Privacy notice

Who we are

EcoTrack is run by [Company legal name], [Company address] (“we”). We decide how your personal data is used, which makes us the data controller under the Data Protection Act, 2019 of Kenya. For privacy questions write to [privacy email address] or call 0759 657 590.

If you use EcoTrack through your employer or another organisation, that organisation also decides how it uses the records you create. Ask them as well.

What we collect

• Your account: name, email address, phone number, role, the organisation you belong to, and when you last signed in.
• Your work in EcoTrack: pickups and weights you record, the time and place of each (the location of your phone when you save a pickup, if you allow it), routes, vehicle and facility records, reports and messages you send.
• Payment details where used: phone numbers used for M-Pesa payments and the status of those payments. We do not see your M-Pesa PIN.
• People and payroll records: where an organisation uses the HR and payroll features, details about its staff such as pay, tax and statutory deductions. Only that organisation’s authorised staff can see them.
• Security records: a log of important actions (sign-ins, changes, exports) with the time and your internet address, so that misuse can be found and traced. The log is chained so that any change to it shows up.
• Residents and clients: if you use the community or client portal, the details you give when you report a problem or request a service.

Why we use it

• To run your account and the waste tracking, billing, payroll and reporting you use EcoTrack for.
• To keep the service secure and to detect misuse.
• To send messages about your account and your work, such as invitations, password resets, invoices and reminders, by email or SMS.
• To meet legal duties, for example the records that waste regulators and tax authorities require.

We do not sell personal data and we do not use it for advertising.

Who else handles it

We use other companies to run parts of the service. They receive only what that part needs.

• Our hosting and database provider: [hosting provider and country].
• Safaricom (M-Pesa), when you pay or receive a payment through the service.
• Africa’s Talking, to send SMS, and our email provider, to send email.
• Anthropic, only if your organisation switches on the AI assistant: the question you ask and the records needed to answer it are sent to produce the answer.
• Your organisation’s administrators and, where the law requires it, regulators and authorities.

If personal data is processed outside Kenya, we do it only with the safeguards the Data Protection Act requires.

How long we keep it

We keep records for as long as your account is active and for [retention period, for example 7 years] afterwards where the law or tax rules require it. The security log is kept for [period]. After that we delete the data or remove what identifies you.

How we protect it

• Connections are encrypted. Passwords are stored as one-way hashes, never as text.
• Administrators and finance staff must use two-step sign-in. Anyone can turn it on.
• People only see what their role allows, and what belongs to their own organisation.
• Backups are taken [how often] and kept [where].

No system is perfectly safe. If a breach is likely to harm you we will tell you and the Data Protection Commissioner within the time the law sets.

Your rights

You may ask to see the personal data we hold about you, to have it corrected, to have it deleted, to object to some uses, or to receive a copy. Write to [privacy email address]. We will reply within the time the Data Protection Act sets. Some records must be kept by law, and we will tell you if that applies.

If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Cookies and storage on your device

EcoTrack uses one cookie to keep you signed in. It is needed for the service to work, and it ends when you sign out or after 12 hours. We also store your theme choice, your menu state and, on phones, pickups waiting to be sent and recently opened pages, so the app works with a weak signal. Signing out removes the saved pages. We do not use advertising or tracking cookies.

Changes

If we change this notice in a way that matters, we will tell you in the app. The date at the top shows the latest version. See also the terms of use.