Privacy Policy

1. Information we collect

Account and contact data

When you sign up, request a demo, subscribe or contact us, we collect your name, company name, job title, email address, phone number, country, preferred language and, for billing, your company's KRA PIN and billing address.

Google sign-in

If you sign in with Google, Google shares your name, email address, profile photo and a confirmation that your email is verified. We do not receive your Google password or access your Gmail, Drive or contacts.

Copilot requests

When you use Copilot with an external AI assistant, the question you type and the information the task needs (for example summarised sales figures, or the one invoice, ticket or receipt photo you chose) are sent to the AI provider your administrator selected. We keep a count of requests per user for usage limits, not the content.

Payment data

For M-Pesa payments we receive the transaction code, amount, paying phone number, payer name and account number from Safaricom. Card and PayPal payments are handled entirely by our PCI-DSS compliant payment providers; we never receive or store full card numbers. If you choose auto-renewal, we keep only a payment token issued by the provider.

Job application data

If you apply for a job at Braysons, we collect your contact details, CV, cover letter and any information you choose to share during interviews. We do not ask for sensitive personal data such as ethnic origin, religion or health information unless the law requires it.

Website and device data

When you visit our website or log in, our servers record your IP address, browser type and language, the pages you visit, the time of your visit and the referring page. We use a session cookie to keep you logged in. See Cookies.

Support and communication data

When you contact support by email, chat, phone or WhatsApp, we keep a record of the conversation and any files you send, so we can solve the issue and improve our help content.

2. How we use your information

• To create and run your G-amini database, provide support and keep the service secure.
• To issue eTIMS-compliant invoices, collect payments, match M-Pesa payments to invoices and send receipts.
• To send service messages, such as renewal reminders, security notices and changes to our terms.
• To send product news and event invitations, where you have agreed or where we have a legitimate interest. Every marketing email and SMS has an opt-out.
• To introduce you to a Braysons implementation partner when you ask for one.
• To understand how the website and product are used, in aggregated form, so we can improve them.
• To assess job applications and, if you join us, to onboard you.

We do not sell personal data, and we do not use the business data in your G-amini database to train AI models.

3. Lawful basis for processing

4. Data in your G-amini database

The records you and your team enter into G-amini ERP, such as customers, employees, payslips and invoices, belong to your organisation. For that data your organisation is the data controller and Braysons is a data processor acting on your instructions under our Data Processing Terms. Braysons staff access a customer database only when you ask for support, or when needed to protect the security of the service, and every access is logged.

G-amini includes tools that help you meet your own obligations: consent records and opt-out lists for marketing, export and anonymisation of a contact's data, retention rules and access logs.

5. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• object to processing, including for direct marketing;
• have inaccurate data corrected and false or misleading data deleted;
• request deletion of data we no longer have a lawful reason to keep;
• receive your data in a portable format.

You can update most account details yourself under My Account. For anything else, email info@g-amini.co.ke. We respond within 7 days where possible and in any case within the time the law allows. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC).

6. Service providers we use

We share personal data with service providers only as needed to run the service, under written contracts that require them to protect it.

We may also disclose data where the law requires it, for example in response to a valid court order, and we will tell you about such a request unless we are prohibited from doing so.

7. How long we keep data

8. Where your data is stored

G-amini Cloud is hosted with major cloud providers. Customers who need their data to remain in Kenya can choose our Kenyan data-centre hosting option. Where data is transferred outside Kenya, we do so only where the receiving country or organisation provides appropriate safeguards, as required by Part VI of the Data Protection Act, 2019.

AI providers may process Copilot requests outside Kenya. Administrators decide which providers are enabled and can turn Copilot off entirely. Providers' terms on retaining and using API data differ, and free tiers may allow data to be used to improve their models, so administrators should review each provider's current terms and use paid business API accounts before enabling it.

9. Cookies

Cookies are small files that a website stores in your browser. We use as few as possible.

You can delete or block cookies in your browser settings. Blocking session cookies will stop you logging in.

10. Children

G-amini ERP is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. Customers who process children's data in their own databases, for example schools, are responsible for obtaining the consent required by section 33 of the Act.

11. Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the latest version. We will email customers about significant changes before they take effect.

12. Contact us

Data Protection Officer, Braysons Group Ltd, Signature Mall, Nairobi, P. O. Box 6084-00100, Nairobi. Tel +254 733 338 989
Email: info@g-amini.co.ke

You can also contact the Office of the Data Protection Commissioner (ODPC) in Nairobi about how your personal data is handled.