Privacy Policy for OrdaBill

Last Updated: September 21, 2026

ORDABILL LTD ("we," "us," or "OrdaBill") is committed to safeguarding the personal data of our platform users, Tenants, and their Customers. This Privacy Policy outlines how we collect, use, process, store, and disclose personal data when you access or interact with the OrdaBill payment orchestration and billing platform.

We operate in strict compliance with the Kenya Data Protection Act, 2019 (DPA) and its associated statutory regulations.

1. Data Controller and Data Processor Roles

• OrdaBill as Data Controller: We act as a Data Controller in respect of personal data submitted directly by users during account registration, merchant onboarding, billing setup, and administrative usage.
• OrdaBill as Data Processor: When Tenants upload, import, or transmit end-customer personal data (e.g., customer directories, invoicing details, subscription profiles) to our platform, the Tenant acts as the Data Controller, and OrdaBill acts as the Data Processor operating strictly under the Tenant's instructions.

2. Information We Collect

We collect personal data necessary to provide, optimize, and secure our SaaS billing and orchestration platform. This includes:

• Identity & Contact Data: Full names, business names, business registration numbers, national identification/passport numbers, email addresses, and phone numbers (including M-Pesa registered lines).
• Financial & Transaction Metadata: Billing history, subscription schedules, invoice records, payment reference codes, and transaction status logs. Note: OrdaBill does not process or store full payment card numbers (PAN/CVV); card tokenization and processing are executed directly by PCI-DSS compliant third-party gateways (e.g., Paystack).
• Technical & Device Data: IP addresses, login logs, browser types, API access tokens, request headers, and device telemetry data collected automatically via cookies and server logs.
• Tenant Customer Data: Names, phone numbers, email addresses, and subscription details provided by Tenants to facilitate automated invoice generation and payment prompt delivery.

3. Legal Basis and Lawful Purpose of Processing

We process personal data under the following lawful bases established under the Kenya Data Protection Act:

• Performance of a Contract: To register accounts, deliver billing software functionality, calculate commissions, and dispatch automated payment push notifications or invoices.
• Compliance with Legal Obligations: To maintain accounting records, fulfill tax obligations, and respond to legal process or requests from statutory regulators.
• Legitimate Interests: To improve platform performance, enforce our Terms of Service, prevent platform fraud, and ensure backend security.

4. Data Sharing and Third-Party Disclosures

OrdaBill does not sell personal data. We disclose personal data only under the following strictly defined conditions:

• Payment Service Providers & Gateways: We transmit transaction payload details (e.g., payment amounts, customer identifiers) to licensed payment gateways (such as Paystack) solely to enable end-to-end processing and automated split settlement.
• Between Tenants and Customers: End-customer details are accessible to the specific Tenant who generated the invoice or subscription schedule.
• Technical Infrastructure Providers: We engage trusted third-party cloud hosting, database management, SMS/notification gateways, and monitoring providers who operate under strict data processing agreements.
• Legal Requirements: We may disclose personal data if required to do so by Kenyan statutory law, court orders, or official directives from the Office of the Data Protection Commissioner (ODPC) or law enforcement authorities.

5. International Data Transfers

Where personal data is transferred, stored, or processed on servers or cloud infrastructure hosted outside the Republic of Kenya, OrdaBill ensures that such cross-border transfers comply with Section 48 of the Data Protection Act, 2019. We ensure appropriate safeguards, standard contractual clauses, or adequacy assessments are established with international cloud hosts.

6. Data Security Measures

We implement robust technical and organizational measures to safeguard personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures include TLS/SSL encryption for data in transit, AES-256 encryption at rest, role-based access controls, and strict API token authentication.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected, or as required by Kenyan commercial, tax, and legal record-keeping standards (typically up to seven years for transaction metadata).

8. Your Data Protection Rights

Under the Kenya Data Protection Act, 2019, you possess specific rights regarding your personal data:

• Right to be Informed: To know how your data is being collected and processed.
• Right of Access: To request copies of your personal data held by us.
• Right to Rectification: To request correction of inaccurate, incomplete, or outdated data.
• Right to Erasure ("Right to be Forgotten"): To request deletion of your personal data, subject to statutory retention exceptions.
• Right to Object or Restrict Processing: To request restrictions on processing under specific conditions.
• Right to Data Portability: To receive your personal data in a structured, commonly used format.

To exercise any of these rights, please contact our Data Protection Office at privacy@ordabill.com. You also have the legal right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC) in Kenya.

9. Contact Us

For any legal inquiries, data protection requests, or questions regarding this Privacy Policy, please contact:

ORDABILL LTD
Attn: Data Protection Officer
Email: support@ordabill.com / privacy@ordabill.com