Privacy Policy

Last Updated: February 2026

1. Introduction

Deadan Group Limited ("DGL", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our DPOS platform and related services.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, phone number, business details
Payment Information: Billing address, payment method details (processed by secure payment providers)
Business Data: Customer records, transaction data, inventory information

2.2 Module-Specific Data Collection

Module	Data Collected	Purpose
Visitor Management (VMS)	Visitor names, ID numbers, photos, signatures, company information	Visitor registration, security, access control
Gym Management	Member names, contact info, health information, biometric data (fingerprints), attendance records	Membership management, access control, health tracking
Property Rental	Tenant names, ID numbers, bank details, employment information	Lease management, payment processing
BnB/Hotel	Guest names, ID documents, payment details, booking preferences	Reservation management, compliance
Dairy Logistics	Farmer names, ID numbers, bank account details, GPS coordinates	Collection management, payment settlements
Marketing	Contact information, communication preferences, engagement metrics	Marketing campaigns, customer engagement
E-commerce	Customer names, addresses, order history, payment information	Order fulfillment, delivery

2.3 Automatically Collected Information

IP addresses and device information
Browser type and operating system
Usage patterns and access times
Cookies and similar tracking technologies

2.4 Sensitive Data

We may collect sensitive personal data including:

Biometric Data: Fingerprint templates for gym access control (with explicit consent)
Health Information: Medical conditions relevant to gym membership
Identity Documents: National ID, passport copies for verification purposes
Financial Data: Bank account details for payment processing

Sensitive data is collected only with your explicit consent and for specific purposes.

3. How We Use Your Information

We use collected information to:

Provide and maintain our Services
Process transactions and send related information
Send administrative and service-related communications
Respond to inquiries and provide customer support
Improve and personalize your experience
Comply with legal obligations
Prevent fraud and enhance security

4. Legal Basis for Processing

We process personal data based on:

Contract: Processing necessary to fulfill our service agreement
Consent: Where you have given explicit permission (e.g., marketing, biometric data)
Legal Obligation: Compliance with applicable laws
Legitimate Interest: Improving our services and preventing fraud

5. Data Sharing and Disclosure

We may share your information with:

Service Providers: Payment processors, SMS/email providers, cloud hosting
Business Partners: With your consent, for integrated services
Legal Authorities: When required by law or to protect our rights

We do not sell your personal information to third parties.

6. Data Retention

We retain personal data for as long as necessary to:

Provide the requested services
Comply with legal obligations (e.g., tax records for 7 years)
Resolve disputes and enforce agreements

After the retention period, data is securely deleted or anonymized.

7. Your Rights

Under applicable data protection laws, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Limit how we process your data
Portability: Receive your data in a structured format
Object: Opt-out of certain processing activities
Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at privacy@dpos.co.ke.

8. Data Security

We implement appropriate technical and organizational measures including:

Encryption of data in transit and at rest
Access controls and authentication
Regular security assessments
Employee training on data protection
Incident response procedures

9. International Data Transfers

Your data may be processed in countries outside Kenya. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses where applicable.

10. Children's Privacy

Our Services are not intended for children under 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or through the Platform. Continued use after changes constitutes acceptance.

12. Contact Us

For privacy-related inquiries or to exercise your rights:

Email: privacy@dpos.co.ke
Data Protection Officer: dpo@dgl.co.ke
Address: Deadan Group Limited, Nairobi, Kenya

13. Regulatory Authority

You have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya if you believe your data protection rights have been violated.