Privacy Policy

1. Introduction

TsavoSync Limited ("TsavoSync", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us by our customers, users, partners, employees, suppliers, and other stakeholders.

TsavoSync develops and operates smart utility management technologies, including software platforms, mobile applications, web portals, smart water metering solutions, smart energy metering solutions, Internet of Things (IoT) devices, payment integrations, and related digital services.

This Privacy Policy explains how we collect, use, disclose, store, protect, and process personal data when you interact with our products, services, websites, mobile applications, utility platforms, APIs, smart devices, customer support channels, and any other services operated by TsavoSync.

We are committed to processing personal data lawfully, fairly, transparently, and securely in accordance with applicable data protection laws and internationally recognized privacy principles.

2. Scope

This Privacy Policy applies to:

• The TsavoSync website.
• TsavoSync Android applications.
• TsavoSync iOS applications.
• TsavoSync customer portals.
• TsavoSync utility management platform.
• Smart water metering solutions.
• Smart energy metering solutions.
• IoT-enabled metering devices.
• Utility management APIs.
• Customer self-service portals.
• Property management solutions.
• Utility integrations.
• USSD services.
• SMS notification services.
• Payment processing services.
• Customer support channels.
• Field service applications.

3. Our Role

Depending on the nature of the services being provided, TsavoSync may act as either:

• A Data Controller, where we determine the purposes and means of processing personal data; or
• A Data Processor, where we process personal data on behalf of our customers, including utilities, government institutions, property managers, landlords, estate developers, corporate organizations, and other clients.

Where TsavoSync acts as a Data Processor, the respective customer remains the Data Controller and determines how personal data is processed.

4. Categories of Personal Data We Collect

Depending on the services being provided, TsavoSync may collect and process the following categories of information.

5. How We Collect Information

We collect information through:

• User registration.
• Utility onboarding.
• Property onboarding.
• Mobile applications.
• Web portals.
• Smart meters.
• IoT devices.
• Customer support interactions.
• Payment gateways.
• Mobile network operators.
• USSD sessions.
• SMS interactions.
• APIs.
• Third-party integrations.
• Government or utility systems where authorized.
• Field service activities.

6. Purpose of Processing

Personal data is processed to:

• Deliver utility management services.
• Manage smart water meters.
• Manage smart energy meters.
• Generate prepaid utility tokens.
• Process customer payments.
• Authenticate users.
• Manage customer accounts.
• Monitor utility consumption.
• Detect fraud.
• Prevent unauthorized access.
• Support customer service.
• Generate reports.
• Improve system performance.
• Perform analytics.
• Meet contractual obligations.
• Comply with legal and regulatory requirements.

7. Lawful Basis for Processing

Where applicable, TsavoSync processes personal data on one or more of the following legal grounds:

• Performance of a contract.
• Compliance with legal obligations.
• Legitimate business interests.
• Protection of vital interests.
• Public interest.
• Consent where required.

8. Sharing of Personal Data

Personal data may be shared only where necessary with:

• Utility companies.
• Government institutions.
• Property managers.
• Payment service providers.
• Licensed mobile network operators.
• Banking institutions.
• Cloud hosting providers.
• SMS gateway providers.
• Technology partners.
• Professional advisers.
• Regulatory authorities.
• Law enforcement agencies where legally required.

TsavoSync does not sell personal data.

9. International Data Transfers

Where services require international processing or cloud hosting, TsavoSync ensures that appropriate contractual, organizational, and technical safeguards are implemented to protect personal data in accordance with applicable data protection laws.

10. Information Security

TsavoSync employs a comprehensive information security programme designed to protect personal data against unauthorized access, alteration, disclosure, destruction, or accidental loss.

Security measures include, but are not limited to:

• Data encryption in transit and at rest.
• Role-based access controls.
• Multi-factor authentication where applicable.
• Secure password management.
• Firewalls.
• Network segmentation.
• Antivirus and endpoint protection.
• Intrusion detection and monitoring.
• Security logging and auditing.
• Secure API authentication.
• Vulnerability assessments.
• Security patch management.
• Regular backups.
• Disaster recovery procedures.
• Physical access controls.
• Employee confidentiality obligations.
• Staff cybersecurity awareness training.

11. Data Retention

Personal data is retained only for as long as necessary to:

• Deliver our services.
• Meet contractual obligations.
• Comply with legal requirements.
• Resolve disputes.
• Maintain audit records.
• Support regulatory compliance.

Upon expiry of the applicable retention period, personal data is securely deleted, anonymized, or archived where legally required.

12. Your Rights

Subject to applicable law, individuals may have the right to:

• Access their personal data.
• Correct inaccurate information.
• Request deletion of personal data.
• Restrict processing.
• Object to processing.
• Withdraw consent where applicable.
• Request data portability.
• Lodge complaints with the relevant supervisory authority.

13. Children's Privacy

TsavoSync services are not intentionally directed toward children unless specifically deployed under lawful institutional arrangements and with the appropriate legal authority.

14. Cookies and Similar Technologies

Our websites and applications may use cookies and similar technologies to:

• Improve user experience.
• Maintain secure sessions.
• Remember user preferences.
• Analyze platform performance.
• Improve service delivery.

Users may manage cookie preferences through their browser settings where applicable.

15. Third-Party Services

Our platforms may integrate with third-party providers including:

• Payment gateways.
• Mobile money operators.
• Banking systems.
• Enterprise Resource Planning (ERP) systems.
• Customer Information Systems (CIS).
• Government platforms.
• Utility systems.
• Mapping services.
• SMS providers.
• Authentication providers.

Each third party processes data in accordance with its own privacy obligations and contractual arrangements.

16. Changes to this Policy

TsavoSync may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or regulatory requirements.

The latest version will always be published on our website.

17. Contact Us

For questions relating to this Privacy Policy or the processing of personal data, please contact:

18. Governing Law

This Privacy Policy shall be governed by the applicable data protection and privacy laws of the jurisdictions in which TsavoSync operates, including but not limited to the laws of the Republic of Kenya, the Republic of Rwanda, and other applicable regional legal frameworks, together with internationally recognized privacy principles where appropriate.