Privacy Policy

This policy explains what data the LimaPOS Tours application (the “Service”) collects, why it is collected, how it is stored and protected, and what rights you have over it. It applies to the people who sign in to the Service and to the records their business keeps in it.

Who we are

The Service is owned and operated by Dexlab Technologies Ltd, company registration number PVT-PJUE8VZ (“we”, “us”). For your account and subscription we are the data controller. For the records your business keeps about its own guests, suppliers and staff, your business is the controller and we process those records on its behalf. You can reach us about privacy at support@limapos.africa.

1. Data we collect

Account data

• Your name and email address.
• Your business name and reporting currency.
• Your password, stored only as a one-way hash, never in a readable form.
• If you sign in with Google, the name and email address Google shares with us. We don’t receive your Google password.
• Your role in the business (owner, manager or staff) and, if you enable two-factor authentication, the secret used to verify your authenticator codes.

Business and financial data you enter

• Customer and guest records, including the names and contact details you choose to record for the people who book with you.
• Traveler details you add to a booking: names, pickup points, emergency contacts, and any dietary, accessibility or other needs you note.
• Tours, departures, schedules, seat capacity and bookings, and the guest proposals you choose to share through a guest link.
• Staff and resource records, and timesheets where you use them.
• Invoices, receipts, credit notes, supplier bills and payments.
• Accounting data: journals, ledger entries, fixed assets and the reports derived from them.

This data is entered by you and your staff. Where it includes personal data about your customers, your business decides what is collected and why; we process it on your behalf in order to run the Service for you.

Operational data

• An activity and audit log of significant actions taken in your account, such as sign-ins and the creation, approval or posting of financial records, with the user and timestamp, so a business can see who changed what.
• Standard server logs generated when the Service is accessed, used to keep it running securely and to diagnose faults.

Subscription payments

When you pay for a plan, the payment is handled by the provider shown at checkout (Paystack or M-Pesa). We receive the payment result, a reference and, for M-Pesa, the phone number used. We never receive or store card numbers.

Health information

Dietary and accessibility needs can be health information, which the law treats as sensitive. Your business is responsible for collecting it lawfully and recording only what is needed to look after the traveler safely.

What we do not do

The Service does not run advertising, does not build marketing profiles, and does not sell data.

2. How data is used

• To create and administer your account and authenticate you when you sign in.
• To provide the Service’s features: scheduling, bookings, invoicing, payments and accounting.
• To send transactional messages that the Service itself requires, for example email address verification at sign-up, password reset links you request, and the notifications you switch on in Settings.
• To bill your subscription and keep records of payments.
• To keep an audit trail so account activity can be reviewed by the business.
• To secure the Service: detecting and preventing unauthorised access, abuse and fraud, and enforcing rate limits and account lockouts.
• To maintain, troubleshoot and improve the Service.
• To comply with legal obligations, including record-keeping requirements.

Data belonging to one business account is not used to provide the Service to another.

3. How data is stored and secured

Data is stored in the Service’s database, and each business’s records are separated by a business identifier that every query is scoped to, so one account cannot read another’s data. Safeguards include:

• Passwords stored only as one-way hashes using a modern hashing algorithm, and re-hashed automatically as standards improve.
• Optional two-factor authentication, plus throttling and account lockout after repeated failed sign-in attempts.
• Session cookies marked HttpOnly and SameSite, and marked Secure when the Service is served over HTTPS, with the session identifier regenerated at sign-in.
• Protection against cross-site request forgery on every action that changes data.
• Role-based access, so staff see only what their role permits.

No system can be guaranteed completely secure. You also play a part: use a strong, unique password, enable two-factor authentication, and grant staff only the access they need.

4. Data retention

Account and business data is retained for as long as the account is active, and afterwards only as long as needed for the purposes described here or to meet legal and accounting record-keeping obligations. Data that no longer needs to be kept is deleted or anonymised.

5. Sharing with third parties

We do not sell your data, and we do not share it for third-party advertising. Data is shared only in these circumstances:

• Service providers. Infrastructure and hosting providers that run the servers and database; an email delivery provider (Amazon Simple Email Service) used to send verification, password-reset and notification emails; the payment providers Paystack and Safaricom (M-Pesa) for subscription payments; and Google, if you choose to sign in with Google. They receive only what they need to provide their service.
• Guests you share with. When you publish a guest proposal link or send a document, the guest sees the itinerary, prices and terms you include. Internal costs and private notes are left out, and you can revoke a link.
• Within your business. Other users of your business account see the records their role gives them access to. Account owners can see account-wide activity.
• Legal requirements. Where we are required to disclose data by law, regulation or valid legal process, or where disclosure is necessary to protect rights, safety, or the security and integrity of the Service.
• Business transfer. If the Service is involved in a merger, acquisition or sale of assets, data may transfer as part of that transaction, and this policy will continue to apply until superseded.

Web fonts used by the application’s pages are requested from a third-party font provider when a page loads, which means your browser contacts that provider and it may receive your IP address as part of that ordinary request.

6. International transfers

Data may be stored or processed in a country other than your own, depending on where the Service and its providers operate. Where data is transferred across borders, we choose established providers and take steps intended to meet the requirements of Kenyan data protection law.

7. Your rights

Under Kenya’s Data Protection Act, 2019, and similar laws elsewhere, you may have the right to:

• Access the personal data held about you.
• Correct data that is inaccurate or incomplete.
• Request deletion of your data, subject to records we must retain by law.
• Object to or restrict certain processing.
• Receive a copy of data you provided in a portable form.
• Withdraw consent where processing is based on consent, without affecting processing already carried out.

Some of these can be exercised directly in the application: you can change your password and manage two-factor authentication in Settings, and correct or remove the business records you have entered. For anything else, email support@limapos.africa; we may need to confirm your identity first. Staff users should first raise requests with the owner of their business account. Where a business recorded your details as its guest or customer, that business is the controller of those records and requests should be directed to it.

You can also complain to the Office of the Data Protection Commissioner in Kenya, or to the data protection authority where you live.

8. Cookies

The Service uses cookies only where they are necessary to make it work. Specifically, it sets a single session cookie that keeps you signed in as you move between pages. It is marked HttpOnly so it cannot be read by scripts, marked SameSite to limit cross-site sending, marked Secure when served over HTTPS, and it expires when your browser session ends or when you sign out.

The Service does not set advertising, marketing or cross-site tracking cookies. Blocking the session cookie will prevent you from signing in.

9. Children

The Service is a business application and is not directed at children. Accounts are intended for people acting on behalf of a business.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page, and material changes will be notified through the Service where reasonably practicable. Continuing to use the Service after a change takes effect means you accept the revised policy.

11. Compliance

We comply with GDPR principles, the Consumer Protection Act, 2012, and the Computer Misuse and Cybercrime Act (CMCA), 2018. Our Compliance page explains what we do in practice under each of them.

12. Contact

Privacy questions and requests: support@limapos.africa. Dexlab Technologies Ltd, registration number PVT-PJUE8VZ.