These documents are drafts for review. Company-specific practices and contractual terms need confirmation before publication.
Purpose and scope
This statement explains the data-protection principles relevant to Staypace’s website and business services. Read it alongside the Privacy Notice and any agreement covering processing for your business.
Kenya’s Data Protection Act, 2019 and applicable regulations provide the legal framework. This statement is not a claim of regulatory registration, certification, or approval.
Controller and processor roles
A controller decides the purpose and means of processing; a processor acts on a controller’s instructions. Staypace’s role depends on the specific activity and contractual arrangement.
For example, account administration and business-directed supplier records can involve different responsibilities. Where processing is carried out on a business’s behalf, the parties should document instructions, permitted uses, confidentiality, security, and assistance with individual rights.
Core principles
Data handling should follow these principles:
- Use information lawfully, fairly, and transparently.
- Collect it for clear, legitimate purposes.
- Limit it to what the purpose requires.
- Keep it accurate and correct errors.
- Retain it only as long as a lawful purpose requires.
- Protect it against unauthorised access, loss, or misuse.
Access and operational safeguards
Relevant controls include role-based access, maker-checker approvals, transaction monitoring, and audit trails. Access should be limited to authorised people who need it for their role.
Security arrangements should be proportionate to risk and reviewed as services change. Ask our team about the controls applicable to your deployment; this statement does not promise a particular certification or an absolute level of security.
Service providers and transfers
Where suppliers or partners process personal information, their purposes, responsibilities, confidentiality, and safeguards should be addressed in the relevant arrangements.
Processing outside Kenya requires a permitted legal basis and appropriate safeguards. A provider’s involvement does not by itself remove the need to protect individual rights.
Retention and secure disposal
Retention should reflect service requirements, legal duties, disputes, and the type of record. Account closure or a deletion request may not remove every lawful reason to retain information.
When information is no longer required, deletion, anonymisation, or disposal should be appropriate to the medium and risk. Request the retention details relevant to your service from our team.
Requests from individuals
To ask about access, correction, deletion, objections, or other applicable rights, email [email protected] with “Data protection request” in the subject.
Explain the request and your relationship to the relevant business. Identity and authority may need to be verified. If another business controls the records, the request may need to be directed to or coordinated with that business.
Security incidents
Report suspected unauthorised access, disclosure, or loss to [email protected] as soon as possible. Include when it happened, the affected service, and a contact for follow-up. Do not send sensitive records unless a suitable channel has been agreed.
The response should assess the incident, contain exposure, preserve relevant evidence, and meet any notification duties to affected parties and the ODPC within applicable legal timeframes.
Business customer responsibilities
Businesses should have authority and a lawful basis for the information they provide, keep it accurate, manage user permissions, and give relevant notices to suppliers, beneficiaries, and staff.
Share only necessary information, follow agreed processing instructions, and inform Staypace promptly about access changes, disputes, rights requests, or incidents affecting the service.
Contact and escalation
Contact Staypace Limited at [email protected] or +254 704 145 832 for data-protection questions. This is the general company contact, not a separately designated data protection officer address.
Individuals may also raise concerns with the Office of the Data Protection Commissioner in Kenya. The date above identifies the latest revision of this statement.
