Privacy Notice

1. Who is responsible for your data

Mizani ERP Ltd (the “Customer”) uses Mizani ERP to run its finance, HR, payroll, procurement, sales and operations. The Customer decides whose data is entered, for what purposes and for how long. Under the Kenya Data Protection Act, 2019 (and, where it applies, the EU/UK GDPR), the Customer is the data controller.

The provider of Mizani ERP (the “Provider”, “we”) hosts and operates the Service for the Customer. We act as a data processor: we process personal data only on the Customer's documented instructions and under a data-processing agreement. We act as a controller only for a small amount of data we need to run our own business, such as account-security telemetry, billing contacts and support correspondence.

2. Personal data processed

Special categories of data, such as health information in sick-leave or medical-benefit records, are processed only when the Customer chooses to record them. Access to them is restricted by role and can be masked for users who do not need it.

3. Why it is processed

• To provide the Service the Customer has subscribed to, on its instructions. The Customer is responsible for having a lawful basis, such as an employment contract, a legal obligation or legitimate interests.
• To secure the Service: authentication, fraud and abuse prevention, audit trails and incident investigation.
• To support and maintain the Service: troubleshooting, backups and fixing defects.
• To meet legal obligations, for example lawful requests from authorities.

Personal data in the Service is not sold, not used for advertising or profiling for marketing, and not used to train third-party AI models.

4. Who it is shared with

• Within the Customer: people whose role allows it, as configured by the Customer's administrators.
• Sub-processors that help us run the Service, such as cloud hosting, email delivery and SMS delivery. Each is bound by a contract with data-protection, confidentiality and security obligations at least as strict as ours. The Customer can request the current list and is told about changes in advance.
• Services the Customer connects, such as banks, payment providers and tax authority systems (for example KRA eTIMS). Data is sent to them only when the Customer turns on and uses that integration.
• Authorities, when the law requires it. Where the law allows, we tell the Customer first.

Provider support staff cannot see the Customer's data by default. A support engineer needs a time-limited support session approved by the Customer's administrator, and every action taken in it is logged under that engineer's name.

5. Where it is stored

Data is stored in the hosting region agreed with the Customer. When data is transferred outside Kenya, for example to a sub-processor's infrastructure, we use the safeguards required by sections 48–50 of the Kenya Data Protection Act. These include appropriate contractual protections and transfers to countries with adequate protection.

6. How long it is kept

• The Customer controls how long business, HR and payroll records are kept, in line with its own legal record-keeping duties (for example tax and employment law).
• Audit and security logs are kept as long as the Customer's retention settings require. They are protected against changes.
• When the subscription ends, the Customer can export its data during the period set out in the Customer Agreement. After that, the data is deleted from live systems. Encrypted backups are overwritten on their normal rotation cycle.

Removing a user's access does not delete records that user created. Those records stay part of the Customer's business and audit history.

7. How it is protected

• Encryption in transit (HTTPS/TLS). Database backups are encrypted.
• Passwords are stored as salted one-way hashes. Accounts lock after repeated failed sign-ins.
• Two-step verification (authenticator app) is available, and the Customer can require it.
• One active session per account, automatic sign-out after inactivity, and secure, HTTP-only cookies.
• Role-based access is enforced on the server for every request. Sensitive fields such as salaries and bank details can be masked by role.
• Audit trails record sign-ins, security changes and record changes. Each customer workspace is kept separate from the others.

8. Your rights

Under the Kenya Data Protection Act, 2019 (and the GDPR where it applies), you have the right to:

• be told how your data is used, and get a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• object to processing, or ask for it to be restricted;
• ask for data to be deleted when there is no longer a lawful reason to keep it;
• receive data you provided in a portable format, where this applies.

Because Mizani ERP Ltd is the controller, send your request to Mizani ERP Ltd, usually its HR department, data protection officer or system administrator. If you send a request to us, we pass it to the Customer and help them respond. You can update many profile details yourself in the Service.

You can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya, or to the supervisory authority where you live.

9. Cookies and device storage

Mizani ERP uses only the cookies and browser storage it needs to work and to stay secure. There are no advertising cookies and no third-party tracking cookies, so you are not asked for cookie consent.

You can clear cookies and site data in your browser at any time. Removing essential cookies signs you out.

10. Personal data breaches

If a personal data breach affects the Customer's data, we notify the Customer without undue delay and give it the information it needs. This lets the Customer meet its duty to notify the Data Protection Commissioner within 72 hours, and to inform affected people where required (section 43 of the Kenya Data Protection Act).

11. Children

Mizani ERP is a workplace system and is not intended for children. Data about minors, such as employees' dependants, is recorded only when the Customer needs it, for example for medical benefits.

12. Changes to this notice

We update this notice when the Service or the law changes. Each version shows its number and effective date, and earlier versions are listed under Version history. We tell the Customer about material changes in advance.

13. Contact

Contact Mizani ERP Ltd about your personal data first, through its HR department, data protection officer or system administrator. Send questions about how the Provider processes data, or about this notice, to support@mizanihq.com.

Version history