Privacy Policy

This Privacy Policy explains how GBA Systems Ltd ("GBA", "we", "us"), the provider of Rasmi, collects, uses, stores, and shares information when you visit our website, use the Rasmi mobile application, contact us, or otherwise use our services. Rasmi is an eTIMS receipt capture and accounting workflow service for businesses in Kenya.

This policy is intended to meet the transparency requirements of the Kenya Data Protection Act, 2019 (the "Data Protection Act"). It should be read together with our Terms of Service. By using Rasmi, you acknowledge this policy.

1. Information we collect

Account and contact information. We collect your name, email address, phone number, business name, role, workspace details, and information you provide when requesting access or contacting us.

Receipt and business information. When you use Rasmi, you may submit eTIMS receipts and related records, including QR payloads, CUINs, supplier details, tax amounts, invoice amounts, dates, categories, payment references, and accounting entries. These records may contain personal data about you, your employees, suppliers, or customers. You remain responsible for ensuring that you have a lawful basis to submit that information to Rasmi.

Device and usage information. We may collect device type, operating system, app version, IP address, approximate location derived from IP, crash diagnostics, log data, and information about how you use the service. The app may use your camera only when you choose to scan a receipt.

Website information. Our website may use essential cookies and, where you consent, analytics cookies. You can change your cookie choice through your browser settings or by contacting us.

2. How we use information

We use information to provide, secure, maintain, and improve Rasmi; read and validate receipt data; route records for review; prevent duplicate submissions; sync approved records with connected accounting services; process subscriptions and payments; respond to support requests; send service and security notices; understand product performance; comply with legal obligations; and enforce our agreements.

We do not sell personal data. We do not use receipt data to advertise unrelated products. We may use aggregated or de-identified information for analytics and service improvement where it cannot reasonably identify a person or business.

3. How we share information

We share information only as needed to operate Rasmi. This may include service providers for hosting, storage, OCR or document processing, email delivery, analytics, customer support, and payment processing. Where you connect QuickBooks Online, Zoho Books, or another integration, we share the records and fields needed to perform the action you request. Those providers process information under their own terms and privacy policies.

We may also disclose information where required by law, court order, regulator, or lawful government request; to protect users, the public, or our rights; or as part of a merger, financing, acquisition, or sale of assets. We do not disclose information to KRA or another authority merely because you use Rasmi, unless you direct us to do so or disclosure is legally required.

4. Retention, security, and international transfers

We retain account and business records for as long as needed to provide the service, meet contractual and legal obligations, resolve disputes, prevent abuse, and maintain appropriate audit records. Workspace administrators control business records and may request deletion, subject to records we must retain by law or for legitimate security purposes.

We use reasonable technical and organisational safeguards, including access controls, encryption where appropriate, logging, and least-privilege access. No online service can guarantee absolute security. Some providers may process data outside Kenya. Where this occurs, we take steps required by applicable law and our contracts to protect the information.

5. Your rights and choices

Subject to applicable law, you may ask us to access, correct, update, restrict, or delete your personal data, object to certain processing, withdraw consent where processing relies on consent, or receive a copy of information you provided. You may also complain to the Office of the Data Protection Commissioner in Kenya. To make a request, email us from the address associated with your account. We may need to verify your identity and coordinate with your workspace administrator before responding.

6. Account and data deletion

You may request deletion of your Rasmi account and associated personal data at any time. Send an email to support@rasmi.co.ke from the email address linked to your account and include "Account deletion request" in the subject. If account deletion is available in the app, you may also use the account deletion control in Settings.

We will verify the request, close the account, and delete or anonymise personal data that we are not required to retain. Workspace business records may be controlled by the workspace administrator, and we may retain limited information where necessary for legal compliance, tax and accounting records, fraud prevention, security, dispute resolution, or enforcement of our agreements. Backups are deleted or overwritten in accordance with our backup cycle. Deleting an account does not delete records already posted to a connected accounting service; you must request removal from that service separately.

7. Children

Rasmi is a business service and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided information to us, contact us so we can review and remove it where appropriate.

8. Changes and contact

We may update this policy when our service, legal obligations, or data practices change. We will post the updated version here and change the effective date. Questions, requests, and privacy complaints should be sent to support@rasmi.co.ke. You may also write to GBA Systems Ltd, Nairobi, Kenya.