Privacy Notice

Effective: 28 April 2026 · Aligned with Kenya Data Protection Act 2019

This Notice explains how BomaOS handles personal data when you visit our website, contact us, or use the platform we operate on behalf of a SACCO. We aim for plain language. If anything is unclear, write to us — contact details at the bottom.

1. Who is the data controller?

For visitors to www.bomaos.app and prospects who contact us, BomaOS is the data controller. ODPC data controller registration is in process.

For members of a SACCO that runs on BomaOS software, the SACCO is the data controller and BomaOS acts as their data processor. The SACCO's own privacy notice governs how member data is collected and used. This page describes only the marketing site and prospect contact.

2. What we collect

From visitors to this site

Server logs — IP address, browser user-agent, page URL, timestamp. Standard web-server logs, retained 30 days.
No tracking cookies. We do not use Google Analytics, Facebook Pixel, Hotjar, or any third-party tracker. The site loads Google Fonts via Google's CDN; Google's own privacy policy applies to that request.

When you contact us

Email address, name, phone (if you share it), and the content of your message.
Used only to respond to your enquiry, send follow-up information you asked for, and (with your consent) keep you informed about BomaOS.

3. Why we process it (lawful basis)

Legitimate interest — running and securing our website, responding to your enquiries.
Consent — for marketing follow-up beyond responding to your enquiry. You can withdraw consent at any time by emailing us.
Legal obligation — where required to keep records or respond to lawful requests.

4. Who we share it with

We do not sell personal data. We share only with these processors, each of whom processes data on our written instructions:

Hosting — Hetzner Online GmbH (EU). Marketing site hosted on Vercel (US/EU edge).
Email — our mail provider for sending and receiving correspondence.

We may disclose data if compelled by lawful court order or regulatory authority. We will notify you where the law permits.

5. How long we keep it

Server logs — 30 days.
Enquiry correspondence — up to 24 months from last contact, then deleted unless you become a customer.
Customer records — for the duration of the contract plus 7 years for tax and audit purposes.

6. Your rights under DPA 2019

If we hold personal data about you, you have the right to:

Be informed about how we use your data (this Notice).
Access a copy of your data.
Correct inaccurate data.
Ask us to delete your data, subject to legal retention.
Object to or restrict processing.
Withdraw consent where consent is the lawful basis.
Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

To exercise any of these rights, email info@bomaos.app with the subject "Data Subject Request". We will respond within 30 days.

7. Cookies

We use no third-party tracking cookies on this site. The site may set a small functional entry in your browser's local storage to remember that you have seen and dismissed our consent notice. Clearing your browser storage removes it.

8. Cross-border transfers

Marketing-site infrastructure is located in the European Union (Hetzner) and on Vercel's global edge. Where data is transferred outside Kenya, we rely on the recipient operating under a regime that provides adequate data protection (e.g. EU GDPR), or contractual safeguards with the processor.

9. Children

Our website and platform are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted to us, contact us and we will delete it.

10. Changes to this Notice

We will publish a new "Effective" date when this Notice changes materially. For substantial changes, we will also email anyone in active correspondence with us at the time.

11. Contact

BomaOS
Email: info@bomaos.app
Postal address: published once ODPC registration is complete
ODPC complaint: odpc.go.ke