These documents are drafts for review. Company-specific practices and contractual terms need confirmation before publication.
About this notice
Staypace Limited is a Kenya-based financial technology company. This notice explains how personal information may be handled when you visit our website, contact us, or use Staypace Payables, Payments, or DTX.
It covers individuals whose information appears in business records, including account users, suppliers, beneficiaries, business representatives, and financiers. Product-specific notices and agreements may provide additional detail.
Information we handle
Depending on the service and your relationship with us, information may include:
- Names, business contact details, account details, and authorised user roles.
- Business verification records and identification information required for onboarding or a transaction.
- Supplier and beneficiary details, invoices, purchase orders, payment references, and transaction records.
- Enquiries, support correspondence, device information, and website or account activity.
Where information comes from
Information can come directly from you, from the business that gives you account access, or from suppliers, payment participants, and service providers involved in an authorised transaction.
If you submit another person’s information, ensure you are authorised to do so, provide relevant privacy information, and share only what the transaction requires.
Why information is used
Information may be used to provide and support services, verify business and beneficiary details, process payments, review invoices, administer financier bids, communicate transaction updates, and maintain records.
Other purposes may include account security, investigating misuse, resolving disputes, meeting applicable legal obligations, and improving service reliability.
Legal grounds for processing
Depending on the purpose, processing may rely on steps needed to enter into or perform a contract, legal obligations, consent, or legitimate interests assessed against individual rights. A business contract alone does not make every use of an individual’s information lawful.
Where processing relies on consent, you may withdraw it for future processing. This does not invalidate processing that was lawful before withdrawal.
Sharing information
Information may be shared with authorised users in your business, payment and verification providers, service providers supporting our operations, and authorities where legally required.
For DTX, information necessary to assess an eligible invoice or fulfil an accepted arrangement may be shared with participating financiers and relevant transaction parties. Confidentiality, access, and processing responsibilities should be addressed in the applicable agreements.
Cookies and website enquiries
Essential storage remembers your cookie choice for up to 180 days and keeps temporary display settings for your browser session. Optional Google Analytics is loaded only when configured and you consent; a placeholder measurement ID does not enable it. You can change your choice using Cookie settings in the footer.
The website contact form prepares an email in your own mail application. It does not submit the message to Staypace automatically. If you send it, your email provider and Staypace receive the information included in that message.
Retention and international processing
Information should be retained only as needed for the service, applicable record-keeping requirements, disputes, or another lawful purpose. Retention depends on the record type and context; this notice does not specify a single period for all records.
Where a service involves processing outside Kenya, an appropriate legal basis and safeguards are required. Contact us for information about the locations and arrangements relevant to your service.
Your privacy rights
Subject to applicable law and its conditions, you may request information about processing, access to your personal data, correction, or deletion. Rights to object, restrict processing, or obtain a portable copy may also apply.
Requests can require identity or authority checks. A request to delete data may be limited by lawful retention duties or the rights of others. We will explain relevant restrictions when responding.
Security and your responsibilities
Safeguards should reflect the sensitivity and risk of the information. Account permissions, payment controls, and audit records support appropriate access and oversight; no online service can promise absolute security.
Keep credentials private and notify us if you suspect unauthorised access. Do not send passwords, PINs, or one-time codes in an enquiry.
Contact, complaints, and changes
For access requests, corrections, privacy questions, or concerns, email [email protected] with “Privacy request” in the subject, or call +254 704 145 832. Describe your request without including unnecessary identity documents or financial credentials.
You may raise a complaint with Kenya’s Office of the Data Protection Commissioner. Updates to this notice will be reflected in the date shown above; material changes should be communicated where required.
