The short version
- We collect only what we need to run MapleCore, support our customers and answer enquiries.
- When a business uses MapleCore to manage its own customers, tenants, borrowers or members, that business decides how their data is used. We process it on the business's instructions.
- We don't sell personal data. We send marketing only with consent, and you can opt out at any time.
- You have the right to access, correct and delete your data, to object, and to complain to the Data Protection Commissioner.
1. Who we are
This policy is issued by Maple Technologies Limited ("Maple", "we", "us"), a company registered in Kenya TODO(client): company registration number. We provide the MapleCore™ business platform, online shops, web hosting and domain services.
We are registered with the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019 TODO(client): ODPC registration certificate number(s), and whether they cover controller and processor.
Registered office: TODO(client): physical and postal address. Data protection contact: privacy@maple.co.ke TODO(client): name of the Data Protection Officer, if designated.
2. What this policy covers
This policy applies to personal data we handle through:
- this website, maple.ltd, and our sign-up pages;
- the MapleCore platform, including its web application, online shops and mobile apps;
- our web hosting and domain services;
- emails, SMS, chat and calls with our sales and support teams.
It does not cover websites or services run by others that link to or from ours, including websites our customers build or run with MapleCore. Those are covered by their owners' own privacy notices.
3. Our two roles: data controller and data processor
When we are the data controller
We decide why and how personal data is used for our own business: running our website, handling enquiries and sign-ups, managing customer accounts and billing, providing support and keeping the platform secure. For this data, we are the data controller and this policy explains what we do.
When we are the data processor
Businesses that use MapleCore ("our customers") store data about their own customers, tenants, occupants, owners, borrowers, policyholders, members, suppliers and staff. For that data, our customer is the data controller and Maple acts as their data processor: we process it only on their documented instructions and under our Terms of service.
If your details are held by a business that uses MapleCore, please contact that business first about your data. If you contact us, we will pass your request to them and help them respond.
4. Personal data we collect
Website visitors and people who contact us
- What you send us: your name, business name, phone number or email address, and your message, when you use our enquiry form (which opens your email or WhatsApp app), email us, message us or call us.
- Technical data: the IP address, browser type and pages requested, recorded in our hosting provider's standard server logs.
People who sign up or request a demo
- Name, business name, email address, phone number, number of employees and the page you came from.
- A bot-protection (CAPTCHA) check runs on the sign-up form to stop automated abuse.
Our customers and their users
- Account details: names, email addresses, phone numbers, job roles and the permissions of each person who uses MapleCore.
- Security data: sign-in history, two-step verification codes, audit trails of actions taken, and device and browser information.
- Billing data: invoices, payments, payment references and billing contacts.
- Support data: your messages and calls with our team, and anything you share to help us resolve an issue.
Data we process for our customers
Depending on the modules a customer uses, this can include contact details, transaction and payment records, account balances, delivery addresses and proof-of-delivery signatures, photos and locations, tenant and owner records, loan and savings records, insurance quotes, policies and claims, survey responses, documents such as leases and identification, and messages exchanged with them.
Some of this may be sensitive personal data under the Act, for example health information in medical insurance quotes and claims, family details of dependants, or property details. We process it only for the customer that collected it, on their instructions, with additional access controls.
5. How we use personal data, and why
We only use personal data where the Act gives us a lawful basis. As a data controller, we rely on the following.
| What we do | Lawful basis |
|---|---|
| Provide MapleCore, hosting and domain services, and manage your account | Performance of our contract with you |
| Answer enquiries, arrange demos and prepare quotes | Steps you asked us to take before a contract; our legitimate interest in responding |
| Send service messages, such as sign-in codes, invoices and outage notices | Performance of our contract |
| Keep the platform secure, prevent fraud and investigate misuse | Our legitimate interests; compliance with legal obligations |
| Keep financial and tax records | Compliance with legal obligations |
| Improve our products using usage information | Our legitimate interests, using aggregated or de-identified data where we can |
| Send news, offers and event invitations | Your consent, which you can withdraw at any time |
| Respond to lawful requests, and establish or defend legal claims | Compliance with legal obligations; our legitimate interests |
Where we rely on legitimate interests, we balance them against your rights and freedoms. Where we rely on consent, you can withdraw it at any time without affecting anything we did before.
6. Marketing messages
We send marketing by email, SMS or other channels only where you have agreed to receive it, or where the law otherwise allows us to. Every marketing message tells you how to stop receiving them, for example by replying STOP or using an unsubscribe link, and you can also email privacy@maple.co.ke. Opting out of marketing does not stop service messages about your account.
We do not sell personal data, and we do not share it with others for their own marketing.
8. Transfers outside Kenya
Our cloud infrastructure is located outside Kenya TODO(client): confirm the hosting region(s); the production configuration points to the United States, and some of our service providers operate in other countries. When personal data leaves Kenya, we do so only as Part VI of the Data Protection Act and the Data Protection (General) Regulations, 2021 allow, including by:
- using providers that give contractual commitments to protect personal data to a standard comparable to Kenyan law;
- encrypting data in transit and controlling who can access it;
- keeping records of the safeguards in place, which we can provide to the Data Protection Commissioner on request.
Sensitive personal data is transferred out of Kenya only with the consent of the person concerned and with appropriate safeguards confirmed. Where we process data as a processor, our customer is responsible for obtaining that consent, and we provide the safeguards.
9. How long we keep personal data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. In practice:
- Enquiries and demo requests that don't lead to an account: up to two years from our last contact TODO(client): confirm.
- Customer account and billing records: for the life of the account, then as long as tax and company law require us to keep financial records.
- Security logs and audit trails: as long as needed to protect the platform and investigate incidents TODO(client): set a period.
- Data we process for customers: as the customer instructs. When a customer leaves, we return or delete their data as set out in our Terms of service, unless the law requires us to keep it.
When data is no longer needed, we delete it or anonymise it so it can no longer identify anyone.
10. How we protect personal data
We build data protection into how MapleCore works. Our safeguards include:
- encryption of data in transit between your browser and our servers;
- permissions down to individual actions, so people only see and do what their role allows;
- two-step sign-in, CAPTCHA checks and lockouts after repeated failed sign-ins;
- audit trails that record sign-ins and important actions;
- secure file storage opened through short-lived links, with risky file types blocked;
- maker-checker approval for sensitive actions such as payouts;
- regular backups, and staff access limited to those who need it, under confidentiality obligations.
No system is completely secure, so please keep your sign-in details private and tell us straight away if you think your account has been misused.
11. If something goes wrong
If we become aware of a personal data breach that creates a real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires, and tell the people affected without undue delay, with advice on steps they can take.
Where we act as a processor, we will notify the affected customer without delay, and where reasonably practicable within 48 hours of becoming aware of the breach, so that they can meet their own obligations.
12. Your rights
Under section 26 of the Data Protection Act and related provisions, you have the right to:
- be informed of how your personal data is used;
- access the personal data we hold about you;
- object to the processing of all or part of your personal data, including for direct marketing;
- have false or misleading data corrected;
- have false, misleading or unlawfully processed data deleted;
- ask us to restrict processing in certain circumstances;
- receive your data in a structured, commonly used format and have it moved to another provider (data portability), where this applies;
- not be subject to a decision based solely on automated processing that significantly affects you, except where the law allows;
- withdraw consent at any time, where we rely on consent.
13. How to use your rights
Email privacy@maple.co.ke with your request. We may ask you to confirm your identity before we act, so that we never disclose data to the wrong person. Requests are free of charge, and we will respond within the time limits set by the Data Protection (General) Regulations, 2021. If we cannot do what you ask, we will explain why.
If your request is about data a business holds in MapleCore, we will forward it to that business, which is responsible for responding, and help them do so.
14. Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal data from children for our own purposes. Where a customer uses MapleCore to process data about children, for example dependants on a medical cover, that customer is responsible for obtaining the consent of a parent or guardian as the Act requires, and we process the data only on their instructions.
16. Automated decisions
Maple does not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Some customers configure rules in MapleCore, for example lending limits; in that case the customer is responsible for meeting the Act's requirements on automated decision-making, including offering human review.
17. Changes to this policy
We may update this policy as our services or the law change. We will change the "last updated" date above and, for significant changes, tell customers by email or in MapleCore before they take effect.
18. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at privacy@maple.co.ke so that we can try to put it right.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya's data protection regulator, at www.odpc.go.ke.
19. Contact us
- Data protection and privacy requests: privacy@maple.co.ke
- General enquiries: info@maple.co.ke
- Post: Maple Technologies Limited, TODO(client): postal address
This policy should be read together with our Terms of service.