Privacy Policy

1Introduction

Synthix Technologies Limited (“Synthix”, “we”, “our” or “us”) is committed to respecting your privacy and protecting personal information entrusted to us.

We are a technology company incorporated in the Republic of Kenya, providing software solutions, digital platforms, mobile applications and technology services to businesses, organizations, individuals and families.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

• Visit our websites.
• Create or use an account on our platforms.
• Use our mobile applications or software products.
• Purchase or subscribe to our Services.
• Contact our support or customer service teams.
• Interact with our marketing, communications or business development activities.
• Otherwise engage with Synthix.

This Policy applies to websites, platforms, applications and services operated by Synthix unless a separate product-specific privacy notice applies.

By using our Services, you acknowledge that you have been provided with this Privacy Policy. Where consent is the applicable legal basis for processing, we will request that consent separately and appropriately.

2Who We Are

The organization responsible for this Privacy Policy is:

Depending on the particular Service and processing activity, Synthix may act as:

A Data Controller: Where we determine the purposes and means of processing personal information, such as information relating to our own customers, website visitors, employees and account holders.

A Data Processor: Where we process personal information on behalf of a business customer or another organization according to its documented instructions.

Our role depends on the specific processing activity and is not determined solely by the type of product being used.

3Personal Information We Collect

The information we collect depends on how you interact with our Services.

3.1 Personal Identification and Contact Information

This may include:

• Full name.
• Email address.
• Telephone number.
• Postal or business address.
• Organization or company name.
• Job title or professional information.
• Account identifiers.

3.2 Account and Authentication Information

We may collect:

• Username and account details.
• Password hashes and authentication information.
• Account preferences and settings.
• Login records.
• Account verification information.
• Security and access logs.

We do not need to store your readable password to authenticate your account.

3.3 Transaction and Payment Information

When you purchase or subscribe to our Services, we may process:

• Subscription details.
• Transaction references.
• Payment status.
• Billing history.
• Invoice details.
• Payment method information made available by the payment provider.

Payments may be processed through third-party payment providers.

We do not intentionally collect or store complete payment card security details where payment processing is handled by an external payment provider.

3.4 Business and Operational Information

For business and enterprise platforms, information may include:

• Company and organizational details.
• Employee and user records.
• Customer and supplier records.
• Property and tenancy information.
• Visitor and access records.
• Operational and maintenance records.
• Communications and support tickets.
• Files and documents uploaded by authorized users.

The information processed will depend on the functionality of the relevant platform and the instructions of the Business Customer.

3.5 Device and Technical Information

When you access our websites or applications, we may automatically collect:

• IP address.
• Browser type and version.
• Operating system.
• Device type and identifiers.
• Application version.
• Network information.
• Date and time of access.
• Usage logs.
• Error reports.
• Security and diagnostic information.

3.6 Usage and Interaction Information

We may collect information about how you use our Services, including:

• Features accessed.
• Pages visited.
• Actions performed.
• Session information.
• Preferences.
• Service performance.
• Interaction with communications and notifications.

Where appropriate, this information may be aggregated or de-identified for analytical and service improvement purposes.

3.7 Communications and Support Information

When you contact us, we may collect:

• Your correspondence.
• Support requests.
• Feedback.
• Complaint details.
• Attachments or documents you voluntarily provide.
• Records of our responses.

3.8 Information From Third Parties

We may receive information from:

• Payment providers.
• Business customers and authorized administrators.
• Authentication providers.
• Technology integration partners.
• Hosting and infrastructure providers.
• Publicly available business information sources, where lawful.

Where information is provided by another organization, that organization is responsible for ensuring it has the appropriate authority to share the information with us.

4How We Use Personal Information

We use personal information for legitimate and disclosed purposes, including:

4.1 Providing Our Services

• Creating and managing user accounts.
• Providing access to software and applications.
• Delivering subscribed features.
• Operating business and personal platforms.
• Processing transactions.
• Providing customer support.
• Managing subscriptions and billing.

4.2 Improving Our Technology

• Monitoring system performance.
• Troubleshooting technical issues.
• Improving user experience.
• Developing new functionality.
• Testing software updates.
• Understanding usage patterns.
• Improving platform reliability.

4.3 Security and Fraud Prevention

• Detecting unauthorized access.
• Protecting accounts and infrastructure.
• Preventing fraud and abuse.
• Investigating security incidents.
• Enforcing our Terms of Service.
• Maintaining audit and access records.

4.4 Communication

• Sending account-related notifications.
• Providing service updates.
• Responding to enquiries.
• Communicating subscription information.
• Notifying users about important policy changes.

4.5 Marketing and Business Development

Where permitted by applicable law, we may use contact information to:

• Share product announcements.
• Provide information about new features.
• Send newsletters and company updates.
• Communicate relevant offers and promotions.

You may opt out of marketing communications at any time through the unsubscribe mechanism provided or by contacting us.

Opting out of marketing does not prevent us from sending essential service, security, billing or legally required communications.

4.6 Legal and Regulatory Compliance

We may process information where necessary to:

• Comply with applicable laws.
• Respond to lawful requests from authorities.
• Establish, exercise or defend legal claims.
• Maintain required business and financial records.
• Protect the rights, safety and property of Synthix, our customers and others.

5Legal Basis for Processing

We process personal information only where an appropriate legal basis applies.

Depending on the activity, these bases may include:

Consent: Where you have freely and specifically agreed to a particular processing activity.

Contractual necessity: Where processing is necessary to enter into or perform a contract with you.

Legal obligation: Where processing is required to comply with applicable legal requirements.

Legitimate interests: Where processing is necessary for legitimate business purposes, provided those interests are not overridden by your rights and freedoms.

Vital interests or public interest: Where processing is permitted or required under applicable law on these grounds.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where processing is necessary to provide a requested Service or meet a legal obligation, withholding required information may affect our ability to provide that Service.

6How We Share Personal Information

We do not sell personal information to third parties as a commercial data-broker service.

We may disclose information to the following categories of recipients where necessary and lawful.

6.1 Technology and Infrastructure Providers

These may include:

• Cloud hosting providers.
• Server and storage providers.
• Security and monitoring providers.
• Database and infrastructure services.
• Backup and disaster recovery providers.

6.2 Payment Providers

We may share necessary transaction information with payment providers to facilitate payments, subscriptions, refunds and financial reconciliation.

6.3 Communication Providers

We may use third-party services to deliver:

• Emails.
• SMS messages.
• Account verification messages.
• Transaction notifications.
• Customer support communications.

6.4 Business Customers and Authorized Users

Where a Service is provided to an organization, authorized administrators may access information relating to accounts and activities within that organization’s platform.

The relevant organization’s own policies and permissions may govern access to information within its account.

6.5 Professional and Legal Advisers

We may disclose information to lawyers, auditors, accountants, insurers and other professional advisers where reasonably necessary.

6.6 Regulators and Authorities

We may disclose information where required by law, court order, regulatory obligation or another lawful request.

6.7 Business Transactions

In connection with a merger, acquisition, restructuring or transfer of business assets, information may be transferred where legally permitted and subject to appropriate confidentiality and data protection safeguards.

We do not authorize third-party service providers to use personal information for purposes unrelated to the services they provide to us, except where they act independently under their own legal obligations.

7Business Customers and Customer Data

When a business or organization uses a Synthix platform, it may upload, manage or otherwise process information relating to its own customers, employees, tenants, visitors, suppliers and other individuals.

In these circumstances:

• The Business Customer may act as the Data Controller.
• Synthix may act as the Data Processor.
• The Business Customer determines the purposes for which the relevant information is processed.
• Synthix processes the information according to applicable contractual obligations and documented instructions.

Business Customers are responsible for ensuring they have a lawful basis to collect and share the information they submit to our platforms.

Where required, Synthix and the Business Customer will enter into a separate Data Processing Agreement setting out their respective obligations.

We do not claim ownership of Customer Data.

We may access or process Customer Data only as necessary to provide, secure, maintain and support the relevant Service, comply with legal obligations or otherwise act in accordance with applicable contractual instructions.

Individuals seeking access to or correction of information managed by a Business Customer may need to direct their request to that organization.

We will provide reasonable assistance where required by law or an applicable agreement.

8Children’s Personal Information

Some Synthix products or applications may be designed for or used by children.

We recognize that children’s personal information requires additional protection.

Where we process personal information relating to children, we will comply with applicable data protection requirements, including the Kenyan Data Protection Act, 2019.

Depending on the relevant product and processing activity, we will:

• Obtain consent from a parent or legal guardian where required.
• Implement appropriate age verification and parental authorization mechanisms.
• Process children’s information in a manner that protects their rights and best interests.
• Limit the information collected to what is necessary for the relevant Service.
• Apply appropriate access controls and security measures.
• Provide appropriate mechanisms for parents or guardians to exercise children’s data rights.

Children’s information will not be used for prohibited direct marketing or profiling activities.

Parents and legal guardians may contact us to request information about the processing of a child’s personal information or to exercise applicable rights on the child’s behalf.

Where we become aware that personal information has been collected from a child without required authorization, we will take appropriate steps to investigate and address the issue.

9International Data Transfers

Synthix may use technology providers, infrastructure and services located outside Kenya.

As a result, personal information may be stored or processed in jurisdictions other than the country in which it was collected.

Where personal information is transferred outside Kenya, we will implement the safeguards and legal conditions required under applicable data protection laws.

Depending on the circumstances, these may include:

• Appropriate contractual safeguards.
• Adequacy or comparable data protection safeguards.
• Other legally recognized transfer mechanisms.
• Additional protections required for sensitive personal information.

We will not assume that information can be transferred internationally without meeting the applicable legal requirements.

10Data Storage and Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• The nature of the information.
• The purpose of processing.
• The duration of a customer relationship.
• Subscription and contractual requirements.
• Financial and legal recordkeeping obligations.
• Security and fraud prevention requirements.
• The resolution of disputes or legal claims.

When personal information is no longer required, we will take reasonable steps to delete, anonymize or securely dispose of it.

Information stored in backups may remain for a limited period under our backup and disaster recovery procedures before being overwritten or securely deleted.

For Business Customer data, deletion and return procedures may also be governed by the relevant service agreement or Data Processing Agreement.

11Information Security

We implement appropriate technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss or destruction.

These measures may include:

• Access controls and authentication.
• Encryption where appropriate.
• Secure communications.
• Network and infrastructure protections.
• Security monitoring and logging.
• Regular software updates.
• Backup and recovery procedures.
• Internal access restrictions.
• Staff confidentiality obligations.
• Incident detection and response procedures.

No method of electronic storage or transmission is completely secure.

Although we take reasonable precautions, we cannot guarantee absolute security.

Where a personal data breach occurs, we will respond in accordance with applicable legal and regulatory notification requirements.

12Your Data Protection Rights

Subject to applicable law and any relevant limitations, you may have the right to:

Be informed: Receive information about how your personal information is used.

Access: Request access to personal information we hold about you.

Correction: Request correction of inaccurate, incomplete or misleading information.

Deletion: Request deletion of personal information where legally applicable.

Object: Object to certain forms of processing, including processing based on legitimate interests or direct marketing.

Restriction: Request restriction of processing in circumstances provided by law.

Data portability: Request personal information in a structured and commonly used format where the right applies.

Withdraw consent: Withdraw consent where processing is based on your consent.

Complain: Lodge a complaint with the Office of the Data Protection Commissioner or another competent supervisory authority.

To exercise your rights, contact us using the details provided in Section 17.

We may request reasonable information to verify your identity and ensure that requests are handled securely.

We will respond within the periods required by applicable law.

Where a request cannot be fulfilled, we will explain the reason where legally required.

If information is processed by Synthix on behalf of a Business Customer, we may refer your request to that organization or assist it in responding.

13Cookies and Similar Technologies

This website (synthixtechnologies.com) does not set cookies and does not use analytics, advertising or tracking tools.

Our applications and platforms, such as Kodi, use cookies, local storage and similar technologies where the Service needs them to work - for example to keep you signed in, remember your settings and keep accounts secure.

If a Service uses non-essential cookies or similar technologies, such as for analytics or marketing measurement, we will say so in that Service and ask for your consent where the law requires it.

You can clear or block cookies in your browser settings. Blocking cookies that a Service needs may stop it from working properly.

14Third-Party Websites and Services

Our Services may contain links to third-party websites, applications or services.

These external services operate independently and may have their own privacy policies and practices.

Synthix is not responsible for the privacy practices of independent third parties.

We encourage you to review their privacy policies before sharing personal information with them.

15Automated Processing and Artificial Intelligence

Some Synthix Services may incorporate automation, analytics or artificial intelligence technologies.

These technologies may be used to:

• Improve platform functionality.
• Automate workflows.
• Generate recommendations.
• Assist with information processing.
• Support customer service.
• Improve user experience.

Where automated processing produces decisions with legal or similarly significant effects on individuals, we will implement the safeguards, transparency and rights required under applicable law.

We will not use personal information for incompatible purposes merely because it is technically possible to do so.

Where third-party AI services are used, relevant information may be processed by those providers subject to applicable agreements and safeguards.

16Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our products, services, data practices or legal obligations.

The updated version will be published on our website or the relevant platform with a revised effective date.

Where changes materially affect how personal information is processed, we will provide appropriate notice and obtain consent where required by law.

We encourage users to review this Policy periodically.

17Contact Us and Privacy Requests

If you have questions, concerns or requests relating to this Privacy Policy or the processing of your personal information, please contact us:

Please include sufficient information to help us understand and respond to your request.

18Complaints to the Data Protection Commissioner

If you believe that your personal information has been processed in violation of applicable data protection laws, you may lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

You may exercise this right without first exhausting our internal complaint process, where permitted by law.

19Governing Law

This Privacy Policy is governed by the laws of the Republic of Kenya, including the Data Protection Act, 2019 and its applicable regulations.

Where another country’s data protection laws apply to a particular processing activity, Synthix will comply with the applicable legal requirements.