Privacy Policy.

Who is responsible for personal data?

PrintPay API (“PrintPay,” “we,” “us,” or “our”) is operated by [LEGAL BUSINESS NAME], located at [BUSINESS ADDRESS]. For privacy questions, contact bestchoicenetworks@gmail.com.

Depending on the data flow, PrintPay may process information for its own account, security, support, and service operations, or process transaction information on behalf of a business customer. The business customer may decide why its customers’ or recipients’ information is collected and how it is used. The parties’ responsibilities may be further described in a separate data-processing agreement.

Personal data we may collect

Depending on how you use the Services, we may collect:

• Account and business details: name, business name, email address, phone number, account identifiers, and information used to configure or verify an account.
• Transaction information: transaction references, amounts, currency, payment status, timestamps, service type, and relevant payment-provider responses.
• Customer or recipient details: information submitted by a business to request or reconcile a payment, which may include a mobile phone number and transaction details required for the workflow.
• Technical and security information: IP address, browser or device details, access logs, API activity, error reports, and security events.
• Support communications: messages and information you provide when contacting us.
• Cookies and similar technologies: information used for necessary site functionality, security, and—if enabled—analytics or preferences.

We do not need your customer’s M-PESA PIN to initiate an STK Push. Never send PINs or secret credentials to support.

How we use personal data

We may use personal data to:

• Create and administer accounts and provide the Services.
• Initiate and manage supported C2B/STK Push requests and B2C payout requests.
• Provide transaction status, callbacks, records, and customer support.
• Secure accounts and systems, investigate errors, and detect suspected fraud or misuse.
• Meet legal, regulatory, accounting, and payment-provider requirements.
• Send service notices, security alerts, and important updates.
• Maintain and improve the Services using appropriate safeguards.

We process personal data for identified purposes and where an appropriate legal basis applies. Depending on the activity, this may include providing a requested service, meeting a legal obligation, pursuing legitimate interests where permitted, or relying on consent where required.

C2B collections and B2C payouts

For C2B/STK Push, a business may submit information needed to request a customer payment and receive transaction updates. The customer approves the payment through the applicable payment provider’s process.

For B2C, a business may submit information needed to request a payout to a recipient. We may process transaction references, amounts, status, customer or recipient details, and provider responses to operate the requested workflow and maintain transaction records.

Payment processing and settlement depend on the relevant provider’s systems, rules, and arrangements. Independent payment providers may handle information under their own privacy notices.

When we share personal data

We may share relevant information with:

• Payment providers and financial institutions where needed to process, verify, settle, investigate, or support a transaction.
• Service providers that help us operate hosting, security, communications, and technical support.
• Your business or organisation where you are connected with its account or transaction.
• Authorities or other parties where required by law or valid legal process, or where necessary to protect rights, safety, and security.
• Business transfer parties if we are involved in a merger, restructuring, or transfer, subject to appropriate safeguards and applicable law.

We do not sell personal data.

Service providers and international transfers

Our service providers may include payment providers, hosting or cloud services, email or customer-support services, and security providers. Complete this list with the providers you actually use:

• Payment provider: [ADD ACTUAL PROVIDER]
• Hosting or cloud provider: [ADD ACTUAL PROVIDER]
• Email or support provider: [ADD ACTUAL PROVIDER]

If personal data is transferred outside Kenya, we will use the safeguards and legal basis required by applicable law. Contact us for information about relevant safeguards, subject to lawful limits.

How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the Services, maintaining transaction records, resolving disputes, preventing fraud, and meeting legal or provider requirements.

Add your actual retention periods or criteria here. For example, specify how long you retain account records, transaction logs, support messages, and security logs: [ADD YOUR RETENTION PERIODS OR CRITERIA]. When information is no longer required, we will delete it, anonymise it, or securely restrict access, subject to applicable law.

How we protect data

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. No online service or transmission method can be guaranteed completely secure.

You are responsible for protecting your account credentials and keeping API secrets on your server, not in public or client-side code.

Your privacy rights and choices

Subject to applicable law, you may have the right to request access to, correction of, or deletion of personal data; object to or request restriction of certain processing; withdraw consent where processing relies on consent; or complain to the relevant data protection authority.

To make a privacy request, email bestchoicenetworks@gmail.com. We may need to verify your identity. If a business customer submitted your information and controls the relevant processing, we may direct you to contact that business. Some information may need to be retained where required by law or for legitimate transaction, security, or dispute purposes.

Cookies and similar technologies

Our website may use cookies needed for functionality, security, or remembering preferences. If we use analytics or advertising cookies, add details about those cookies, the providers, and any controls available: [ADD YOUR ACTUAL COOKIE AND ANALYTICS DETAILS].

You can manage cookies through your browser settings. Disabling essential cookies may affect how parts of the website work.

Children’s information

The Services are intended for businesses and their authorised users, not for children to create accounts. If you believe a child’s personal data has been provided to us, contact us so we can assess and address the request under applicable law.

Changes to this policy

We may update this Privacy Policy to reflect changes to our Services, data practices, or legal requirements. We will publish the updated policy on this page and provide additional notice or request consent where required.