Privacy Policy

1. Introduction

NeoInfosoft POS is a business software service. Most information held in it is information that your business enters about itself, its staff, its customers and its suppliers. Understanding who controls that information — you or NeoAfrica Consultants — is the single most important part of this policy. Section 3 explains this.

This policy applies to the NeoInfosoft POS web application, its registration and subscription processes, and its support channels.

2. Who We Are

NeoInfosoft POS is provided by NeoAfrica Consultants.

3. Controller and Processor Roles

You should read this section first, because the answer depends on which information you are asking about.

3.1 Where NeoAfrica Consultants is the controller

For information collected directly from you in order to provide and administer the NeoInfosoft POS service, NeoAfrica Consultants acts as the data controller. This is primarily:

• Your business registration details and business profile
• Your account, login, and user-management information
• Your subscription, plan, and billing information
• Your support correspondence with us
• Technical and security information generated by your use of the platform

We determine the purposes for which this information is processed because we need it to run, secure, bill, and support the service.

3.2 Where the subscribing business is the controller

For customer, supplier, employee, and other business records that you enter into NeoInfosoft POS, the subscribing business is generally the data controller. Your business decides:

• Why the information is collected (for example, to issue an invoice or track a loyalty balance)
• Which customers and suppliers are recorded
• What is retained and when it is removed

NeoInfosoft POS processes that information on your behalf, under your instructions and subject to applicable law and the contractual arrangements in your subscription. This typically includes storing and displaying the records, producing invoices, receipts and reports, computing taxes and balances, transmitting invoices to the Kenya Revenue Authority where you have enabled eTIMS, and backing up the information.

3.3 Practical consequence

If a customer of your business asks to see or correct the data you hold about them, that request normally goes to your business first. They may then contact us as your processor. We will assist your business in responding, within what we are technically able to do.

We do not make an absolute determination of the controller and processor boundary in every case. Where the law requires a different allocation, the law prevails.

4. Information We Collect

The categories below reflect the actual data model and runtime behaviour of NeoInfosoft POS.

4.1 Account and identity information

Business name, surname, first name, last name, username, email address, password (stored only as a bcrypt hash), language preference, account status, and user type.

4.2 Contact information

Mobile and telephone numbers, alternate numbers, and email addresses associated with your account, your business, and your business locations. Some staff or customer records can additionally capture date of birth, gender, marital status, blood group, next-of-kin or guardian details, identity-document name and number, bank details, and social-media or custom fields, if you choose to enable and populate them. These fields are optional and are not required to operate the platform.

4.3 Business and branch information

Business name, registration and tax numbers and labels, currency, time zone, financial-year settings, business location and branch details, postal address, landmark, business telephone, alternate number, email, and website.

4.4 Customer, supplier and other contact records

Names, mobile numbers, alternate numbers, landlines, email addresses, contact ID, postal address lines, city, state, country, postcode, landmark and street details, tax numbers, credit limits, payment terms, balances, positions, customer groups, reward-point balances, and any custom fields you define.

4.5 Sales, purchase and inventory information

Invoices, quotations, receipts, returns, invoice numbers and references, customer or supplier reference, products and variations, quantities, unit prices, cost values, discounts, tax rates and amounts, stock movements, adjustments, warehouse or branch allocation, purchase orders and requisitions, and goods-receipt and delivery records.

4.6 Payment information

For each payment against a transaction: the payment method, amount, currency, date paid, the account or ledger it was applied to, the user who recorded it, any free-text payment reference, and any attached document reference. Transaction records also retain the billing counters (opening, closing, total) that customers and suppliers accrue.

4.7 M-Pesa C2B and STK information

M-Pesa payment information is received and retained to reconcile and apply payments, including the transaction or reference identifier, the M-Pesa receipt number where issued, the transaction amount, the business shortcode, the bill reference and invoice reference, payer name fields supplied by the mobile money network, the payment status, and a partially masked form of the payer's phone number (for example, 254••••••78). Raw callback payloads received from the mobile money network are also stored for reconciliation, retry, and audit purposes.

4.8 Subscription and payment information

Selected plan, billing cycle, subscription start and end dates, subscription status, amount, currency, payment method, and the payment reference, tracking, and notification identifiers returned by the payment provider.

5. How We Use Information

We use information for the following purposes. This list reflects the functions the platform actually performs.

1. To create and administer your account — including validating registration, authenticating users, and managing roles and permissions.
2. To provide the service — recording and processing sales, purchases, stock movements, invoices, receipts, reports, and customer or supplier balances.
3. To calculate and record tax on transactions you enter.
4. To transmit invoices to the Kenya Revenue Authority (KRA) via eTIMS for fiscalisation and tax compliance, where you have enabled that integration.
5. To process and reconcile payments, including M-Pesa payments received from the mobile money network.
6. To bill and manage your subscription, and to receive payment through the applicable payment provider.
7. To secure the service — including recording login activity, maintaining audit trails, enforcing role-based permissions, and isolating one subscribing business's data from another's.
8. To provide support and diagnose faults, using the audit and application logs described in Section 4.10.
9. To back up the service so that your business records remain recoverable following a fault or outage.
10. To meet legal, accounting, tax, and record-keeping obligations that apply to us or to you.

We do not use your business records for advertising. NeoInfosoft POS does not currently operate a marketing or advertising profile, and we do not sell personal information.

6. Business Customer, Supplier and Employee Data

Because this is the largest category of information in the platform, we want to be explicit about it.

When you use NeoInfosoft POS, you will typically enter:

• Customer records — names, phone numbers, email addresses, addresses, tax numbers, credit limits, payment terms, running balances, and purchase or sales history
• Supplier records — the same categories, for the businesses you buy from
• Employee and staff records — names, contact numbers, roles, permissions, and, if you use the optional fields, the additional details listed in Section 4.2

This information is stored in the database in readable form. It is not aggregated or anonymised by the platform. Access is controlled by your own role and permission settings, and is additionally scoped so that one subscribing business cannot ordinarily see another subscribing business's records.

Responsibilities that sit with your business:

• You must have a lawful basis to collect and use the personal information you enter.
• You are responsible for the accuracy of what you enter.
• You decide how long to keep it.
• You are responsible for the notices you give to the people whose information you enter.
• You are responsible for responding to requests those people make to you.

NeoAfrica Consultants processes this information on your behalf, as set out in Section 3.2. We do not use it to build profiles, to market to your customers, or for any purpose independent of your instructions.

7. Payment and M-Pesa Information

7.1 Card payments

NeoInfosoft POS does not currently collect or store customers' full card numbers, CVV/security codes, or card expiry details as part of the active payment flow. Where card payment services are used, payment processing is handled through the applicable payment provider.

In practice this means: a customer who pays by card is taken to the payment provider's own hosted page, and the card details are entered on the provider's systems, not on NeoInfosoft POS. What NeoInfosoft POS receives back is a payment reference and a status.

For an in-store cash sale, what is recorded is the amount, the method, the date, the account it was applied to, and any reference your cashier enters.

7.2 Mobile money (M-Pesa)

Where M-Pesa is enabled, NeoInfosoft POS communicates with Safaricom's Daraja service to send payment prompts to a customer (STK push), and to receive, validate and confirm payments made to your business shortcode (C2B) so that those payments can be reconciled against open invoices and finalised once confirmed.

Payment information such as the transaction or reference identifier, the amount, the transaction timestamp, your business shortcode, the bill reference and invoice reference, and payer information supplied by the mobile money network is received and processed so that the payment can be matched and applied.

Payer phone numbers are stored in a partially masked form so that staff can identify a payer without the full number being routinely readable in the interface. The payer's name fields, where the network supplies them, are stored as received.

Raw callback payloads from the mobile money network are retained so that a payment can be traced, retried where necessary, and audited.

7.3 Payment references and identifiers

Payment reference numbers, checkout request identifiers, transaction identifiers, and payment-provider tracking and notification identifiers are retained against the transaction or subscription they relate to.

7.4 What is shared with the payment provider

Payments taken through NeoInfosoft POS to pay a subscription are processed by the payment provider. The order request sent to the provider includes the merchant reference, currency, amount, a description of the plan, the callback URL, and a billing block containing the account owner's name, email address, and phone number, together with the country code. This is used by the provider to process and confirm the payment.

8. eTIMS and Tax Information

Kenya's electronic tax invoicing requirements mean that, where you enable the eTIMS integration, invoice data must be transmitted to the Kenya Revenue Authority.

8.1 What is transmitted

For each invoice submitted, NeoInfosoft POS sends the Kenya Revenue Authority information including:

• The taxpayer's registered TIN and taxpayer name
• The branch code, where configured
• The device serial and software version of the integration
• The invoice number, date and type
• The taxable amount, tax amount and total
• The currency and exchange rate
• The invoice line items, including the item classification and tax codes
• Buyer details, where present — the buyer's PIN, name and email address

8.2 What is retained locally

In addition to the submitted invoice, NeoInfosoft POS retains a record of the submission, including the full request and response payloads, the KRA response and invoice code, generated QR and verification data, digital signature and receipt material, device and signature identifiers, submission timestamps, status transitions, retry counts, and any error messages. This is retained so that submissions can be retried, reconciled, and audited.

8.3 Your responsibilities

• You must be duly registered and authorised to transact on eTIMS.
• You are responsible for the accuracy and completeness of the invoice information and for your own tax position.
• NeoInfosoft POS acts as a technical intermediary. It does not verify, certify, or take responsibility for the tax position of your business.
• You are responsible for keeping your eTIMS credentials and access tokens secure.

9. Third-Party Service Providers

NeoInfosoft POS works with the following external services. Each receives only what is needed for its function.

We do not use advertising networks, analytics trackers, or social-media pixels. NeoInfosoft POS does not set analytics or marketing tracking cookies.

10. Cookies and Similar Technologies

10.1 What we use

NeoInfosoft POS uses only essential cookies and session technologies, which are required for the application to function:

• A session cookie — identifies your session while you are signed in. It expires after approximately 120 minutes of inactivity.
• Authentication state — held within the session so that the platform knows you are signed in.
• A CSRF token — protects forms and requests against cross-site request forgery.

These are not used for advertising, profiling, or behavioural tracking.

10.2 What we do not use

NeoInfosoft POS does not set analytics cookies, advertising cookies, or marketing tracking cookies. There is no third-party advertising or analytics tracker embedded in the platform.

10.3 Content delivery networks

Interface resources such as fonts and icons are loaded from external content delivery networks (for example, Google Fonts and cdnjs). Loading these resources necessarily makes a request to those providers, which will see ordinary technical request data such as your IP address and browser type. This is a consequence of using shared asset services and does not involve your business data.

10.4 Google reCAPTCHA

Where reCAPTCHA has been enabled for an installation, Google's reCAPTCHA service is used on the login screen. In that case your browser will contact Google and your IP address will be shared with Google for verification purposes. Where reCAPTCHA is not enabled, no such contact occurs.

11. Data Security

We apply the following measures. We describe them factually rather than as guarantees, and we do not claim that any system can be entirely secure.

11.1 Access control

• Passwords are hashed using bcrypt and are never stored in readable form.
• Access to features and records is governed by role-based permissions assigned within your business.
• A business isolation mechanism scopes records to the subscribing business that owns them, so that one customer cannot ordinarily access another's data.
• A separate super-administrator area exists for service administration and is access-restricted.

11.2 Encryption of sensitive credentials

• Specified eTIMS and KRA credentials — including the taxpayer TIN, API username, API password, the CMC key, the device certificate, and access and refresh tokens — are encrypted at rest.
• The M-Pesa merchant passkey is encrypted at rest and is deliberately excluded from any API response or data export.

11.3 Data minimisation in payment records

M-Pesa payer phone numbers are stored in a masked form rather than in full.

11.4 Logging and auditability

The platform maintains an activity log of changes, an operations audit log capturing the user, action, route, IP address and user-agent, a login log recording the user, email, IP address and login time, and an eTIMS submission history recording submission status changes and errors.

11.5 Deletion behaviour

Many business records — including users, contacts and fiscalised invoices — are soft-deleted: they are marked as deleted and removed from normal use, but the underlying record is not permanently erased. This supports audit and record-integrity requirements. See Section 12.

11.6 eTIMS environment separation

The eTIMS integration maintains a strict separation between the sandbox and production tax-authority environments, and refuses to operate if the configured environment does not match the endpoint.

12. Data Retention

NeoInfosoft POS does not currently operate a fixed, automated data-retention and deletion schedule in the platform. We are stating this plainly so that you understand what to expect.

12.1 General position

NeoAfrica Consultants will retain personal data only for as long as reasonably necessary for the purposes described in this policy, and for as long as required by applicable legal, accounting, tax, contractual, dispute-resolution and security requirements. Retention is not optional: information is kept for a legitimate, defined reason and no longer than that reason requires.

In practical terms this generally means:

• Account, subscription and billing information — retained while your subscription is active and for as long as needed afterwards to meet accounting and tax record-keeping obligations.
• Business, customer, supplier and transaction records — retained for as long as your business keeps them, subject to your own retention practices and any legal or tax obligation that applies to you.
• Payment records and eTIMS submissions — retained as transaction and tax records, including the audit, retry and reconciliation data described in Sections 4.7 and 8.2.
• Login, audit and activity records — retained as security and audit records.

Where applicable law requires particular retention periods, or requires a review of the periods in place, we will implement and apply appropriate retention periods accordingly.

Because the platform does not currently enforce an automatic deletion schedule, you should apply your own retention and archiving practices to your business data.

12.2 Soft-deleted records

Where a record is soft-deleted, it is removed from normal day-to-day use but remains in the database. It is not automatically and permanently erased. If you need information permanently removed, contact us using the details in Section 17.

12.3 Backups

The service is backed up regularly so that business records remain recoverable following a fault or outage. Backup copies may continue to contain information after it has been deleted from the operational records. Backups are protected under the same access controls and are subject to their own lifecycle controls; information within them is not selectively editable or immediately erasable.

12.4 Deactivation and closure

Deactivating a business account or removing a user does not automatically and permanently erase the underlying information, for the reasons given in Section 12.2. If you require information to be erased, please contact us and we will discuss what is possible in the circumstances.

13. Data Subject Rights

Depending on the role described in Section 3, and subject to applicable law, individuals whose information is processed may have rights including the right to:

• Be informed — to know that their information is being processed, and how
• Access — to obtain a copy of the information held about them
• Correction — to have inaccurate or incomplete information corrected
• Objection — to object to certain processing
• Erasure — to request deletion of their information, where applicable
• Restriction — to request restriction of certain processing, where applicable
• Portability — to receive certain information in a portable format, where applicable
• Withdrawal of consent — to withdraw consent where processing is based on consent

13.1 How to make a request

Requests can currently be submitted by email to info@neoafricaconsultants.com. Please state what you are asking for and which NeoInfosoft POS account or business it relates to.

13.2 What to expect

• There is no self-service privacy portal. Requests are handled manually by email.
• Requests are not fulfilled automatically. Each request is reviewed and handled by a person.
• We may ask for information to verify your identity and your authority to make the request, particularly where the request concerns information belonging to a subscribing business. This protects other people's data.
• Where information belongs to a subscribing business — for example a customer record held by one of our customers — we will normally direct you to that business, or ask that business to authorise us to assist.
• Some requests may not be possible to fulfil in full, for example where information is required to be retained for legal, accounting or tax reasons, or where it is contained in backups subject to Section 12.3. Where we cannot fulfil a request, we will explain why.
• We do not currently commit to a fixed response timeframe in this policy.

13.3 Right to lodge a complaint

If you believe your data protection rights have not been adequately addressed, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC). We would encourage you to contact us first so that we have the opportunity to understand and resolve your concerns, but this is not a condition of your right to complain.

13.4 Correcting information yourself

Most information in NeoInfosoft POS can be corrected directly by the users of your business through the normal application interface, without contacting us.

14. International Data Transfers

We do not state that all information processed through NeoInfosoft POS remains in Kenya.

Some of the service providers and infrastructure involved in operating the service — for example payment providers, communications providers, and content delivery networks — may process information on servers located outside Kenya. Where a payment provider processes a transaction, that processing takes place on that provider's infrastructure, which may be outside Kenya.

Any such cross-border processing is undertaken for the purposes described in this policy and is subject to applicable legal requirements and appropriate safeguards.

You should also note that eTIMS submissions are made to the Kenya Revenue Authority under Kenyan tax law, and that the tax authority's own handling of that information is a matter for the tax authority.

15. Data Breaches and Security Incidents

We take the security of the service and the information in it seriously.

Where a personal data breach occurs, NeoAfrica Consultants will assess and handle the incident in accordance with applicable law and will make any required notifications to affected persons, the Data Commissioner, customers, or other relevant parties within the applicable legal requirements.

We are not describing a notification deadline beyond what the law requires.

You can assist by reporting any suspected security issue involving your account to info@neoafricaconsultants.com.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. This may happen because:

• the service, its features, or its integrations change
• our processing activities change
• legal or regulatory requirements change
• our internal practices change

Where changes are material, we will provide reasonable notice through the Service or other appropriate communication channels. The updated policy will show its effective and last updated date.

17. Contact Us

For any question about this Privacy Policy, or to make a request concerning personal information, please contact us:

Email is the recommended channel for privacy and data requests, as it provides a written record of the request. Please include enough detail for us to identify the account or business concerned.

If you are a customer, supplier, employee, or other individual whose information is held in a subscribing business's NeoInfosoft POS account, you may also contact that business directly, as it is generally the controller of your information.

18. Applicable Law and Regulatory Framework

This policy has been prepared by reference to the Data Protection Act, 2019 of Kenya, and with regard to the tax and fiscalisation requirements administered by the Kenya Revenue Authority through the eTIMS service.

The processing described in this policy is also governed by:

• the agreement between your business and NeoAfrica Consultants for the provision of NeoInfosoft POS, including the applicable Terms and Conditions
• applicable tax, accounting, and record-keeping requirements
• other laws that may apply to the parties and to the information in question

Where a specific legal requirement applies to a particular category of information, that requirement prevails over this policy. We do not claim in this policy that the service has been certified or assessed against any particular standard, and nothing in it should be read as a representation of such a certification.