This notice explains how HelaPay ("we") handles your personal data, in line with Kenya's Data Protection Act, 2019. HelaPay is the data controller for the information described here.
1. What we collect
- Account data: your name, username, phone number, and password (stored only as an irreversible hash).
- Transaction data: amounts, references, dates, notes you write, and who you paid or were paid by.
- Security data: sign-in times, device information, IP address, and security events such as failed PIN attempts.
- Payment data: when you deposit, M-Pesa provides us a confirmation receipt. We never see or store your M-Pesa PIN.
2. Why we use it
- To operate your wallet — moving money, showing balances and history.
- To verify it's really you, and to detect fraud or unauthorised access.
- To send you transaction confirmations, security alerts and verification codes.
- To meet legal obligations, including record-keeping and anti-money-laundering requirements.
We do not sell your data, and we do not use your transaction history for advertising.
3. Who we share it with
Only where necessary: Safaricom (to process M-Pesa deposits and withdrawals), our SMS provider (to deliver codes and alerts), our hosting provider (to run the service), and regulators or law enforcement where the law requires it. Each receives the minimum needed to do its job.
4. How long we keep it
Financial records are retained for at least seven years, as required by Kenyan financial record-keeping law, even if you close your account. Security logs are kept for a shorter period.
5. How we protect it
Passwords and PINs are hashed, never stored in readable form. Traffic is encrypted in transit. Access is protected by PINs, device verification, rate limiting and account locking. No system is perfectly secure, but we take these obligations seriously and will notify you and the Office of the Data Protection Commissioner of any breach affecting your data, as required by law.
6. Your rights
Under the Data Protection Act you may request access to your data, correct inaccurate data, request deletion (subject to the retention rules above), object to certain processing, and lodge a complaint with the Office of the Data Protection Commissioner. To exercise any of these, email support@helapay.co.ke.
7. Children
HelaPay is not intended for anyone under 18. We do not knowingly open accounts for minors, and will close any account we discover belongs to one.
8. Changes
If we change this policy in a way that materially affects you, we'll tell you before it takes effect.
9. Contact
Questions about your data: support@helapay.co.ke