Privacy Policy

Last updated: 8 November 2026 · Version 3.2

1. Who we are

Beeper Software Solutions ("Beeper", "we", "us") is a business registered in Kenya, operating from The Address Building, Room 7CB, Muthangari Drive, Westlands, Nairobi, Kenya. We are the data controller for personal data collected through this website and in the course of our commercial relationship with customers, prospective customers and partners.

Where we operate the Beeper platform on behalf of a customer, that customer is the data controller of the personal data processed in the platform, and we act as its data processor under the terms of our data processing agreement.

2. Scope of this policy

This policy applies to:

• visitors to beepersoftware.shop and any associated subdomains;
• prospects and customer contacts who enquire, request a demonstration, receive a proposal or sign an agreement with us;
• suppliers, partners and contractors who work with us;
• individuals who contact our support or client operations teams.

It does not govern personal data processed inside the Beeper platform on behalf of a customer — for example, a merchant's own customers, cashiers or loyalty members. Those arrangements are governed by the customer's own privacy notice and our data processing agreement with them.

3. Personal data we collect

We aim to collect the minimum needed to operate commercially. Categories include:

• Contact details — name, job title, company, business email address, telephone number, country.
• Enquiry content — the message you send us, the products or modules you are interested in, and the number of locations you operate.
• Commercial records — proposals issued, agreements signed, invoices raised and payments received.
• Support records — communications with our support team, including any attachments you choose to send.
• Technical data — IP address, browser type, device type, pages visited and referring source, collected through server logs and, where enabled, privacy-respecting analytics.
• Account and access data — user names, roles, authentication events and audit records for the platform's administrative interfaces.

We do not collect payment card numbers through this website. We do not seek special category data, and we ask that you do not include it in enquiry messages.

4. Purposes and lawful bases

We process personal data for the following purposes:

• Responding to enquiries and providing demonstrations — on the basis of our legitimate interests in pursuing business relationships, or on steps taken at your request before entering a contract.
• Performing our contracts — delivering implementation, subscriptions and support to customers.
• Billing and financial administration — invoicing, collections, tax reporting and audit, as required by contract and law.
• Improving our services — analysing aggregate usage of the website and non-identifying product telemetry to improve reliability and usability, on the basis of legitimate interests.
• Security and fraud prevention — maintaining logs, detecting abuse and protecting our systems.
• Marketing communications — where you have opted in, or where we have an existing business relationship and the law permits, with an unsubscribe option in every message.
• Legal obligations — record-keeping, responding to lawful requests and enforcing our rights.

5. Data we process on behalf of customers

When a customer subscribes to the Beeper platform, we process transaction, customer, inventory and staff records on that customer's instructions. In that role we:

• process data only to provide the service and as documented in the data processing agreement;
• apply technical and organisational measures described in section 10;
• assist the customer in responding to data subject requests;
• notify the customer without undue delay on becoming aware of a personal data breach;
• return or delete data at the end of the arrangement, subject to statutory retention obligations.

Card payment data is captured by certified payment processors and terminal estates and does not enter the Beeper platform. We retain only tokenised references, authorisation outcomes and settlement lines required for reconciliation.

6. Cookies and similar technologies

This website uses a small number of strictly necessary cookies and local storage entries to preserve interface state, such as whether a navigation panel is open. We do not use advertising cookies, cross-site tracking pixels or third-party profiling on this site.

Our public pages load web fonts from Google Fonts, which means your browser requests files from Google's infrastructure and your IP address is visible to that provider. If you prefer to avoid this, we can supply a self-hosted build on request.

7. Sharing and sub-processors

We share personal data only where necessary, and with safeguards in place:

• Infrastructure and hosting providers — for compute, storage, backups and email delivery.
• Payment and finance providers — for invoicing, card processing and collections. Card payments are handled by PCI DSS certified providers.
• Communication providers — for transactional email and support ticketing.
• Professional advisers — auditors, legal counsel and insurers, under duties of confidentiality.
• Authorities — where required by law or to protect legal rights.

A current list of sub-processors relevant to your subscription is available under NDA and is maintained with change notifications in line with our data processing agreement. We do not sell personal data.

8. International transfers

We are based in Kenya and serve customers in several markets. Where personal data is transferred outside the jurisdiction in which it was collected, we rely on appropriate safeguards — contractual data protection clauses, documented vendor assessments and, where applicable, regional hosting placement chosen to satisfy local law.

9. Retention

We keep personal data only as long as necessary for the purpose it was collected:

• Website enquiries — up to 24 months from the last contact, then deleted or anonymised.
• Customer and contract records — for the duration of the agreement and for the statutory period required for tax and company record-keeping afterwards.
• Support communications — up to 36 months after the ticket closes, for continuity and quality review.
• Platform data of customers — per customer instruction; 30 days after termination by default, then deletion with a certificate available on request.
• Security and access logs — typically 12 months, longer where an incident investigation requires it.

10. Security

We apply encryption in transit and at rest, role-based access with least-privilege defaults, mandatory multi-factor authentication for staff, time-bound production access with approval and session logging, immutable audit journals, and tested backup and restore procedures. Our engineering team maintains an internal vulnerability remediation standard by severity, and we commission an annual third-party penetration test.

No system is entirely without risk. If a breach affecting personal data occurs, we follow our incident response plan and notify affected parties and regulators as required.

11. Your rights

Depending on your jurisdiction, you may have the right to:

• be informed about how your data is processed;
• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure where there is no continuing lawful basis for processing;
• restrict or object to processing, including direct marketing;
• request portability of data you provided to us;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with your supervisory authority, including the Office of the Data Protection Commissioner in Kenya.

Requests can be made to [email protected]. We respond within 30 days and may ask for information to verify your identity. If your request concerns data we process on behalf of a merchant customer, we will refer the request to that customer, or assist them in responding, as appropriate.

12. Marketing

We send commercial email to business contacts who have requested information, who are existing customers, or where the law otherwise permits. Every message includes a working unsubscribe link, and unsubscribing does not affect transactional or contractual communications about an active subscription.

13. Changes to this policy

We review this policy at least annually. Material changes are published on this page with an updated version number, and where the change affects customers under contract we will notify the nominated administrative contact by email before it takes effect.

14. How to contact us

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (Kenya) or, where GDPR applies, to the supervisory authority in the EU member state where you live or work.