Privacy Policy

1.1OdooGrid is operated by Odutech Solutions of Nairobi, Kenya (“we”, “us”, “our”). For the personal data described in this policy, we are the data controller within the meaning of the Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021.

1.2We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller and data processor, as required by the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.

1.3For questions about this policy, or to exercise your rights, contact our data protection officer at notifications@odutechsolutions.net, or on +254 754 625 698.

2.1This policy covers personal data we collect through the OdooGrid website, the client and affiliate portals, sign-up and sign-in, billing, live chat, email, WhatsApp and phone support, and our marketing pages.

2.2Data in your Odoo instance. When our clients store personal data in the Odoo instances we host (for example their customers’, employees’ or suppliers’ records), the client is the data controller and we are a data processor acting on their instructions. Section 18 explains what we commit to as processor. If your data is held in one of our clients’ systems, please contact that organisation first.

In line with section 25 of the Act, we make sure that personal data is:

• processed in accordance with your right to privacy under Article 31 of the Constitution of Kenya;
• processed lawfully, fairly and transparently;
• collected for explicit, specified and legitimate purposes and not processed in ways incompatible with them;
• adequate, relevant and limited to what is necessary;
• collected only where a valid explanation is given whenever information about family or private affairs is required;
• accurate and, where necessary, kept up to date, with inaccurate data corrected or erased without delay;
• kept in an identifiable form only as long as necessary; and
• not transferred outside Kenya unless there is proof of adequate safeguards or your consent.

Information you give us

• Account details: full name, email address, phone number, organisation name, username, profile photo and password. We store your password only as a one-way hash.
• Organisation and billing details: billing email, Billing Currency, KRA PIN or tax details where you provide them, billing cycle and plan.
• Payment details: the M-Pesa or Airtel Money phone number you pay from, and the transaction references, amounts and status our payment partners send back. We do not collect or store card details, and we never see your mobile money PIN. A phone number you save for automatic charging is encrypted, and our staff cannot read it.
• Domain registrant details: name, organisation, address, email and phone, as registries require.
• Communications: messages you send through live chat, email, WhatsApp or our contact forms, and our replies.
• Affiliate details: payout details (for example an M-Pesa number or bank account), referral code, referral and conversion counts, badge category and score, and commission and token history.
• Consent records: the date, time, policy version and IP address when you accepted our Terms of Service and this Privacy Policy.

Information we collect automatically

• Sign-in and security data: IP address, approximate country (derived from the IP address), browser and device type, login times, active sessions and two-factor authentication status.
• Usage data: pages visited, referring page and actions in the portal, linked to the og_vid visitor ID or your account.
• Security logs: for requests our systems block, such as forged payment confirmations, the source IP address, country, request headers and body, and an automated risk score.
• Service data: deployment logs, server metrics, backup records and DNS settings for your instances.

Information from third parties

• Social sign-in: if you choose Google, Apple, Facebook or Instagram, we receive your name, email address (and whether the provider has verified it) and a unique account identifier. We do not receive your password, and we do not post on your behalf.
• Affiliates: the referral code of the affiliate who referred you.
• Payment providers: confirmation of your payments, including the payer’s name and phone number as the provider reports them.

Section 30 of the Act lets us process personal data only on a lawful basis. We rely on the following:

• Performance of a contract: to create and run your account, verify your email, provision and manage instances, register domains, take payments, issue invoices, credit signup bonuses and affiliate rewards, and provide support.
• Legal obligation: to keep accounting and tax records under the Tax Procedures Act, 2015, the Value Added Tax Act, 2013 and the Income Tax Act (Cap. 470); to respond to lawful requests from the Kenya Revenue Authority, the courts or law enforcement; and to notify personal data breaches.
• Legitimate interests: to secure the platform and prevent fraud, including blocking and risk-scoring suspicious requests and detecting referral abuse; to improve the Services using aggregated statistics; and to establish, exercise or defend legal claims. We weigh these interests against your rights and do not rely on them where your interests override ours.
• Consent: for optional marketing messages, and for other processing where we ask for your consent. You can withdraw consent at any time. This does not affect processing that took place before you withdrew it.

6.1When you create an account, you must tick the box labelled “I have read and agree to the Terms of Service and Privacy Policy”. This confirms that we have informed you of the matters set out in section 29 of the Act. The box is never pre-ticked, and the account cannot be created without it.

6.2Section 32 of the Act places on us the burden of proving consent. We therefore record when you gave it, which version of these documents you accepted, and the IP address you accepted from.

6.3You can withdraw your consent by closing your account. We will then stop processing that relies on consent. We may still retain data we are legally required to keep, as described in section 13.

7.1We do not ask for sensitive personal data as defined in the Act, such as health, biometric, ethnic, religious, genetic or sexual orientation data, and we ask you not to send it to us through support channels. If our clients store sensitive data in their Odoo instances, they are responsible, as data controllers, for meeting the additional conditions in sections 44 to 46 of the Act.

7.2The Services are intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it, in line with section 33 of the Act.

We use automated processing in a few places:

• Affiliate badges: a scheduled job calculates each affiliate’s score from their signups and conversions using a published formula, and assigns a badge category, which may come with tokens.
• Payment and request security: incoming payment confirmations and suspicious requests are scored automatically, and requests from unrecognised sources are blocked for a human to review.
• Billing automation: overdue invoices can lead to automatic reminders and, after the notified grace periods, suspension of a server.

Under section 35 of the Act, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or significantly affects you. You can ask us at notifications@odutechsolutions.net for a person to review any automated decision, to give your point of view, and to have the decision explained.

We will only send you marketing messages about OdooGrid if you have agreed to receive them, or if you are an existing client and the messages are about similar services, as allowed by section 37 of the Act. Every marketing email includes a way to opt out, and you can also opt out by writing to notifications@odutechsolutions.net. Service messages, such as invoices, security alerts, verification emails and suspension notices, are part of the contract and will still be sent.

We do not sell your personal data. We share it only as needed, with:

• Cloud infrastructure providers that host the platform and your instances, such as DigitalOcean, Contabo and Hetzner, and S3-compatible storage for backups and files.
• Payment partners: KCB Bank Kenya (including its Buni API), Safaricom (M-Pesa) and Airtel Money, to take and confirm payments.
• Domain registrars and registries, such as Namecheap, KeNIC and ICANN-accredited registries, to register and manage your domains.
• Email and messaging providers, to deliver emails, SMS and WhatsApp messages.
• Sign-in providers (Google, Apple, Meta), only to complete sign-ins you start.
• Odoo S.A. or its partners, if you ask us to manage an Odoo Enterprise subscription for you.
• The affiliate who referred you: they see your name or organisation, your sign-up status and whether you became a paying client, so their commission can be calculated. They do not see your billing details or instance data.
• Professional advisers, such as auditors, advocates and accountants, under a duty of confidentiality.
• Authorities, such as the Kenya Revenue Authority, the ODPC, courts and law enforcement agencies, where the law or a lawful order requires it.
• A buyer or successor, if all or part of our business is reorganised, merged or sold. In that case this policy will continue to protect your data.

We bind our processors by written contract, as section 42 of the Act requires. They may process your data only on our instructions, must keep it confidential and secure, and must help us respond to your rights requests.

11.1Some of our providers store or process data outside Kenya. For example, servers may run in data centres in Europe, North America or Asia, depending on the region you choose for an instance, and email and sign-in providers operate globally.

11.2We transfer personal data outside Kenya only as allowed by sections 48 to 50 of the Act and Part VI of the Data Protection (General) Regulations, 2021. That means where the receiving country or organisation provides appropriate safeguards (such as contractual data protection clauses and recognised security certifications), where the transfer is necessary to perform our contract with you, or with your consent.

11.3You can choose the server region for your instance when you order. Contact us if you need your instance hosted in a particular region, or need data localisation for regulatory reasons.

In line with section 41 of the Act (data protection by design and by default), our measures include:

• HTTPS/TLS encryption for all traffic to the portal and to your instances;
• passwords stored only as one-way hashes, optional two-factor authentication, and automatic locking of idle sessions;
• encryption of saved payment details and server credentials at rest;
• role-based access for staff, the minimum access each person needs, and audit logs of administrative actions;
• verification of payment confirmations, an allowlist of trusted sources, and automatic blocking and risk-scoring of suspicious requests;
• separate servers for each client instance, firewalls, and regular security updates; and
• scheduled backups kept separately from the servers they protect.

No system is perfectly secure. You also play a part: use a strong, unique password, turn on two-factor authentication, and never share your login.

Under section 39 of the Act, we keep personal data only as long as needed for the purpose it was collected for, or as the law requires. Then we delete it or anonymise it. As a guide:

• Account and organisation data: while your account is open, and for up to 24 months after closure in case of queries or disputes.
• Invoices, payments and other tax records: at least 5 years from the end of the tax period they relate to, as the Tax Procedures Act, 2015 requires.
• Consent records: while your account is open, and for 6 years after closure, which is the period for contract claims under the Limitation of Actions Act (Cap. 22).
• Instance data and backups: until the end of the notified suspension period after cancellation or non-payment. The servers and backups are then destroyed.
• Live chat and support messages: up to 24 months after the conversation ends.
• Security logs and blocked requests: up to 12 months, or longer if needed for an investigation or legal proceedings.
• Visitor statistics: up to 24 months, after which they are kept only in aggregated form.
• Unverified sign-ups: verification links expire. Accounts that are never verified may be deleted.

If a personal data breach creates a real risk of harm to you, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires. Unless it would hinder a criminal investigation, we will also tell you within a reasonable time, in writing, what happened, the likely consequences, the steps we are taking, and what you can do to protect yourself. Where we act as a processor, we will notify the affected client without delay so they can meet their own obligations.

Under sections 26, 38 and 40 of the Act, you have the right to:

• be informed of how your personal data is used (this policy);
• access the personal data we hold about you and get a copy;
• object to the processing of all or part of your personal data, including for direct marketing;
• correct false, inaccurate, outdated, incomplete or misleading data;
• delete data that is no longer needed, irrelevant, excessive or unlawfully obtained;
• data portability: receive the data you gave us in a structured, commonly used and machine-readable format, and have it sent to another controller where technically possible;
• restrict processing while a correction or objection is being considered; and
• not be subject to solely automated decisions that significantly affect you (section 8).

You can update most account details yourself in the portal. For anything else, email notifications@odutechsolutions.net from the address on your account, or write to us. To protect you, we may need to verify your identity first. We will respond within the time limits set by the Data Protection (General) Regulations, 2021. We normally do not charge a fee. If we cannot fully meet a request, for example because the law requires us to keep tax records, we will explain why.

We use a small number of first-party cookies and browser storage. We do not use third-party advertising or cross-site tracking cookies.

Strictly necessary cookies are needed for sign-in and security, so they cannot be switched off. You can block or delete the other cookies in your browser settings. Some features, such as affiliate attribution, may then not work.

Live chat conversations, support emails and WhatsApp messages are stored so we can help you, keep a record of what was agreed, and train our team. Automated assistant messages in live chat (for example badge or billing notifications) are clearly shown as coming from the OdooGrid bot. Please do not share passwords, full card numbers or PINs in any message.

For personal data in the instances we host for you, we will:

• process it only on your documented instructions, given through your use of the Services and these terms, unless the law requires otherwise (in which case we will tell you, where lawful);
• make sure staff who can access it are bound by confidentiality;
• apply the security measures in section 12;
• use sub-processors only under written terms that protect the data at least as well, and tell you about material changes to our infrastructure providers;
• help you respond to data subject requests and meet your security, breach-notification and impact-assessment obligations, taking into account the nature of our processing;
• notify you without undue delay after becoming aware of a breach affecting your instance data;
• at the end of the Services, let you export your data, and then delete it along with its backups, as described in our Terms of Service; and
• make available the information you reasonably need to show compliance with section 42 of the Act.

If you are unhappy with how we have handled your personal data, please contact us first at notifications@odutechsolutions.net and we will try to put it right. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya, at www.odpc.go.ke, in line with section 56 of the Act and the Data Protection (Complaints Handling Procedure and Enforcement) Regulations, 2021.

We may update this policy when our Services, providers or legal obligations change. The date at the top shows the latest version. For material changes we will notify you by email or in the portal at least 30 days before they take effect, and where the law requires it, we will ask for your consent again.

Data protection officer, Odutech Solutions, Nairobi, Kenya. Email: notifications@odutechsolutions.net. Phone or WhatsApp: +254 754 625 698.