Data protection

Privacy rights

Your customers are data subjects under the Kenya Data Protection Act, 2019, and you are the controller of their details. When a customer or a member of your team asks for a copy of what is held about them, or asks for it to be erased, log the request here so its deadline is tracked, then answer it. Owners and admins only.

What each request does

  • Access (a copy of their data). Shows the customer's name, email, phone and tax PIN, and every invoice raised to them. You can download it to send to them. Each export is recorded in your audit trail. You must provide it within 7 days of the request.
  • Erasure. Removes their name, email, phone and tax PIN, the payment-matching history learned from their name, and the account choices learned for payments to them. The invoices stay, with no personal identifiers, because tax and accounting records must be kept for KRA. Erasure cannot be undone. You must respond within 14 days of the request.
  • Deadlines. The Data Protection (General) Regulations, 2021 give you 7 days to provide a copy of a customer's data (regulation 9) and 14 days to respond to a request to erase it (regulation 12). The time runs from the day the customer makes the request, not from the day someone opens this page. Neither may be charged for. A customer who is unhappy with your answer can complain to the Data Commissioner.
  • Team members. A team member can ask for a copy of their login account (name, email, role, sign-in history) or for it to be erased. Erasure removes their name and email, signs them out everywhere and makes the account unusable; past records keep an anonymous reference. You can't erase your own account or the only remaining owner. Hesalio also holds login accounts, so a team member can send their request to Hesalio through the contact form too. Confirm with your adviser who answers which requests.
  • Before you act, confirm the request really comes from that customer (or someone they authorised). Keep your own note of the request and your reply.

Log a request

Enter the day the person made the request. The due date follows from it.

Requests

Loading…