Personal Information and Privacy Notice

M-PESA × AfriQuantum treats the responsible use of personal information as a core commitment. We handle data openly, for defined purposes and in line with applicable requirements, including the GDPR. This policy describes the information we gather, the reasons for processing it, retention periods and the measures used to protect it.

1. Responsibility for your information

For GDPR purposes, responsibility for your personal information rests with the website operator and the M-PESA × AfriQuantum platform. Our legal notice contains the relevant contact information and other details. You can also reach our data protection officer with any privacy enquiry.

2. Data we collect

We collect and use only the information necessary to provide services, meet legal responsibilities and protect the platform. This can include:

Identity details: first name, surname and date of birth, used to confirm identity and age.
Contact details: email address, supplied telephone number, country of residence and, where applicable, postal address.
Account and payment data: payment details, deposits, withdrawals and transaction history.
Technical and usage data: IP address, browser type, device information, sign-in times and connection logs.
Verification records: identity documents, proof of address and other materials required for KYC/AML procedures where relevant law applies.

We generally avoid collecting sensitive information, such as health data or religious beliefs, unless the law calls for it or you have provided explicit permission.

3. How information reaches us

We obtain information through several protected sources and channels:

Details you provide: for example, when opening an account, updating your profile, submitting verification documents or using a contact form.
Data collected automatically: such as cookies, server logs, analytics information and device data created through platform use.
Data supplied by other organisations: including payment providers handling deposits or withdrawals, KYC/AML services and social-login providers you have authorised.

4. Purposes of processing

We process personal information for specific, lawful and understandable purposes, including:

Opening, operating and supporting your account, including access to platform tools.
Processing and protecting payments, including deposits and withdrawals.
Handling support enquiries and providing assistance relevant to your situation.
Complying with legal and regulatory responsibilities, including KYC, AML and tax obligations.
Protecting the service by identifying fraud, misuse and attempted security breaches.
Improving platform performance and making the user experience clearer and more effective.
Providing marketing or service updates only when you have actively agreed to receive them.

5. Legal bases for processing

Entering into and carrying out a contract, including preparatory steps before an agreement is made.
Observing legal duties, including measures intended to prevent money laundering.
Pursuing legitimate operational interests, such as maintaining platform stability and security.
Using your clear consent, for example for promotional messages or optional platform features.

6. Disclosure to other parties

We share information only when needed and with selected service providers, which may include:

Banks and payment processors that support deposits and withdrawals.
Approved specialist providers carrying out KYC and AML checks.
Technology, hosting and cloud vendors operating under suitable data-processing terms.
Analytics and security providers that use anonymised or pseudonymised data where reasonably possible.
Professional advisers, including legal and tax specialists, where compliance or legal support is required.
Government authorities or courts when disclosure is required by law or necessary to establish or defend legal rights.

We do not sell your personal information or disclose it to other parties for their independent commercial purposes.

7. International data transfers

Certain providers, including cloud-hosting and analytics companies, may be located outside Kenya or another applicable jurisdiction. In those cases, we apply appropriate safeguards intended to preserve the protection required by relevant privacy rules.

8. Information security

We apply a combination of organisational procedures and technical safeguards to protect your information:

Encrypted transfers using current security protocols, including TLS 1.3 or a newer standard.
Strong encryption for sensitive data stored in our systems, including AES-256 where appropriate.
Planned security reviews, penetration testing and independent assessments by qualified specialists.
Continuous monitoring of systems for suspicious activity and attempted unauthorised access.
Restricted staff access managed through role-based permissions.
Client funds held separately through regulated service providers.

Security controls cannot remove every possible risk. Our measures are nevertheless designed to limit exposure as far as reasonably practicable.

9. Retention periods

We retain personal information only while it serves its stated purpose or for the legally required period:

For as long as your account is active and our contractual relationship continues.
After account closure, for the period required by law, which may be 5–10 years for tax or regulatory documentation.
Where consent is the basis for processing, such as marketing, until you withdraw that consent.

Once information is no longer needed, we securely delete it or transform it so that it can no longer identify you.

10. Rights available to you

Applicable privacy rules provide several rights concerning your personal information, including the ability to:

Request confirmation of whether we hold personal information about you and ask for a copy.
Request corrections to inaccurate information or completion of incomplete records.
Request erasure, subject to duties that require certain records to be retained.
Request limits on processing where the law permits this.
Receive your information in a structured, commonly used and machine-readable format for portability.
Withdraw consent at any time for processing based on consent going forward.
Raise a complaint with the appropriate data-protection authority.

11. Cookies and similar technology

Cookies and similar technologies allow the website to function, show us how visitors use it and support service improvements. Essential cookies operate by default; analytics and advertising cookies are placed only with your consent. Our cookie policy provides additional information.

12. Changes to this notice

This notice may be revised periodically to reflect regulatory changes, legal developments or updates to our features. The current version will be published on the website, while significant changes may also be notified by email or through the platform.

13. How to contact us about privacy

If you have a question about this notice, privacy practices or your data rights, email us at $site_gmail or use the website contact form. Our data protection officer will review your request and respond within a reasonable timeframe.

When you use M-PESA × AfriQuantum, you confirm that you have reviewed this privacy notice and accept its provisions.