Data processing terms

Version 2026-11-03 · Last updated 3 November 2026

These terms form part of our Terms of service. They cover the personal information about your customers, suppliers and other contacts that you store in Shopnasi ("your customer data"). For this information you are the data controller and Kennivate Technologies (the provider of Shopnasi) is your data processor under the Kenya Data Protection Act, 2019.

1. What we do with your customer data

• We process it only to run Shopnasi for you and only on your instructions. The way you use the service is your instruction.
• We don't sell it, use it for our own marketing, or contact your customers ourselves, except emails you send through the service (such as invoices, receipts and campaigns).
• If a legal request requires us to hand it over, we will tell you first unless the law forbids it.

2. Your responsibilities

• Have a lawful reason to collect and use your customers' information, and tell them how you use it (for example in your shop's privacy notice).
• Only send marketing emails to people who agreed or are your genuine customers, and respect unsubscribes.
• Answer your customers' requests to see, correct or delete their information. The tools in Shopnasi let you do this.

3. People who can access it

Only staff who need to, bound by confidentiality, and only to run or support the service. Support visits to your account are view-only, short and recorded; when you ask us to make changes for you, the owner is emailed first and every change is recorded in your activity log.

4. Our providers (sub-processors)

We use the providers listed in our Privacy policy (hosting, email delivery, payments, notifications, security). Each is bound to protect the information. We will tell you before adding a new provider that handles your customer data, so you can object.

5. Security

We protect your customer data with encrypted connections, access controls within each business, encrypted secrets, regular backups and activity logs.

6. If something goes wrong

If we learn of a breach affecting your customer data, we will tell you without undue delay with the details we have, so you can meet your own duty to notify the regulator and the people affected.

7. Helping you

We will reasonably help you answer your customers' requests, carry out data protection assessments, and deal with the regulator about how we process your customer data.

8. When your account ends

You can export your data at any time. When the business is closed, your customer data is deleted after the 30-day period to change your mind and removed from backups within 14 days after that.

9. Contact

Kennivate Technologies (the provider of Shopnasi), Nairobi, Kenya. Email: privacy@shopnasi.co.ke.