Privacy Policy

1. Introduction & Regulatory Framework

FLOYNEX DIGITAL TECHNOLOGIES LTD ("Floynex", "Company", "we", "us", or "our") is committed to protecting the personal data of our users. This Privacy Policy is formulated in strict compliance with the **Laws of the Republic of Kenya**, including the **Kenya Data Protection Act (2019)** and guidelines set by the Office of the Data Protection Commissioner (**ODPC**). By registering an account, you consent to the data practices described herein.

2. Information We Collect

To provide automated ledger services, M-Pesa integrations, and secure account switches, we collect the following categories of information:

• **Identification and Contact Data:** Your official government-issued ID/Passport names, phone numbers associated with your Safaricom M-Pesa account, and your corporate registration names if you toggle to a Business Profile.
• **Financial and Transactional Data:** Account ledger balance metrics, wallet-to-wallet transfer histories, M-Pesa transaction IDs, STK Push transaction logs, and B2C payout callbacks.
• **Device and Technical Information:** IP addresses, unique device identifiers, operating system logs (desktop web application and mobile application instances), and diagnostic technical data.
• **In-App Communication Logs:** Transmissions, reads, and logs of alerts, warnings, and maintenance updates sent via the Admin Panel into your internal system Inbox.

3. How We Use Your Data

Floynex processes your information strictly for the following lawful reasons:

• To initiate automated M-Pesa STK Push triggers, manage our single shortcode Paybill gateway, and process automated B2C payout execution.
• To manage internal database ledger logic for wallet-to-wallet instant asset movement.
• To facilitate the in-app account profile toggle, altering your transaction visibility from personal government identities to commercial trade names seamlessly.
• To push mandatory security warnings, maintenance alerts, and system emergency notes into your user Inbox.
• To ensure compliance with local Anti-Money Laundering (AML) policies and the Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) of Kenya.

4. QR Codes and Local Device Operations

Our application requests permissions to use device features to display or download QR codes and support copy-and-paste buttons. When you scan a QR code within the ecosystem to execute a transfer, our application reads the code locally to auto-type the recipient's account details. We do not store your device's raw camera imagery on our central servers; scanning events are handled natively on your device to dynamically generate text entries for ledger validation.

5. Data Sharing and Third-Party Disclosures

We do not sell your personal data. We only share information with third parties under the following strict conditions:

• **Safaricom M-Pesa (Daraja Live APIs):** Shared securely to process validation checks, handle callbacks, run STK pushes, or complete Business B2C transfers.
• **Legal & Regulatory Authorities:** When legally requested by the Central Bank of Kenya (CBK), the Kenya Revenue Authority (KRA), law enforcement agencies, or the ODPC under statutory mandates.
• **Service Providers:** Secure third-party cloud hosting servers and transactional infrastructure partners who are legally bound to uphold identical data isolation standards.

6. Data Retention

In alignment with Kenyan financial regulations and statutory standards, Floynex stores your core financial transactions, KYC records, and profile history for a mandatory minimum period of seven (7) years following account deletion or system inactivity. This historical data is archived securely to handle future regulatory audits, dispute resolution windows, and legal compliance workflows.

7. Data Security Safeguards

We implement robust administrative, logical, and technical protection measures to insulate your data against unauthorized access, hacking, data leaks, or unauthorized modification. All communication traffic between our mobile clients, desktop web app portals, and active API databases is fully encrypted using Transport Layer Security (TLS/HTTPS).

8. Your Rights Under the Kenya Data Protection Act

Subject to certain statutory financial limitations, you hold the following rights regarding your data under the Kenyan ODPC frameworks:

• The right to be informed of how your data is collected and processed.
• The right to access your stored personal information and download historical transaction ledger summaries.
• The right to request immediate correction of inaccurate profile text or out-of-date corporate names.
• The right to object to or restrict processing under specific personal contexts.
• The right to request erasure of non-financial data ("Right to be Forgotten"), subject to our legal 7-year retention requirements.

9. Mobile App Stores and Third-Party Compliance

Our mobile deployment instances on the Google Play Store and Apple App Store require explicit collection declarations. This policy serves as your transparent warning regarding device diagnostic collection, operating system version identification, and platform feature requests necessary to support account link sharing, clipping tools, and camera scans.

10. Changes to This Privacy Policy

Floynex reserves the right to modify or replace this Privacy Policy at any time. Any changes will be posted openly on this URL with an updated revision date. Critical updates concerning data handling laws will be sent directly to your in-app system Inbox, which you agree to review continuously.

11. Contact Our Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise your legal data rights, or need to file a formal request regarding your information, please contact our Compliance and Data Protection team at:

**Email:** compliance@floynexpay.com
**Corporate Office:** FLOYNEX DIGITAL TECHNOLOGIES LTD, Kenya.