1.0 Introduction

Evopay Limited is committed to protecting the fundamental right to privacy of those with whom we interact. We commit to always identify and document the lawful basis of processing your data for each specific purpose and put the necessary safeguards to ensure that the lawful basis is always applicable. This document seeks to state and explain the data we collect from our customers on Evopay applications, the reason behind the collection of the data, how the data is used, whether the data is disclosed to 3rd parties and in instances where it is disclosed, we explain the circumstances leading to the disclosure of the data.

2.0 Information Collected

Pursuant to legal and regulatory requirements and obligations, our customers are obliged to provide personal data to us. The personal data provided enables us to verify customer information so that the customers are availed with their chosen products or services. Failure to provide the required data may mean our failure to fulfil our obligations towards the provision of the said products and services. We collect, process, store and transfer different kinds of data about our customers and stakeholders. The data collected from the customer includes;

Type of Information and examples
 Identification And Contact Information e.g Name, telephone number, email address, social media accounts (where applicable)
General Information e.g Location, Vehicle License Plate Number(s)
Financial Information e.g M-Pesa details, Airtel Money details, Prepaid Card numbers
Audio-Visual Information e.g Photographs & videos
Information Relating to Specific Product Offering e.gThird party and in-app vouchers assigned and used, in-app Loyalty programs customer is privy to   
  
­­The data collected from stakeholders (Car parks and related stores) includes;     

Type of Information and Examples
Contact Information e.g Phone number, email, website
General Information e. g Name, location, Number of car parks, Opening and closing time, Stores Names, Store details
Audio-Visual Information e.g Images, videos
Information Relating to Specific Product Offering e.g In app Voucher & Loyalty program images
­Available stores e.g Stores Names, Opening and Closing times
Marketing materials e.g In app banner advertisement Images & Videos

3.0 How The Information Collected Is Used

The Data Protection Act and Regulations law allow us to use the data we collect as stipulated below on the basis that the processing is necessary for the performance of a contract with our customers or we are acting in our legitimate interests e.g. in the provision of our products and services.
3.1 Identification may be used for compliance with Know Your Customer (KYC) regulations and Customer Due Diligence (CDD).
3.2 The information collected may be used to facilitate payment of parking fees across parking facilities on the app.
3.3 Facilitated payments may be across the following payment platforms; M-Pesa, Visa, Paytech Prepaid parking card, In app Vouchers and Loyalty points.
3.4 Location information, both Customer and stakeholder, may be used to assist customers navigate to car parks and locate parking spots with ease and convenience.
3.5 Personalizing user experience on the app.
3.6  Available stores may be used to inform customers of stores and offer customers options based on proximity of the customer to various car parks.
3.7 We may send you emails on enhancements and improvements to our product and service offerings.
3.8 We may communicate updates to our terms of use and applicable policies.
3.9 Carrying out research and data analysis including customer satisfaction surveys and assessment of business risks in accordance with applicable law.
3.10 Providing marketing information and payment confirmations through in app push notifications, emails and text messages.
3.11 To respond to feedback queries and complaints submitted through calls, feedback forms and email.
3.12 Enforcing and defending legal right accruing due to the nature of business operations.

4.0 Legal Justification for collecting this information

4.1 To comply with applicable legal requirements e.g Know your customer (KYC), Customer Due Diligence (CDD) and requirement to avail information our regulators such as the Central Bank of Kenya (CBK).
4.2 To fulfil our contractual obligation in the offering of our products and services.
4.3 For public interest when complying with obligations set out by proceeds of Crime and Anti-Money laundering Act in relation to disclosure of your personal data.
4.4 For our legitimate interest such as undertaking research to enhance our products and services.

5.0 Disclosure Of Personal Information

We only use personal data for our internal business purposes as described above. We may disclose your data to a third party subject to your request or consent in furtherance of our legitimate interests. The table below provides some examples of whom we may share your personal data with.

Type Of Third Party and Examples
Group Companies e.g Evopark Limited
Government Authorities e.g We may share personal data with Regulators such as the Central Bank of Kenya in compliance with a legal requirement
Business Partners e.g Where legally permitted, including to establish, exercise or defend our legal rights, we may share personal data with third party service providers such as auditors, lawyers, accountants, banks, Safaricom and other business partners, third party vendors and outsourced service providers that assist in carrying out business activities.                                                                                                 

Further to the information in the table above:
5.1 We shall in all circumstances where feasible and legally justifiable seek consent prior to sharing personal data.
5.2 We shall however provide personal data whenever we are legally obligated to provide such information.
5.3 We shall not share personal data with any person or entity that is acting beyond the legal mandate.

6.0 How We Safeguard Personal Information

We have put in place appropriate physical, legal, technical and organizational measures to safeguard the personal data we collect on connection with our services. Such measures include requiring confidentiality from employees and other persons who handle personal data, information technology measures such as access control protocols and restrictions, system rights and firewalls.We process and store most personal data electronically and have put measures to ensure security of the data as described above. Information communication and technology (ICT) measures remain vulnerable to new and unforeseen risks however, we have and shall continue to deploy appropriate technical and organizational mechanisms to secure personal data.

7.0 International transfer of Personal Information

We shall only transfer your personal data outside Kenya or in any other jurisdiction we operate in accordance with applicable laws. We shall ascertain prior to any transfer that the transfer is based on the provided legal and regulatory standards. Circumstances in which we may transfer your personal data are highlighted in the table below.

Legal Basis and Examples
There being appropriate data protection safeguards with respect to the security and protection e.g Storage of your personal data in a cloud whose data server is located in American and European countries that have implemented the General Data protection Regulation (GDPR).     
An adequacy decision having been made by the Office of the Data Commissioner e.g Where the Data Commissioner has published of countries which have appropriate data protection safeguards and we decide to store your data in that jurisdiction in furtherance to our legitimate interest.

8.0 Retention Of Personal Data.

8.1 We shall will retain your personal data for as long as reasonably necessary to fulfill the purpose of collecting your personal data in the first place.
8.2 Failure to use the Evopay app for a period of 6 months makes it inactive hence leading to the deactivation of the app.

9.0 The customers Rights

9.1 Right to withdraw your consent to the processing of personal data. This right is not obsolete. We may reject it where we demonstrate that we have justifiable reasons for processing that would 
negate the customers interests e.g. where required by a government agency exercising their legal mandate.   
9.2 Right to restrict processing of personal data. The customer reserves the right to restrict processing of certain information. For example, the customer may choose to grant the Evopay app access to Location only while using the app as opposed to all the time.     
9.3 Right to access the Evopay app and update personal data. For instance, contact information such as email and phone number, License Plate numbers, Credit and Debit card Numbers and Prepaid parking card numbers. 
9.4 The customer has the right to request rectification of certain data where it is inaccurate or captured wrongly.   
9.5 Right to be informed that we are collecting their personal data.       
9.6 Right to access personal data anytime and seek to know how the information is being used. 
9.7 The customer reserves the right to object to receiving marketing emails and messages at any time by calling our help center (+254709 639 116/111) or sending us an email: contactcentre@evopay.africa
9.8 Right to data portability- you have the right to receive your personal information in a format that is machine readable and reusable.
9.9 Right to lodge complaint with the relevant authorities.
9.10 Right to erasure of data. This right gives you the power to delete of your personal data from our stored records.         

10.0 Enforcing Rights and Complaints

If a customer wishes to enforce any of their rights as provided by the Data Protection Act and attendant regulations, or lodge a complaint of any nature, they may contact us on our details in clause 13.0 below.

11.0 Non-Compliance With This Policy.

We may opt to terminate our agreement with a customer if there is failure to comply with any or all the provisions of this policy.

12.0 Right To Amend this Policy.

We maintain the right to amend this policy at any time in line with business and statutory requirements. All amendments or changes to this policy will be communicated and posted on our website www.evopayafrica.com.

13.0 Contact Us.

Incase of any queries in relation to personal data and how we protect customer rights, please contact us on the information below:  
Evopay Limited
Kabarsiran Gardens, off Kabarsiran Ave, Nairobi, Kenya.
P.O Box: 24858 - 00502
Website: www.evopay.africa
Email; info@evopay.africa
Office line; +254 724 270 270 
Contact centre; +254 709 639 116 / 111
Contact centre email: contactcentre@evopay.africa