Privacy Policy

1. Introduction & Regulatory Framework

FLOYNEX DIGITAL TECHNOLOGIES LTD ("Floynex", "Company", "we", "us", or "our") operates **Floynex Pay**, a secure digital wallet and financial infrastructure platform in Kenya. This Privacy Policy is formulated in strict compliance with the **Laws of the Republic of Kenya**, including the **Kenya Data Protection Act (2019)** and guidelines set by the Office of the Data Protection Commissioner (**ODPC**). By registering an account, you consent to the data practices described herein.

2. Information We Collect

To provide digital wallet infrastructure, unique account IDs (MSF format followed by 8 digits, e.g., MSF12345678), M-Pesa C2B Paybill integrations, and secure ledger management, we collect the following categories of information:

• Identification, Contact & Location Data: Your first name, last name, email address, phone number associated with your Safaricom M-Pesa account, business name, country, county, town, and operational area.
• KYC Identity & Document Verification Data: Your official government-issued ID/passport numbers, document types, and digital image file uploads of your ID/passport (both front and back screenshots) used to verify wallet ownership and authenticate your identity.
• Financial, Wallet & Transactional Data: Your unique Floynex wallet account number (formatted as "MSF" followed by 8 digits, such as MSF12345678), ledger balance metrics, wallet-to-wallet (W2W) transfer histories, M-Pesa C2B Paybill deposit logs (via Paybill Business Number 4050385), STK push transaction records, B2C payout logs, and physical agent withdrawal histories.
• Device and Technical Information: IP addresses, unique device identifiers, operating system logs (desktop web application and mobile application instances), and diagnostic technical data.
• In-App Communication Logs: Transmissions, reads, and logs of alerts, warnings, and maintenance updates sent via the Admin Panel into your internal system Inbox.

3. How We Use Your Data & Purpose of KYC

Floynex processes your information strictly for the following lawful reasons:

• Know Your Customer (KYC) & Crime Prevention: We collect and verify your real identity details, ID numbers, and front/back document screenshots to ensure users are real persons, protect the financial platform against fraud, meet statutory compliance, and maintain clear traceability in the event of any unlawful activity or security investigations related to wallet transactions.
• To issue and manage unique digital wallet accounts (MSF followed by 8 digits).
• To process M-Pesa C2B Paybill automated deposits when funds are paid to Business Number 4050385 using your wallet account as the account number.
• To initiate automated M-Pesa STK Push deposit requests, handle peer-to-peer (P2P) transfers, and process payouts or agent withdrawals.
• To manage internal database ledger logic for instant asset movement and generate transaction summaries.
• To push mandatory security warnings, maintenance alerts, and system emergency notes into your user Inbox.
• To ensure compliance with local Anti-Money Laundering (AML) policies and the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) of Kenya.

4. QR Codes and Local Device Operations

Our application requests permissions to use device features to display or download QR codes and support copy-and-paste buttons. When you scan a QR code within the ecosystem to execute a transfer, our application reads the code locally to auto-type the recipient's account details. We do not store your device's raw camera imagery on our central servers; scanning events are handled natively on your device to dynamically generate text entries for ledger validation.

5. Data Sharing and Third-Party Disclosures

We do not sell your personal data. We only share information with third parties under the following strict conditions:

• Safaricom M-Pesa (Daraja Live APIs): Shared securely to process validation and confirmation callbacks for C2B Paybill transactions (Business Number 4050385), run STK pushes, or complete Business B2C transfers.
• Legal & Regulatory Authorities: When legally requested by the Central Bank of Kenya (CBK), the Kenya Revenue Authority (KRA), law enforcement agencies, or the ODPC under statutory mandates.
• Service Providers: Secure third-party cloud hosting servers and transactional infrastructure partners who are legally bound to uphold identical data isolation standards.

6. Data Retention

In alignment with Kenyan financial regulations and statutory standards, Floynex stores your core financial transactions, KYC records, and profile history for a mandatory minimum period of seven (7) years following account deletion or system inactivity. This historical data is archived securely to handle future regulatory audits, dispute resolution windows, and legal compliance workflows.

7. Data Security Safeguards

We implement robust administrative, logical, and technical protection measures to insulate your data against unauthorized access, hacking, data leaks, or unauthorized modification. All communication traffic between our mobile clients, desktop web app portals, and active API databases is fully encrypted using Transport Layer Security (TLS/HTTPS). Additionally, sensitive user records are protected via database-level encryption at rest, field-level data encryption, and industry-standard bcrypt hashing for passwords and transaction PINs.

8. Your Rights Under the Kenya Data Protection Act

Subject to certain statutory financial limitations, you hold the following rights regarding your data under the Kenyan ODPC frameworks:

• The right to be informed of how your data is collected and processed.
• The right to access your stored personal information and download historical transaction ledger summaries.
• The right to request immediate correction of inaccurate profile text or out-of-date corporate names.
• The right to object to or restrict processing under specific personal contexts.
• The right to request erasure of non-financial data ("Right to be Forgotten"), subject to our legal 7-year retention requirements.

9. Mobile App Stores and Third-Party Compliance

Our mobile deployment instances on the Google Play Store and Apple App Store require explicit collection declarations. This policy serves as your transparent warning regarding device diagnostic collection, operating system version identification, and platform feature requests necessary to support account link sharing, clipping tools, and camera scans.

10. Changes to This Privacy Policy

Floynex reserves the right to modify or replace this Privacy Policy at any time. Any changes will be posted openly on this URL with an updated revision date. Critical updates concerning data handling laws will be sent directly to your in-app system Inbox, which you agree to review continuously.

11. Contact Our Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your legal data rights, or need to file a formal request regarding your information, please contact our Compliance and Data Protection team at:

Email: info@floynexapp.com
Corporate Office: FLOYNEX DIGITAL TECHNOLOGIES LTD.