product type (POS / Bookings / Both), and active add-ons.
• Transaction data: Sales records, inventory changes, expense logs, shift records, and M-Pesa payment references.
• Usage data: Login timestamps and IP addresses. Used only for security and platform improvement.
• Affiliate data: Referral codes, commission totals, and payout records.

A2. Why We Collect It

• To create and manage your account and subscription.
• To process M-Pesa subscription payments and send confirmations.
• To deliver platform features and operational communications (OTPs, expiry notices).
• To calculate and pay affiliate commissions.
• To comply with Kenyan tax and financial record-keeping obligations.

A3. Legal Basis

We process merchant account data under: contract performance (to deliver the Service you signed up for), legitimate interests (platform security and fraud prevention), and legal obligation (financial record retention).

A4. Data Sharing

We do not sell your personal data. We share it only with: Safaricom / M-Pesa (payment processing), Railway / cloud hosting (secure infrastructure), and transactional email providers (OTPs and notifications). All sub-processors are bound by data processing agreements.

A5. Retention

We retain account data while your account is active. After deletion or termination, data is retained for 90 days before permanent deletion. Except financial records retained for 7 years as required by Kenyan law.

BBooking Guest Data

B1. Controller vs. Processor

When you book an appointment through a merchant's WebpinnPOS booking page:

Data Controller

The merchant determines why your data is collected, manages your booking, and is responsible for their own privacy notice to you.

Data Processor

We process your booking data solely on behalf of and under instruction from the merchant, providing the scheduling engine and secure infrastructure.

B2. Guest Information Collected

• Display name. For check-in at the counter.
• Kenyan mobile phone. For M-Pesa deposit STK push and SMS reminders.
• Email address (optional). For booking confirmations and cancellation notices.
• Booking notes. Any optional service requests you add to the form.

B3. Retention & Right to Be Forgotten

Under the Kenya DPA 2019, you have the right to have your data erased. We implement this through:

Auto-anonymization: 12 months after a completed service, your name and phone are replaced with [anonymized] and your email is permanently deleted.

Manual request: Ask the merchant cashier to anonymize your contact details immediately after your service via the Bookings panel.

3Your Rights Under the Kenya DPA 2019

• Access. Request a copy of your personal data we hold.
• Rectification. Correct inaccurate data.
• Erasure. Request deletion of your personal data, subject to legal retention requirements.
• Objection. Object to processing based on legitimate interests.
• Portability. Receive your data in a structured, machine-readable format.

To exercise any right, contact us at privacy@webpinnpos.com. We will respond within 21 days.

4Security

We employ TLS encryption in transit, bcrypt password hashing, JWT token versioning to invalidate compromised sessions, Redis-backed rate limiting, and Helmet HTTP security headers. While we take every reasonable precaution, no system is entirely immune from risk.

5Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants via email or a platform notice at least 14 days before material changes take effect.

6Contact Us