Privacy Policy
How Luminai Tech Limited handles personal data in LuminaiPay, written to the Data Protection Act 2019. It covers both the data we decide the use of and the data we process on behalf of our clients — the difference matters, so it is marked throughout.
Last updated
1.Who we are, and in what capacity
Luminai Tech Limited builds and runs LuminaiPay, billing and collections infrastructure used by property, school, retail, gym and crowdfunding platforms. This policy explains what we do with personal data, and it is written to the Data Protection Act 2019.
We handle personal data in two different capacities, and almost everything below depends on which one applies:
- As a data controller for people who contact us, visit this website, or hold a staff account with one of our client businesses. Here we decide why and how the data is used, and this policy is our notice to you.
- As a data processorfor the payer data that flows through our clients’ platforms — the people being invoiced by a landlord, a school or a gym that uses LuminaiPay. There, our client is the controller, we act only on their documented instructions, and their own privacy notice governs the relationship.
If you are a tenant, parent, member or customer of a business that uses LuminaiPay, that business is your controller. You may still contact us and we will help, but we will normally pass your request to them.
2.What we collect as controller
When we decide the purpose ourselves, we hold:
- Enquiries. Your name, email address, and whatever you choose to write when you email us from the contact page or apply through the careers page. Job applications include the CV and any supporting material you send.
- Client relationship records. The names, business email addresses, telephone numbers and roles of the people at our client businesses who administer an account or sign an agreement.
- Account and authentication data. Usernames, hashed credentials, and records of logins and administrative actions taken in the platform.
- Billing records for our own fees. What we invoiced a client, when, and whether it was paid.
- Technical logs. IP addresses, timestamps, request paths and error traces produced by our servers, kept to keep the service secure and to work out what went wrong when something fails.
3.What we process on behalf of our clients
When a client configures LuminaiPay to bill and collect, personal data about their payers passes through the platform. Depending on what the client sends us, that can include:
- Names and account or reference identifiers such as a unit number, a student admission number or a membership number.
- Mobile telephone numbers, which mobile money collection requires, and email addresses where invoices are sent.
- Amounts invoiced and paid, due dates, arrears positions, payment status, and the transaction references returned by the gateway.
We process this only to carry out the instructions in our agreement with the client and their configuration of the platform. We do not sell it, we do not use it to market anything to payers, and we do not use it to build profiles of payers for our own purposes.
We do not receive, hold or settle payment funds, and we do not store full payment card numbers. Money moves between the payer and the client’s own gateway and merchant accounts. Card details, where cards are used, are collected and held by the gateway, not by us.
4.Our lawful bases
Section 30 of the Act requires a lawful basis for every processing operation. As controller, ours are:
| What we do | Basis |
|---|---|
| Answer an enquiry you send us | Steps at your request before entering a contract, and our legitimate interest in responding |
| Administer a client account and provide the platform | Performance of our contract with the client |
| Consider a job application | Steps at your request before entering a contract |
| Keep the service secure, investigate incidents | Our legitimate interest in the security and integrity of the platform |
| Keep tax, accounting and anti-money laundering records | Compliance with a legal obligation |
As processor, the lawful basis for processing payer data is the controller’s to establish, not ours. Our clients undertake in their contract with us that they have one.
6.Transfers outside Kenya
Personal data in LuminaiPay is processed in Kenya wherever the service allows it. Some of the infrastructure and software services we rely on operate outside Kenya, so a transfer may occur.
Sections 48 and 49 of the Act permit a transfer only where appropriate safeguards are in place, or where a specified condition applies. Where we transfer personal data out of Kenya we rely on contractual safeguards with the recipient that hold them to standards comparable to the Act, we transfer no more than the purpose needs, and where the data is sensitive personal data we confirm the further conditions in section 49 are met before doing so.
Clients can ask us which of their processing involves a transfer, and on what safeguard we rely.
7.How we protect it
Section 41 requires appropriate technical and organisational measures. The ones we apply include:
- Encryption of data in transit over public networks.
- Access control on a need-to-know basis, with individual accounts, no shared logins, and access withdrawn when a role ends.
- Separation of each client’s data, so one client’s platform cannot read another’s.
- Credentials and API keys stored hashed or in a secrets store, never in plain text and never in source control.
- Audit logging of administrative and financial actions, retained so an incident can be reconstructed.
- Backups, and restoration testing, so data can be recovered after a failure.
- Review of changes to the platform before they reach production.
We describe what we do rather than claim a certification we do not hold. No system is perfectly secure, and we do not promise one is.
8.How long we keep it
We keep personal data only as long as the purpose needs, then delete or anonymise it.
- Enquiries that do not become a relationship: up to twelve months, so we have context if you write again.
- Unsuccessful job applications: six months, unless you ask us to keep your details on file for future openings.
- Client account and relationship records: for the life of the agreement, then seven years, which is the period tax and company records must be kept under the Tax Procedures Act 2015 and the Companies Act 2015.
- Payer data we process for a client: for as long as the client instructs. On the end of their agreement it is available for export for thirty days, then deleted or anonymised, except where a law requires us to retain it.
- Technical and security logs: normally up to twelve months, longer where a log forms part of an ongoing investigation.
9.Your rights
Section 26 of the Act gives you the right:
- To be informed of the use to which your personal data is put — which is what this policy is for.
- Of access to the personal data we hold about you.
- To object to the processing of your personal data, in whole or in part.
- To correction of false or misleading data, and to deletion of false or misleading data about you.
- To data portability, where the processing is carried out by automated means.
To exercise any of these, use the data protection route on our contact page or email info@luminaipay.com. We answer without undue delay and within the period the Act allows. We do not charge for a request unless it is manifestly unfounded or excessive, and we will say so before charging anything.
We may need to verify your identity first — a request granted to the wrong person is itself a breach. We will ask for no more than is needed to be sure.
Where the data is held for a client, we are the processor and cannot decide the request ourselves. We will pass it to that controller without delay, tell you we have done so, and assist them in responding.
10.If something goes wrong
Where a personal data breach presents a real risk to the rights and freedoms of the people affected, section 43 of the Act requires us to notify the Data Commissioner within seventy-two hours of becoming aware, where feasible, and to communicate with the affected data subjects in writing. Where we act as processor, we notify the controller without undue delay so they can meet their own obligations, and we help them do so. We keep a record of every breach, including those we conclude are not notifiable, and what we did about it.
12.Children
LuminaiPay is a business product and is not directed at children. Some of our clients — schools in particular — hold data about children, and where that data reaches the platform we process it only as their processor, under their instructions and their lawful basis. Section 33 of the Act places the obligation to obtain parental consent, and to act in the best interests of the child, on the controller. We do not knowingly collect data from a child in our own right.
13.Complaints
If you are unhappy with how we have handled your personal data, tell us first and we will try to put it right. Write to info@luminaipay.com.
You also have the right to complain to the Office of the Data Protection Commissioner, which supervises compliance with the Act in Kenya, at any time. You do not have to come to us first.
14.Changes to this policy
We update this policy when what we do changes, or when the law does. The current version is always on this page with the date it took effect. Where a change materially affects how we use personal data about you, we will tell you rather than rely on you noticing.
15.Contacting us
The data controller is Luminai Tech Limited. Questions about this policy, and requests under it, go to info@luminaipay.com, or through the contact page.
Our terms of service set out the contractual side of the same relationship, including when a separate data processing agreement applies.