Privacy Policy

1. Introduction

Sunny Payments Limited ("Sunny Payments," "we," "us," or "our") is a licensed Payment Service Provider regulated by the Central Bank of Kenya (CBK) under the National Payment System Act, 2011. We are committed to protecting your privacy and ensuring the security of your personal and financial information in compliance with the Kenya Data Protection Act 2019, the General Data Protection Regulation (GDPR), and the Payment Card Industry Data Security Standard (PCI DSS).

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our payment processing services, website, mobile applications, and APIs.

2.1 Personal Information

• Full name, date of birth, and national identification number
• Contact information (email address, phone number, physical address)
• Business registration details and KRA PIN (for business accounts)
• Bank account and mobile money account details
• Biometric data (where applicable for identity verification)

2.2 Payment Information

• Payment card numbers (encrypted and tokenized per PCI DSS requirements)
• Transaction history and payment details
• Billing and shipping addresses
• M-Pesa and mobile money transaction identifiers

2.3 Technical Information

• IP address, device type, browser type, and operating system
• Device identifiers and geolocation data
• API access logs and integration data
• Cookies and similar tracking technologies

We process your personal data for the following purposes:

4. Legal Basis for Processing

Under the Kenya Data Protection Act 2019 and GDPR, we process your data based on:

• Contractual Necessity: Processing required to provide our payment services
• Legal Obligation: Compliance with CBK regulations, AML laws, and tax requirements
• Legitimate Interest: Fraud prevention, security, and service improvement
• Consent: Where you have given explicit consent for specific processing activities

We may share your information with:

• Payment Networks: Visa, Mastercard, and M-Pesa for transaction processing
• Financial Institutions: Banks and mobile money operators as required
• Regulatory Authorities: CBK, Kenya Revenue Authority (KRA), and law enforcement when legally required
• Service Providers: Cloud hosting, fraud detection, and identity verification partners (under strict contractual obligations)
• Business Partners: Merchants and institutions you transact with (limited to transaction data)

We never sell your personal information to third parties.

We implement industry-leading security measures to protect your data:

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Transaction Records: 7 years (as required by CBK and tax regulations)
• KYC Documentation: 7 years after account closure
• Account Data: Duration of account plus 5 years
• Technical Logs: 12 months for security and debugging purposes

Under the Kenya Data Protection Act 2019 and GDPR, you have the following rights:

To exercise these rights, contact our Data Protection Officer at privacy@sunnypay.com

9. International Data Transfers

Your data may be transferred to and processed in countries outside Kenya, including for cloud hosting and payment network processing. We ensure adequate safeguards are in place, including:

• Standard Contractual Clauses approved by the Office of the Data Protection Commissioner (ODPC)
• Transfers to countries with adequate data protection levels
• Binding Corporate Rules where applicable

10. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or prominent notice on our website. Continued use of our services after changes constitutes acceptance of the updated policy.