Last updated: 14 October 2025

This Privacy Policy explains how Sentibooks (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use our website at sentibooks.com and our bookkeeping application (together, the “Service”).

We are the data controller for personal data processed through the Service, and we are registered as a data controller with the Office of the Data Protection Commissioner of Kenya as required by the Data Protection Act, 2019.

1. Data we collect

Account and identity data. When you sign up, we collect your name, business name, email address, phone number, and KRA PIN.

Billing data. To process subscriptions, we collect your billing address and payment details through our payment processors. We do not store full card numbers on our servers.

Business data. When you use the app, we store the records you create: customer details, invoices, quotations, expenses, inventory, employee records, and accounting entries.

Usage and technical data. We automatically collect IP address, browser type, device type, operating system, and pages visited within the Service for security, analytics, and product improvement.

Communications. If you contact us by email or through our contact form, we retain the correspondence.

2. Lawful basis

We process personal data on the following lawful bases under Section 30 of the Data Protection Act, 2019:

Contract performance: to provide the Service you have signed up for
Legal obligation: to comply with KRA, employment, and other statutory requirements
Legitimate interests: to improve the Service, prevent fraud, and secure our systems
Consent: where you have explicitly opted in (for example, marketing emails)

You can withdraw consent at any time by contacting us.

3. How we use your data

We use your data to provide, operate, and maintain the Service, process payments and send invoices, respond to your enquiries and support requests, send service notices such as downtime and billing reminders, detect and prevent technical or security issues, comply with legal obligations, and improve product features based on aggregate usage patterns.

We do not sell your personal data to third parties, and we do not use your business records for advertising.

We share personal data only with service providers who help us run the Service (cloud hosting, payment processing, email delivery, and analytics), professional advisers such as lawyers and auditors when required, and regulators and law enforcement where we are legally compelled, such as a KRA request or a court order.

Where we share data with service providers, we require them to protect it under contractual terms consistent with this Policy and the Data Protection Act.

5. Cross-border transfers

Some of our service providers process data outside Kenya. Where this happens, we ensure the transfer is made under the safeguards required by the Data Protection Act, including the use of standard contractual clauses or transfer to jurisdictions with an adequacy determination.

6. Data retention

We retain personal data for as long as your account is active. After account closure, accounting records are retained for 7 years in line with KRA requirements, customer and transaction records you have created are retained for as long as you keep an active backup or export, and account data is deleted within 90 days of closure unless retention is required by law.

You may export your data at any time before closure.

7. Your rights

Under the Data Protection Act, 2019, you have the right to be informed about how we use your data, to access the personal data we hold about you, to correct inaccurate or incomplete data, to delete your personal data subject to legal retention requirements, to object to processing in certain circumstances, to restrict processing in certain circumstances, to data portability, and to lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these rights, email us at privacy@sentibooks.com. We will respond within 30 days.

8. Security

We protect personal data with encryption in transit using TLS, encryption at rest for stored data, access controls and role-based permissions, audit logging of sensitive operations, two-factor authentication for admin accounts, and regular backups and security reviews.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

9. Cookies

Our website uses cookies for essential functions like keeping you logged in and remembering preferences, and for analytics to understand how visitors use the site in aggregate.

You can disable cookies in your browser settings. Some parts of the Service may not work without essential cookies.

10. Children

The Service is not intended for use by anyone under 18. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or through a prominent notice in the Service at least 14 days before they take effect.

12. Contact

For privacy questions or to exercise your data rights:

Email: privacy@sentibooks.com Postal: Sentibooks, Nairobi, Kenya

For complaints that we cannot resolve, you may contact the Office of the Data Protection Commissioner at odpc.go.ke.