LEGAL · DATA PROTECTION
Privacy Notice
This Notice explains how information is handled when you visit Zetu Pay, create an account, use the dashboard or API, make or receive a payment through a supported flow, or contact Support. It should be read with the Terms of Service.
1. Who handles your information
Zetu Pay is a service operated by Zetu Business Solutions, a registered business name in Kenya. For privacy enquiries, contact support@christech.co.ke and use the subject “Privacy request”. Depending on the activity, Zetu Business Solutions may act as a data controller for account and service administration, or process information on a merchant’s instructions for a payment-related purpose. The role for a particular processing activity depends on who determines its purposes and means under applicable law.
2. Information processed
- Account and contact information: name, email address, phone number, account type, login and verification status.
- Business and verification information: business details and identity or supporting documents you submit when required to verify an account or enable a feature.
- Payment and payout information: transaction identifiers, external references, amount, fees, currency, timestamps, status history, recipient or payer details necessary for processing, provider receipt/reference and reconciliation information.
- Technical and security information: IP address, device/browser information, authentication events, API request metadata, audit logs, error records and security signals.
- Support and communications: messages, attachments and information you choose to provide when asking for help or disputing a transaction.
Do not send us your M-Pesa PIN, password, one-time passcode or a complete API secret. We do not need those to investigate an ordinary support request.
3. Purposes and lawful handling
Information is used as necessary to create and administer accounts; authenticate users; provide requested collections, payouts, webhooks and account features; maintain transaction records and reconcile results; calculate applicable fees; investigate errors, fraud and disputes; protect the service; respond to support requests; enforce agreements; and meet applicable legal, regulatory or payment-provider requirements. Information should be limited to what is relevant to these purposes and handled under an applicable lawful basis.
4. Payment-provider and service-provider sharing
To complete a requested payment or maintain the service, relevant information may be shared with the payment provider and with hosting, database, messaging, email, security or other service vendors acting for the service. Information may also be disclosed to authorised staff with a legitimate role-based need, or to a regulator, law-enforcement body, court or other recipient where disclosure is legally required or permitted. We do not publish merchant credentials, private transaction records or verification documents for general access.
Merchants must provide their own customers with appropriate privacy information for the merchant's website, goods or services. A merchant should only send personal information to Zetu Pay that it is entitled to share for the requested payment or service.
5. Security
Access controls, authentication, audit records and technical safeguards are used as appropriate to protect information. No internet service can guarantee absolute security. You must protect your account, devices, API keys and webhook secrets, limit staff access and notify Support promptly if you suspect compromise. We will handle suspected security incidents in accordance with applicable requirements.
6. Retention
Information is retained only for as long as reasonably needed for the purposes described in this Notice, including service operation, transaction reconciliation, dispute handling, fraud prevention, accounting, security and legal obligations. Retention periods depend on the record type and applicable requirements. When information is no longer required, it should be securely deleted or de-identified where appropriate, subject to lawful retention and backup cycles.
7. Transfers and processing locations
Some service vendors may process or store information outside Kenya. Where a cross-border transfer occurs, the responsible party must apply safeguards and other requirements required by applicable data-protection law. Contact Support if you need information about a specific processing arrangement relevant to your account.
8. Your privacy rights
Subject to applicable law and valid exceptions, you may request information about the use of your personal data, access it, seek correction of inaccurate information, object to certain processing, or request deletion where applicable. Certain transaction, security, dispute or compliance records may need to be retained. We may ask for reasonable information to verify your identity before acting on a request. Send requests to support@christech.co.ke with the subject “Privacy request”; do not email passwords, PINs or API secrets.
9. Children
The service is intended for people who are legally able to enter into the relevant account or merchant relationship. Do not submit personal information about a child unless you have a lawful basis and it is necessary for the service.
10. Changes and contact
This Notice may be updated as the service or legal requirements change. The effective date will be updated when material revisions are made. For questions or requests, contact support@christech.co.ke or visit Support.