Privacy notice
Last updated: 4 August 2026 | Compliant with the Kenya Data Protection Act, 2019
Data controller
Knozii Limited, Nairobi, Kenya.
Data Protection Officer: dpo@knomart.com (response within 7 days).
What we collect and why
| Data | Why | Retention |
|---|---|---|
| Owner name, phone, email | Account creation, login, support | Until account closure + 60 days |
| Business name, location | Tenant setup, agent territory | Until account closure + 60 days |
| Staff names, phones, PINs | Login, role assignment, audit trail | Until removed by owner or closure |
| Business records (washes, payments, etc.) | The service you are paying for | Until account closure + 60 days |
| Device ID, app version | Sync, debugging, security | 90 days after last sync |
| M-Pesa transaction references | Payment reconciliation, refunds | 7 years (tax compliance) |
| Agent code | Commission attribution | Duration of agent relationship |
What we never do
- Sell or share your data with advertisers or data brokers.
- Use your records to train AI or machine-learning models.
- Allow your agent to see your money totals or financial records.
- Store passwords in plain text. PINs are hashed and cannot be read by anyone, including us.
Who can see your data
- You (the owner) see everything in your business.
- Managers see one app's data. Supervisors see today only. Attendants see only their own work.
- Your agent sees sync status and whether you need help. They cannot see money or records.
- Knomart support staff can access your data for support purposes, logged and audited.
- No one else.
Your rights
Under the Kenya Data Protection Act, you have the right to:
- Access all data we hold about you (export at any time).
- Correct inaccurate data (corrections are append-only; the original is kept for audit).
- Delete your account and all data (request via WhatsApp or email; completed within 30 days).
- Port your data (exported as spreadsheet).
- Object to processing (contact the DPO).
Where your data is stored
Your data is stored on servers in Amsterdam (DigitalOcean). Backups are encrypted. We do not transfer data outside of the infrastructure required to run the service.
Cookies
We use two cookies: knomart_db (routes you to your business database) and session_id (keeps you logged in). Both are functional, not tracking. We do not use analytics cookies.
Changes
Material changes to this notice are communicated 14 days in advance via SMS or WhatsApp.
Data Protection Officer: dpo@knomart.com | WhatsApp: +254 799 233236
Office of the Data Protection Commissioner: www.odpc.go.ke