Privacy Policy
Last updated: 28 September 2026
1. Introduction
Akoto Technologies Group Limited, trading as Akoto Group Limited ("we", "us"), operates AkotoPOS, a Point of Sale and business management platform. This Privacy Policy explains what data we collect, why, where it is kept and who else sees it, in line with the Kenya Data Protection Act, 2019 and the regulations of the Office of the Data Protection Commissioner (ODPC).
For the business records you keep in AkotoPOS — your sales, your customers, your staff — your business is the data controller and we process that data on your behalf. For your own account details, we are the controller.
2. Data We Collect
2.1 Business and account information
- Business name, address, phone number, email and KRA PIN
- Owner and staff names, phone numbers, email addresses, and a hashed password or PIN (we never store the password itself)
- Your M-Pesa Till or PayBill number, and details you give when asking us to connect M-Pesa
2.2 Records you keep in AkotoPOS
- Sales, receipts, returns, payments and balances still owed, including which staff member and which till recorded them
- M-Pesa payment details (phone number, amount, M-Pesa receipt number) where Safaricom sends them to us
- Products, stock, suppliers, purchase orders, expenses and cash movements
- Customer names, phone numbers and loyalty points, and an ID number only if you choose to record one
- Staff pay records, if you use payroll: wages and deductions, and national ID number and KRA PIN where you enter them
2.3 Technical data
- IP address and device information, recorded in the audit log of actions taken in your account
- Error reports, so we can find and fix faults
3. How We Use Your Data
- Running the service: record sales, track stock, produce your reports and exports
- M-Pesa: send payment prompts and receive payment confirmations through Safaricom's Daraja API, where your shop has it set up
- KRA eTIMS: send your sales invoices to KRA, where your business has eTIMS set up
- Messages to you: account emails, and the low-stock alerts and daily summaries you switch on. We do not send receipts to your customers by SMS or email.
- Security and support: keep an audit trail, investigate problems you report, and prevent misuse
- Billing: collect your AkotoPOS subscription by M-Pesa
We do not use your data for advertising and we do not sell it.
4. Legal Basis for Processing
Under the Kenya Data Protection Act, 2019, we process your data based on:
- Contract: processing is necessary to provide the service you signed up for
- Legal obligation: tax records must be kept, and eTIMS invoices are required by Kenyan tax law
- Legitimate interest: security, fraud prevention and fixing faults
- Consent: for optional messages such as SMS summaries, which you can switch off
5. Who Else Handles Your Data
We share data only with the services needed to run AkotoPOS:
- Namecheap: hosts the servers that run AkotoPOS and store its data
- Safaricom: phone numbers and amounts for M-Pesa payments
- Kenya Revenue Authority: invoice data for eTIMS (only if you use eTIMS)
- Amazon Web Services (Amazon SES): delivers our emails to you
- Africa's Talking: phone numbers for SMS (only if you switch SMS on)
Namecheap's servers and Amazon SES are outside Kenya, in the United States, so your data is transferred there; we use them because they protect it, as the Kenya Data Protection Act requires. Each business can see only its own records.
We may also disclose data where Kenyan law or a court order requires it.
7. Your Rights (Kenya DPA 2019)
Under the Kenya Data Protection Act, you have the right to:
- Access: ask for a copy of the data we hold about you
- Rectification: correct inaccurate data
- Deletion: ask us to delete your data, subject to the records the law requires us to keep (section 8)
- Portability: export your data — products, sales, customers and expenses download as CSV from the dashboard, and we will send a full export of your business on request
- Object: object to processing, including any marketing
- Withdraw consent: where we rely on consent, at any time (this does not affect earlier processing)
To use any of these rights, email hello@akotogrouplimited.com. Customers and staff of a shop that uses AkotoPOS should contact that shop first, since the shop decides what it records about them.
8. How Long We Keep Data
- We keep your data for as long as your account is open.
- Sales, tax and payment records are kept for at least 5 years, as the Tax Procedures Act, 2015 requires — including after an account is closed.
- When you close your account, we deactivate it and, on request, send you a full export. Data the law does not require us to keep is deleted on request.
- Encrypted database backups are kept for 14 days and then deleted.
9. Children's Privacy
AkotoPOS is intended for business use by people aged 18 and above. We do not knowingly collect data from minors.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or the law. Material changes will be communicated by email or dashboard notice at least 14 days before they take effect.
11. Data Protection Officer
For any privacy concern, or to use your data rights, contact:
Data Protection Officer
Akoto Technologies Group Limited (trading as Akoto Group Limited)
Email: hello@akotogrouplimited.com
Kenya
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at complaints@odpc.go.ke.