Compliance

1. GDPR principles

The data protection principles of the EU General Data Protection Regulation, which we apply to the personal data we handle.

• Lawful and transparent: our Privacy Policy says what we collect, why, who we share it with and on what basis.
• Used for a stated purpose: we use data to run the Service. We don't run advertising, build marketing profiles or sell personal data.
• Only what's needed: we count visits to our website without cookies and without storing IP addresses, and the only cookies we set are the sign-in cookie and, for referred visitors, a referral cookie.
• Accurate: records can be corrected in the app, and anyone can ask us to correct their data.
• Kept no longer than needed: data is kept while an account is active, and afterwards only as long as legal and accounting duties require.
• Secure: each business sees only its own records, passwords are stored as one-way hashes, two-factor sign-in is available, connections use HTTPS, and stored payment keys are encrypted.
• Accountable: sensitive actions are recorded in an audit log with the user and time.

You can ask to see, correct, export or delete your data. See Your rights.

2. Consumer Protection Act, 2012

Kenya's law on fair dealing, clear information and honest marketing.

• Clear prices: every plan's price, billing period, limits and included tools are shown on our pricing section and again before you pay. There are no setup fees.
• Try before you pay: the free trial needs no payment card.
• No lock-in: there's no long-term contract. If a plan lapses your account becomes read-only rather than deleted, so you can still view and export your records.
• Honest descriptions: we describe only features the product has, and say when a tool depends on your plan.
• Your statutory rights stay: our Terms of Use don't limit any right you have under this Act.

3. Computer Misuse and Cybercrimes Act, 2018

Kenya's law against unauthorised access to computer systems and data, and other cybercrime.

• Access control: sign-in is rate limited, two-factor sign-in can be required for every staff member, staff see only the branches and pages their role allows, and every data change is protected against cross-site request forgery.
• A record of activity: sensitive actions are logged with the user and time, and financial entries are corrected by reversal, never silently deleted.
• Clear rules: our Terms of Use forbid unauthorised access, probing for weaknesses and disrupting the Service.
• Lawful requests: we disclose data to authorities only where the law or a valid legal process requires it.
• Report a problem: if you find a security weakness, please tell us at support@limapos.africa instead of testing it further.