Privacy Policy

1.Who is responsible for the data

Lucent Ledger holds two kinds of personal data. About the people who sign in, we decide why and how it is used, so we are the data controller. About the tenants, customers, suppliers and staff of our customers, which our customers put into Lucent Ledger, the customer decides why and how it is used and is the data controller; we are the data processor and act on the customer's instructions. If you are a tenant, customer or supplier of one of our customers and want to see or correct your data, ask that business first.

2.What we collect

Depending on how you use Lucent Ledger, we handle:

• Account data: your name, email address, role, and the organisation you belong to.
• Sign-in data: whether you signed in with Google or a password, when, and your IP address and browser details. For a password, only a one-way hash is kept, never the password itself.
• Proof of acceptance: each time you accept the Terms of Service and Privacy Policy we keep which version, how you signed in, the time, your IP address and your browser details.
• Records your organisation enters or imports: contacts and their phone numbers and addresses, invoices, payments, M-Pesa and bank statement lines (which can include names and phone numbers of payers), expenses, notes and messages.
• Usage and technical data: pages and features used, errors, and device and browser information, kept in logs to run and secure the service.
• Messages: the content and delivery status of SMS and email messages sent through the service.

3.Signing in with Google

When you choose Google sign-in, Google tells us your name, your email address and whether that address is verified. We use the email address, and only that, to find the account your administrator created for you. We do not receive your Google password, and we do not read your Gmail, Drive, contacts or any other Google data.

Google processes your sign-in under its own privacy policy. Signing in with Google does not create an account: you need one already.

4.How we use information

We use personal data to:

• provide, secure, support and improve the service, and sign you in;
• keep records of who accepted which terms, and when;
• send you service messages, such as security notices and changes to our terms;
• detect, investigate and prevent fraud, abuse and security incidents;
• meet our legal obligations and establish, exercise or defend legal claims.

5.Who we share information with

We do not sell personal data, and we do not use it for advertising.

We share it only with: service providers who help us run the service (hosting, database, logging, SMS and email delivery, Google for sign-in), who may use it only for that purpose; the customer organisation whose account you belong to; professional advisers; and authorities, courts or other parties where the law requires or allows it, or to protect rights, safety or property. If we are bought or reorganised, data may pass to the new owner on the same terms.

Some providers are outside Kenya. Where data leaves Kenya we take steps to make sure it stays protected as the law requires.

6.Retention

We keep personal data for as long as the account is active and as long afterwards as we need it for the purposes above, including for legal, tax, accounting and dispute purposes. Records of accepted terms are kept for as long as they might be needed to answer a claim. Logs are kept for a limited time. When data is no longer needed it is deleted or anonymised, though backups may hold it for a further period.

7.Your rights

Under the Data Protection Act, 2019 you may ask to be told whether we hold personal data about you and to see it, to have wrong data corrected, to have data deleted or its use restricted where the law allows, to object to some uses, and to receive your data in a usable form. We may need to check who you are first, and some data we must keep by law. You may also complain to the Office of the Data Protection Commissioner of Kenya.

8.Security

We use reasonable technical and organisational measures to protect personal data, including encrypted connections, hashed passwords, access controls and logging. No system is completely secure, and we cannot guarantee that data will never be lost, accessed or disclosed without authority. You must keep your own sign-in details and devices safe. If a breach affects you we will tell you and the authorities as the law requires.

9.Cookies and similar technologies

We use cookies and browser storage that the service needs to work, such as keeping you signed in and remembering your settings. We do not use them for advertising.

10.Children

The service is for business use by adults. It is not meant for anyone under 18, and we do not knowingly collect their data.

11.Changes to this policy

We may update this policy. When we do, we will change its effective date, and you will be asked to accept the new version the next time you sign in.

12.Contact

To use your rights or ask a question about privacy, write to support@lucent-ledger.com.