Cowrietech Limited is a private limited company incorporated in Kenya (Registration No. PVT-KAUZJ29), carrying on the business of software development and the provision of the SingularERP suite of cloud-based business applications. Our registered office is at Jahazi, Lavington, Nairobi, P.O. Box 49484-00100 GPO, Nairobi, Kenya. For the purposes of the Data Protection Act, 2019, Cowrietech is the data controller in respect of the Personal Data described in this Policy that we collect for our own purposes.
2.1 “Personal Data” means any information relating to an identified or identifiable natural person, as defined under the Data Protection Act, 2019.
2.2 “Sensitive Personal Data” means data revealing a person’s health, ethnic or racial origin, religious beliefs, biometric data, and other categories defined as sensitive under the Act.
2.3 “Data Controller” means a person who determines the purpose and means of processing Personal Data.
2.4 “Data Processor” means a person who processes Personal Data on behalf of a data controller.
2.5 “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
2.6 “Processing” means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, or erasure.
Depending on how you interact with us, we may collect the following categories of Personal Data when we act as a data controller:
Name, business name, job title, email address, telephone number, postal address, and login credentials when you register for or administer an account.
Billing details, M-Pesa or mobile money references, bank or payment information, subscription plan, invoices, and payment history. We do not store full payment card numbers; card payments, where offered, are handled by third-party payment processors.
Records of your correspondence with us, including support requests, enquiries, feedback, and the content of emails, calls, or messages exchanged with our team.
Information about how you access and use the Service, including IP address, device and browser type, log data, pages visited, time and date of access, and similar diagnostic data collected automatically.
Data collected through cookies and similar technologies on our website, as described in clause 9 below.
When acting as a data processor, we process Personal Data that our customers submit to the Service about their own data subjects (for example, employees, students, members, or customers). We process this data only as described in clause 11.
We process Personal Data for the following purposes, relying on the lawful bases set out below as required by the Data Protection Act, 2019:
| Purpose | Lawful Basis |
|---|---|
| To create and administer your account and provide the Service | Performance of a contract |
| To process payments, issue invoices, and manage billing | Performance of a contract; legal obligation |
| To provide customer support and respond to enquiries | Performance of a contract; legitimate interest |
| To maintain the security, integrity, and availability of the Service | Legitimate interest; legal obligation |
| To improve and develop our products and services | Legitimate interest |
| To send service-related and administrative communications | Performance of a contract; legitimate interest |
| To send marketing communications about our products | Consent; legitimate interest |
| To comply with legal, tax, and regulatory obligations | Legal obligation |
| To establish, exercise, or defend legal claims | Legitimate interest |
We do not sell, rent, or trade Personal Data. We may share Personal Data only in the following circumstances:
7.1 Personal Data is stored on cloud infrastructure which may be located within or outside Kenya. Where data is transferred outside Kenya, we take steps to ensure that an adequate level of protection is afforded to it, consistent with the requirements of the Data Protection Act, 2019.
7.2 Such safeguards may include ensuring the recipient country has commensurate data protection laws, or putting in place appropriate contractual data protection clauses with the recipient.
8.1 We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, tax, or reporting obligations.
8.2 Account and transaction data is generally retained for the duration of your subscription and for a reasonable period thereafter, in line with statutory retention requirements (including tax records, which Kenyan law generally requires to be kept for at least five years).
8.3 Where we act as a data processor, retention of Customer Data is governed by our agreement with the relevant customer. Following termination, Customer Data is handled as set out in our Terms of Service.
8.4 When Personal Data is no longer required, we securely delete, anonymise, or destroy it.
9.1 Our website and Service use cookies and similar technologies to enable core functionality, remember your preferences, maintain your session, and understand how the Service is used.
9.2 We use the following broad categories of cookies: strictly necessary cookies (required for the Service to function), functional cookies (to remember your settings), and analytics cookies (to understand usage and improve the Service).
9.3 You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.
Under the Data Protection Act, 2019, you have the following rights in relation to your Personal Data:
To exercise any of these rights, please contact us using the details in clause 16. We will respond within the timeframe required by law. Where we act as a data processor, requests should be directed to the relevant customer who is the data controller, and we will assist that customer in responding.
11.1 When our customers use the Service to process Personal Data about their own data subjects, the customer is the data controller and Cowrietech is the data processor.
11.2 In that capacity, we process Customer Data only on the documented instructions of the customer, for the purpose of providing the Service, and in accordance with our Terms of Service and any data processing terms agreed with the customer.
11.3 We implement appropriate technical and organisational measures to protect such data, assist customers in meeting their own obligations under the Act, and do not use Customer Data for our own independent purposes.
11.4 If you are a data subject of one of our customers and wish to exercise your rights, please contact that customer directly, as they are responsible for that data.
We implement appropriate technical and organisational security measures to protect Personal Data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include, among others:
While we take all reasonable steps to protect Personal Data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13.1 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we shall notify the Office of the Data Protection Commissioner and affected data subjects without undue delay, in accordance with the Data Protection Act, 2019.
13.2 Where we act as a data processor, we shall notify the relevant customer (data controller) without undue delay upon becoming aware of a breach affecting their Customer Data.
Certain products, such as our school management module, may involve the processing of data relating to children on behalf of educational institutions. Where this occurs, we act as a data processor on behalf of the institution, which is responsible for obtaining the necessary parental or guardian consent. We do not knowingly collect Personal Data directly from children for our own purposes.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be published on our website with its effective date. Where changes are material, we will take reasonable steps to notify you. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
If you have any questions, requests, or complaints regarding this Privacy Policy or our handling of your Personal Data, please contact us:
Cowrietech Limited
Attention: Data Protection Contact
Jahazi, Lavington, Nairobi
P.O. Box 49484-00100 GPO, Nairobi, Kenya
Email: privacy@cowrietech.com · Web: www.singularerp.com
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner if you believe your data protection rights have been infringed:
Office of the Data Protection Commissioner · Website: www.odpc.go.ke
This Privacy Policy should be read together with the SingularERP Terms of Service.