Data Protection

GBA Systems Ltd is responsible for the Rasmi service and is committed to handling personal data in accordance with the Kenya Data Protection Act, 2019 and guidance from the Office of the Data Protection Commissioner (ODPC). Our Privacy Policy explains what information we collect, why we use it, who may receive it, and how to request deletion.

Roles and responsibility. For account, website, support, and service-operation data, GBA generally acts as the data controller. For receipt and business records submitted by a customer on behalf of its employees, suppliers, or customers, the business may determine the purpose and means of processing and act as controller, while GBA processes the records only to provide Rasmi. Workspace administrators are responsible for giving appropriate instructions, permissions, notices, and lawful bases for records they submit.

Processing principles. We aim to collect only information relevant to the service, use it for stated and lawful purposes, keep it accurate where practical, limit access, retain it only as long as necessary, and protect it against unauthorised access, loss, alteration, or disclosure. We do not sell personal data or use receipt data to advertise unrelated products.

Safeguards and service providers. Rasmi uses access controls, role-based permissions, encryption where appropriate, audit logging, and least-privilege access. We may use contracted providers for hosting, storage, OCR, email, analytics, support, and payments. Providers may process information outside Kenya; we use contractual and other safeguards required by applicable law.

Data incidents. We maintain procedures for identifying, containing, investigating, and responding to suspected personal-data incidents. Where notification is required, we will notify affected customers and/or the ODPC within the periods and in the manner required by applicable law.

Your rights. Subject to legal limitations, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Account deletion requests can be made through the app where that control is available or by emailing support@rasmi.co.ke. We may verify your identity and coordinate with the relevant workspace administrator. You may also complain to the ODPC.

For privacy, data protection, or security questions, contact support@rasmi.co.ke. This page and our Privacy Policy may be updated when our service or legal obligations change.