Data Protection Policy

Effective Date: April 2026

This Data Protection Policy describes the technical and organizational measures implemented by Kappanetics Limited (“SumsPOS”) to protect the personal data and business data of our customers, their staff, and their end-customers. This policy is informed by Kenya's Data Protection Act, 2019 and international best practices including GDPR principles.

1. Data Protection Principles

SumsPOS processes all personal data in accordance with the following principles:

• Lawfulness, fairness, and transparency: Data is processed lawfully and transparently, with clear information provided to data subjects.
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.
• Data minimization: Only data that is necessary for the stated purpose is collected.
• Accuracy: Reasonable steps are taken to ensure data is accurate and kept up to date.
• Storage limitation: Data is retained only for as long as necessary for its purpose.
• Integrity and confidentiality: Data is processed with appropriate security measures.
• Accountability: We demonstrate compliance with these principles through our policies, procedures, and audit trails.

2. Data Controller and Processor Roles

Kappanetics Limited (SumsPOS) acts as a Data Processor on behalf of our customers. Our customers (business owners) are the Data Controllers for the personal data of their staff and end-customers that is entered into SumsPOS.

For account data (tenant registration, billing), Kappanetics Limited acts as both Data Controller and Data Processor.

3. Technical Security Measures

3.1 Encryption

• Data in transit: All communication encrypted with TLS 1.2+ (HTTPS). gRPC traffic between internal services encrypted.
• Data at rest: Sensitive data (payment API keys, webhook secrets) encrypted with AES-256-GCM. Database connections use SSL.
• Password storage: User passwords hashed with bcrypt (cost factor 12). Staff PINs hashed with bcrypt (cost factor 10). Plaintext passwords are never stored or logged.
• Token storage: Session tokens stored as SHA-256 hashes. Raw tokens are never persisted to the database.

3.2 Access Control

• Multi-tenant isolation: PostgreSQL Row-Level Security (RLS) ensures each tenant's data is completely isolated at the database level. Cross-tenant data access is architecturally impossible.
• Role-based access control (RBAC): 23 permission modules with 26 granular actions. Each user can only access features permitted by their role.
• Session management: Sessions expire after 8 hours. Device-based tracking ensures one active session per device. Sessions can be revoked by administrators.
• Rate limiting: Brute-force protection on login (5 attempts, 15-minute lockout). API rate limiting per tenant.

3.3 Audit and Monitoring

• Immutable audit log: Every data-modifying action is recorded in an append-only audit trail. The audit log cannot be modified or deleted. Records include: who, what, when, before/after state, IP address, and device.
• Retention: Audit logs retained for 7 years, partitioned by month, with old partitions archived to secure cold storage.
• Monitoring: Application metrics, error rates, and security events are monitored. Anomaly alerts are configured for suspicious activity.

3.4 Infrastructure Security

• Services deployed in Docker containers with minimal attack surface (distroless base images)
• Database access restricted to application services only (no public exposure)
• Environment secrets managed via environment variables, never committed to source code
• Regular dependency vulnerability scanning

4. Organizational Security Measures

• Principle of least privilege: Team members have access only to data and systems necessary for their role.
• Incident response: We maintain an incident response procedure for data breaches. In the event of a breach, affected data subjects and the relevant authorities will be notified within 72 hours.
• Data Protection Impact Assessments (DPIA): Conducted for new features or processing activities that may present high risks to data subjects.

5. Data Backup and Recovery

• Daily backups: Automated PostgreSQL backups to secure cloud storage. 30 daily backups retained.
• Weekly backups: Full database snapshots. 12 weekly backups retained.
• Write-Ahead Log (WAL) archiving: Continuous archiving for point-in-time recovery. Recovery Point Objective (RPO): less than 5 minutes.
• Recovery testing: Backup restore tested weekly to verify data integrity.
• Recovery Time Objective (RTO): Less than 1 hour for full service restoration.

6. Data Retention Schedule

7. Data Subject Rights

In accordance with Kenya's Data Protection Act, 2019, data subjects have the right to:

• Be informed about how their data is collected and used
• Access their personal data
• Rectify inaccurate data
• Delete their data (right to erasure), subject to legal retention requirements
• Object to processing
• Data portability: receive data in a structured, machine-readable format
• Not be subject to automated decision-making without human involvement

Business owners (our customers) can exercise these rights through their SumsPOS dashboard or by contacting us. End-customers should contact the business that collected their data, who can then manage the request through SumsPOS.

8. International Data Transfers

SumsPOS's primary infrastructure is hosted in data centers with appropriate security certifications. When data is transferred internationally (e.g., for card-payment processing), we ensure appropriate safeguards are in place, including:

• Standard contractual clauses with data processors
• Verification that receiving jurisdictions have adequate data protection laws
• Technical measures (encryption) that protect data regardless of jurisdiction

9. Breach Notification

In the event of a personal data breach:

1. The breach will be contained and assessed immediately
2. The Office of the Data Protection Commissioner (Kenya) will be notified within 72 hours if the breach poses a risk to data subjects
3. Affected data subjects will be notified without undue delay if the breach poses a high risk to their rights and freedoms
4. A breach record will be maintained in the audit log, documenting the nature of the breach, data affected, and remedial actions taken

10. Sub-Processors

SumsPOS uses the following sub-processors to deliver the service:

11. Compliance

This Data Protection Policy aligns with:

• Kenya Data Protection Act, 2019
• EU General Data Protection Regulation (GDPR): for customers in the EU/EEA
• Nigeria Data Protection Regulation (NDPR): for customers in Nigeria
• South Africa Protection of Personal Information Act (POPIA): for customers in South Africa

12. Policy Review

This policy is reviewed annually or whenever significant changes are made to our data processing activities. Updates will be communicated to customers and published on this page.

13. Contact