GDPR – BizTrack

1Does GDPR Apply to BizTrack?

🇪🇺

The EU General Data Protection Regulation (GDPR) directly applies to organisations established in the EU/EEA, or to organisations outside the EU that offer goods or services to EU residents or monitor their behaviour.

BizTrack is a Kenyan company serving primarily Kenyan and East African businesses. Our primary legal framework is the Kenya Data Protection Act, 2019 (KDPA), enforced by the Office of the Data Protection Commissioner (ODPC).

However, if you are an EU or EEA resident using BizTrack, we voluntarily extend GDPR-equivalent rights to you because we believe everyone deserves strong data protection regardless of geography. The rights described in Section 4 apply to all BizTrack users.

2Our Data Protection Principles

Whether under GDPR or the Kenya DPA, BizTrack adheres to the same core principles:

Lawfulness, fairness, and transparency — we process data only where we have a lawful basis, and we are transparent about what we collect and why
Purpose limitation — data collected for one purpose is not repurposed without notice and fresh consent
Data minimisation — we collect only what is necessary for the stated purpose
Accuracy — we maintain accurate records and enable you to correct errors
Storage limitation — we retain data only as long as necessary or legally required
Integrity and confidentiality — data is protected with appropriate technical and organisational measures
Accountability — we can demonstrate compliance with these principles

3Lawful Bases for Processing

We rely on the following lawful bases (under both GDPR Art. 6 and KDPA Section 30):

Processing Activity	GDPR Basis	KDPA Basis
Account creation and management	Contract (Art. 6(1)(b))	Contract performance
Processing sales and expenses	Contract (Art. 6(1)(b))	Contract performance
M-Pesa payment processing	Contract (Art. 6(1)(b))	Contract performance
Credit scoring (opt-in)	Consent (Art. 6(1)(a))	Consent
Marketing communications	Consent / Legitimate interest	Consent / Legitimate interest
Fraud detection and security	Legitimate interest (Art. 6(1)(f))	Legitimate interest
Legal and regulatory compliance	Legal obligation (Art. 6(1)(c))	Legal obligation
Anonymised analytics	Legitimate interest (Art. 6(1)(f))	Legitimate interest

4Your Rights

All BizTrack users — regardless of location — may exercise the following rights:

Right of Access

Request a copy of all personal data we hold about you in a readable format.

Right to Rectification

Ask us to correct any inaccurate or incomplete personal data we hold.

Right to Erasure

Request deletion of your data, subject to legal retention obligations.

Right to Restrict

Ask us to temporarily stop processing your data while a dispute is resolved.

Right to Portability

Receive your data in a machine-readable format (CSV/JSON) to transfer elsewhere.

Right to Object

Object to processing based on legitimate interest, including direct marketing.

Withdraw Consent

Where processing relies on consent, withdraw it at any time — future processing stops immediately.

Automated Decisions

Request human review of any automated decision (e.g. credit scoring) that significantly affects you.

To exercise any right, email privacy@biztracksme.com. We will respond within 30 days. We may request identity verification. EU users who are unsatisfied with our response may lodge a complaint with their national data protection authority.

5Kenya Data Protection Act 2019

The KDPA is Kenya's primary data protection law, modelled closely on GDPR. It established the Office of the Data Protection Commissioner (ODPC) as the regulatory authority.

BizTrack's compliance includes:

Registration with the ODPC as a Data Controller
Maintaining a Data Processing Register documenting all processing activities
Conducting Data Protection Impact Assessments (DPIAs) for high-risk processing
Notifying the ODPC of data breaches within 72 hours
Appointing a Data Protection Officer (DPO)

For complaints under Kenyan law, contact the ODPC at odpc.go.ke or call +254 20 228 6000.

6International Data Transfers

BizTrack's primary data storage is in Kenya. Some third-party processors (cloud infrastructure, email delivery) may be based outside Kenya or the EU.

For any international transfers, we ensure:

Transfers are only to countries with adequate data protection frameworks, or
Standard Contractual Clauses (SCCs) are in place with processors, or
The processor holds recognised certifications (ISO 27001, SOC 2 Type II)

EU users: transfers outside the EEA are governed by GDPR Chapter V safeguards including SCCs approved by the European Commission.

7Data Protection Officer

BizTrack has appointed a Data Protection Officer (DPO) responsible for overseeing our compliance with the KDPA, GDPR (where applicable), and all other applicable data protection laws.

The DPO can be contacted directly at dpo@biztracksme.com for any data protection enquiries, rights requests, or compliance questions.

8Data Breach Response

In the event of a personal data breach, BizTrack will:

Notify the ODPC within 72 hours of becoming aware of the breach (KDPA requirement)
Notify affected users without undue delay where the breach is likely to result in high risk to their rights
Provide details of the nature of the breach, data affected, likely consequences, and steps taken
Document all breaches in our internal breach register regardless of whether notification is required

To report a suspected security incident involving your data, email security@biztracksme.com immediately.

9Contact

Data Protection & GDPR Enquiries

DPO: dpo@biztracksme.com

Privacy team: privacy@biztracksme.com

BizTrack Technologies Limited · BizTrack House, Westlands, Nairobi

GDPR & Data Protection

BizTrack Support