1. Who we are
DomiTech Solutions (“we”, “us”, “our”) operates DomiTech POS, a cloud point of sale system for businesses in Kenya. Our registered address is Nairobi, Kenya.
For the purposes of the Data Protection Act, 2019, we act as a data controller for the personal data of our own account holders, and as a data processor for personal data that you enter into the system about your customers, employees and suppliers. You remain the controller of that data and are responsible for having a lawful basis to collect it.
Questions about this policy or your data go to privacy@domitechpos.co.ke or 0727 925 557.
2. What we collect
| Category | Examples | Why we need it |
|---|---|---|
| Account data | Your full name, username, email address, phone number, password (stored hashed) | To create and secure your account and to contact you about your service |
| Business data | Business name, branch name, business address, business phone and email | To configure your branches, print your details on receipts and invoices, and bill you |
| Transaction data | Sales, stock movements, purchases, expenses, invoices, credit records | This is the service itself — the records you create by using the POS |
| Your customers' and suppliers' data | Names, phone numbers, balances owed, purchase history that you enter | Processed on your behalf and under your instruction |
| Technical data | IP address, login timestamps, actions recorded in the activity log, browser type | Security, fraud prevention, troubleshooting and audit trails |
| Payment data | Subscription payment references and receipts | To confirm payment and keep accounting records required by law |
We do not knowingly collect data from children, and the service is not directed at anyone under 18.
3. Our lawful basis for processing
- Performance of a contract — to deliver the POS service you have signed up for.
- Legal obligation — to keep tax, accounting and transaction records as required by Kenyan law.
- Legitimate interest — to keep the platform secure, prevent fraud and improve the product.
- Consent — for any marketing communication, which you can withdraw at any time.
4. How we use your data
- To create, authenticate and secure your account and your branch users.
- To process sales, inventory, credit, supplier and expense records you enter.
- To generate the reports, invoices, receipts and VAT summaries you request.
- To provide support, setup, product loading and training.
- To notify you about billing, downtime, security issues and material changes to the service.
- To detect, investigate and prevent fraud, unauthorised access and misuse.
- To produce aggregated, anonymised statistics that cannot identify you or your business.
What we never do. We do not sell your data. We do not rent, trade or disclose your customer lists to advertisers, marketers or data brokers. We do not use your sales figures to benefit a competitor. We do not read your business data except where you ask us to for support, or where we are legally compelled to.
5. Who we share data with
We share personal data only with:
- Hosting and infrastructure providers who store the platform's data under contract and confidentiality obligations.
- Payment and mobile money providers, to the extent needed to confirm a subscription payment.
- Professional advisers such as auditors and lawyers, bound by confidentiality.
- Public authorities, including the Kenya Revenue Authority, courts or law enforcement, where we are legally required to disclose.
- A successor entity, if our business is sold or merged, with notice given to you beforehand.
6. Where your data is stored
Data is stored on secured servers. Where a hosting provider stores or backs up data outside Kenya, we take steps to ensure the transfer meets the conditions set out in sections 48 and 49 of the Data Protection Act, 2019, including appropriate contractual safeguards.
7. How long we keep it
- Active accounts — for as long as your account is open.
- After you close or cancel — your data is retained for a grace period so you can reactivate or request an export, then deleted or anonymised.
- Financial and transaction records — retained for up to 7 years where tax and accounting law requires it.
- Security and audit logs — retained for a limited period for fraud prevention.
8. How we protect it
- Passwords are stored hashed, never in readable form.
- Access is controlled by user roles, so a cashier cannot see owner-level reports.
- Every login and significant action is written to an activity log.
- Data is backed up automatically, and backups are protected to the same standard as live data.
- Staff access to customer data is limited to what is needed for support and is subject to confidentiality obligations.
9. Your rights
Under the Data Protection Act, 2019 you have the right to be told how your data is used, to access it, correct it, request deletion, object to processing, receive it in a portable format, and withdraw consent to marketing at any time.
To exercise any of these, email privacy@domitechpos.co.ke.
10. Requests about your own customers' data
If one of your customers asks about data held in your DomiTech POS account, that request belongs to you as the controller. Forward it to us and we will support you in responding.
11. Cookies
We use a session cookie to keep you logged in securely. This is strictly necessary for the service to function. We do not use advertising or cross-site tracking cookies.
12. Complaints
If you believe we have mishandled your data, contact us first at privacy@domitechpos.co.ke. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.
13. Changes to this policy
We may update this policy as the service or the law changes. The version date at the top of this page always reflects the current version.
14. Contact us
DomiTech Solutions
Nairobi, Kenya
Email: privacy@domitechpos.co.ke
Phone: 0727 925 557