1. Who We Are
GroupYetu360 is a community management platform operated by EPH Technologies Limited, a company incorporated in Kenya (Registration No. PVT-RXUMLM2Q), with registered offices at Western Heights, Karuna Road, Westlands, Nairobi.
For all privacy matters, contact us at: info@groupyetu.org
2. Information We Collect
2.1 Information you provide directly
- Full name, email address, phone number and ID number (for member registration)
- Organisation name, registration number and contact details (for group administrators)
- Financial information including contribution amounts, payment references and bank balance figures entered by administrators
- Meeting records, welfare event details and project information
- Messages and communications sent through the platform's SMS feature
2.2 Information collected automatically
- Login activity and session data
- Device type, browser type and IP address
- Pages visited and features used within the platform
- Error logs and performance data
2.3 Information from third parties
- Google Sign-In: If you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password.
- Payment partners (Paystack, Fingo Africa, SasaPay): When Instant Pay is enabled by your organisation, we receive payment confirmation data including transaction reference, amount and phone number. We do not store your M-Pesa PIN or full M-Pesa account details.
- Celcom Africa: SMS delivery status and recipient data for bulk messages sent through the platform.
3. How We Use Your Information
We use your personal data only for the following purposes:
- To operate and provide the GroupYetu360 platform to you and your organisation
- To authenticate your identity and manage your account, including two-factor authentication where enabled
- To process and record financial contributions and payments
- To send SMS notifications you or your administrator have requested
- To provide customer support and respond to your enquiries
- To improve the platform through analysis of aggregate usage patterns
- To comply with legal obligations under Kenyan law
We do not sell your personal data to any third party. We do not use your data for advertising.
4. Data Storage and Security
Your data is stored securely on Supabase infrastructure, which uses PostgreSQL databases hosted on AWS with encryption at rest and in transit (TLS 1.2+). Supabase is SOC 2 Type 2 certified.
We implement the following security measures:
- Row-level security (RLS) ensuring organisations can only access their own data
- Role-based access control - members see only their personal data; admins manage their organisation only
- Optional two-factor authentication (2FA) for admin, treasurer and superadmin roles - a one-time verification code is generated and emailed to your registered account email via our email provider, Resend, and expires after 5 minutes
- All passwords are hashed and never stored in plain text
- API keys and credentials are encrypted at the database level
- HTTPS enforced on all connections
5. Data Sharing
We share your data only with the following parties, strictly to provide our service:
- Supabase Inc. - Database and authentication infrastructure provider
- Paystack, Fingo Africa and SasaPay - For processing Instant Pay member contributions where enabled by your organisation. Fingo Africa and SasaPay also disburse collected funds to organisations on our behalf - see our Terms of Service for how this works
- Safaricom PLC - As the underlying mobile network operator for M-Pesa transactions initiated through our payment partners
- Celcom Africa - Our SMS delivery partner for bulk notifications
- Resend - Transactional email delivery, including account verification and two-factor authentication codes
- Google LLC - For Google Sign-In authentication
We may disclose your data to law enforcement or regulatory authorities if required to do so by Kenyan law or a valid court order.
6. Member Data and Organisation Responsibility
When an administrator registers member data (names, phone numbers, financial records) on GroupYetu360, that administrator and their organisation are the data controllers for that member data. EPH Technologies Limited acts as the data processor.
Organisations using GroupYetu360 are responsible for:
- Obtaining consent from members before registering their personal data
- Ensuring member data is accurate and up to date
- Informing members that their data is managed on GroupYetu360
7. Your Rights (Kenya Data Protection Act, 2019)
Under the Kenya Data Protection Act 2019, you have the right to:
- Access - Request a copy of the personal data we hold about you
- Correction - Request correction of inaccurate or incomplete data
- Deletion - Request deletion of your personal data (subject to legal retention requirements)
- Objection - Object to certain processing of your data
- Portability - Request your data in a portable format
To exercise any of these rights, contact us at info@groupyetu.org. We will respond within 21 days as required by law.
8. Payment Data
When Instant Pay is enabled by your organisation administrator, the following applies:
- Your M-Pesa phone number is used to initiate payment prompts
- Transaction confirmation data (reference, amount, date and payment partner used) is stored to record your contribution
- Your M-Pesa PIN is entered directly on Safaricom's secure system and is never transmitted to or stored by GroupYetu360 or any of our payment partners
- Where your organisation uses Fingo Africa or SasaPay, your contribution is briefly received into EPH Technologies' merchant account with that provider before being disbursed to your organisation - see our Terms of Service for details. Where your organisation uses Paystack, your contribution goes directly to the organisation's own Paystack subaccount and EPH Technologies never receives it
- Payment data is also processed under the respective privacy policies of Safaricom, Paystack, Fingo Africa and SasaPay
9. Cookies and Tracking
GroupYetu360 uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking pixels or third-party analytics services that track you across websites.
10. Data Retention
We retain your data for as long as your account or organisation account is active on GroupYetu360. If an organisation account is deleted, all associated member and financial data is permanently deleted within 30 days. You may request deletion at any time.
11. Children's Privacy
GroupYetu360 is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered organisation administrators by email of any material changes. The updated policy will be published at groupyetu.org/privacy.html with the effective date.
13. Contact Us
For any privacy concerns, data requests or questions about this policy:
- Email: info@groupyetu.org
- WhatsApp: +254 702 903 544
- Address: EPH Technologies Limited, Western Heights, Karuna Road, Westlands, Nairobi, Kenya
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.