Effective Date: 1 July 2025 · Last Updated: 1 July 2025
Vanda Consultancy LTD, a company registered in the Republic of Kenya ("we", "us", or "our"), operates the OptimizeERP cloud-based enterprise resource planning platform and mobile application (collectively, the "Service"). The Service is designed for businesses operating in East Africa. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the Service.
The data controller responsible for your personal data under the Kenya Data Protection Act, 2019 ("DPA") and, where applicable, the EU General Data Protection Regulation ("GDPR") is:
| Category | Data Types | Purpose |
|---|---|---|
| Account Data | First name, last name, email address, hashed password, role assignments | Authentication, authorization, account management |
| Organisation Data | Organisation name, domain slug, subscription tier, feature flags | Multi-tenant isolation, service delivery |
| Business Data | Customers, suppliers, products, invoices, journal entries, inventory records | Core ERP functionality as requested by your organisation |
| Device Data | Expo push token, device platform (iOS/Android), app version | Delivering push notifications you opt into |
| Usage Data | API request logs, error logs, IP addresses | Service reliability, security monitoring, debugging |
We process personal data in accordance with the Kenya Data Protection Act, 2019 and, where applicable, the GDPR:
Our company is registered and operates from Kenya. All data is hosted on servers located in Germany (EU) to benefit from world-class infrastructure and EU-level data protection standards. We implement industry-standard security measures including:
We share data only with the following third-party services, solely for the purposes stated:
| Service | Purpose | Data Shared |
|---|---|---|
| Expo (expo.dev) | Push notification delivery | Expo push token, notification content |
| Cloudflare | CDN, DDoS protection, DNS | IP addresses, request metadata (not application data) |
We do not sell, rent, or trade your personal data to any third party.
We are registered in Kenya and our servers are located in Germany (EU). This means your personal data is transferred from East Africa to the European Union for storage and processing. Germany provides a high standard of data protection under the GDPR. We ensure that all international data transfers comply with the Kenya Data Protection Act, 2019 (including any guidance issued by the Office of the Data Protection Commissioner) and, where applicable, the GDPR.
Where third-party processors (e.g., Expo, Cloudflare) may process metadata outside Kenya or the EU, they do so under appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms.
Under the Kenya Data Protection Act, 2019 (and the GDPR where applicable), you have the right to:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
The mobile application does not use cookies or third-party analytics/tracking SDKs. The web endpoints use only essential session cookies required for authentication.
We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your data rights, contact:
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya (www.odpc.go.ke). If you are located in the European Union, you may also lodge a complaint with the data protection authority in the EU Member State of your habitual residence.