Privacy Policy

1. Information We Collect

Personal Information

We collect the following types of personal information when you use our services:

• Name, phone number, and email address
• Physical address and location data
• Payment information (processed securely through M-Pesa and bank transfers; we receive the payment confirmation and receipt code, never your M-Pesa PIN or card number)
• Website order details: the items you order, the delivery location you type or share from your device, and your contact details
• If you sign in with Google: your name, email address and profile picture (see section 16)
• Service preferences and requirements
• Communication records (calls, emails, messages)

CCTV and Security Footage

When we install and manage security systems, we may handle:

• Video surveillance footage from installed cameras
• Access control logs and entry/exit records
• Biometric data (fingerprints, facial recognition) for access control
• System monitoring and maintenance logs

2. How We Use Your Information

Service Provision

We use your information to:

• Provide security system installation and maintenance services
• Process service requests and quotations
• Schedule installations and technical support
• Monitor and maintain security systems
• Provide emergency response services

Communication

We use your contact information to:

• Send service updates and appointment reminders
• Provide technical support and troubleshooting assistance
• Share security alerts and system notifications
• Respond to inquiries and service requests

3. CCTV Footage Retention Policy

Standard Retention Period

Commercial Clients: CCTV footage is retained for 30 days from the date of recording, unless extended by client request or legal requirements.

Residential Clients: CCTV footage is retained for 14 days from the date of recording, unless specified otherwise in the service agreement.

Extended Retention

Clients may request extended retention periods for:

• Legal proceedings or investigations
• Insurance claims documentation
• Compliance requirements
• Specific business needs (with written agreement)

Footage Deletion

All footage is automatically deleted according to the retention schedule. Manual deletion can be requested by:

• Property owner or authorized representative
• Written request with proper identification
• 24-48 hour processing time for deletion requests

4. Data Security and Protection

Technical Security Measures

We implement industry-standard security measures:

• 256-bit encryption for all stored data and video footage
• Secure cloud storage with redundant backups
• Access control systems with multi-factor authentication
• Regular security audits and penetration testing
• Secure transmission protocols (HTTPS, VPN)

Physical Security

Physical security measures include:

• Secure data centers with 24/7 monitoring
• Restricted access to server rooms and equipment
• Background checks for all technical staff
• Secure equipment disposal and recycling

5. Data Sharing and Disclosure

We Do Not Sell Your Data

Qyvea Limited Kenya never sells, rents, or shares your personal information with third parties for marketing purposes.

Permitted Disclosures

We may share information only when:

• Required by law or court order
• Necessary for law enforcement investigations
• Requested by the property owner or authorized representative
• Essential for service provision (with your consent)

6. Your Rights and Choices

Data Access and Correction

You have the right to:

• Request access to your personal information
• Correct inaccurate or incomplete data
• Request deletion of your information (where legally permitted)
• Opt-out of non-essential communications
• Request data portability

CCTV Footage Rights

As a property owner, you have the right to:

• Access any footage from your property
• Request copies of specific recordings
• Determine retention periods
• Authorize third-party access (with written consent)

7. Biometric Data Protection

Special Protection

Biometric data receives enhanced protection:

• Separate storage from other personal data
• Template-based storage (not raw images)
• Automatic deletion after contract termination
• Strict access controls and audit logs

Consent Requirements

We obtain explicit consent for:

• Collection of biometric data
• Use in access control systems
• Storage duration and processing methods
• Third-party sharing (if applicable)

8. Cookies and Tracking

Website Cookies

Our website uses:

• Essential cookies for website functionality
• Analytics cookies to improve user experience
• Session cookies for security and authentication

Website Analytics

To understand which pages help visitors, we record anonymous page views and clicks on our call, WhatsApp, email and site-survey buttons, together with the page, device type and how the visit reached us (for example a search engine, social network or campaign link). These records never include your name, phone number or email. If you choose "Accept" on our cookie notice, we also remember on your device how you first found us and use Google Analytics cookies; if you choose "Essential only", nothing is stored on your device for analytics and Google Analytics runs without cookies. When you submit a site-survey request, how you found us is saved with your request so we can see which pages bring enquiries.

Personalised Store ("Recommended for you")

If you choose "Show me products I'll like" on our store's cookie notice, we remember your last 8 searches and the last 10 products you viewed, and use them to show you "Recommended for you", "Because you searched" and "Recently viewed" rows. This history is kept in your browser's local storage. If you are signed in to a Qyvea account, the same list is also saved to your account so it follows you to other devices; only you can read it. If you choose "No thanks, essentials only", or change your choice later, your saved searches are removed from your device and the copy in your account is deleted. You can also clear your recent searches at any time from the search box.

Cookie Control

You can control cookies through:

• Browser settings to block or delete cookies
• Cookie consent banner on our website
• Opt-out of analytics tracking

9. International Data Transfers

Data Location

All personal data and CCTV footage is:

• Stored within Kenya whenever possible
• Processed using Kenya-based data centers
• Transferred internationally only with explicit consent
• Protected by EU-standard GDPR compliance measures

10. Children's Privacy

Age Restrictions

We do not knowingly collect personal information from children under 18 years of age.

School and Family Systems

For systems installed in schools or family homes:

• Parental/guardian consent is required
• Special privacy protections apply to minors
• Limited data collection and retention

11. Breach Notification

Data Breach Response

In case of a data breach, we will:

• Notify affected individuals within 72 hours
• Provide details of the breach and potential impact
• Offer remediation and protection measures
• Report to regulatory authorities as required
• Implement corrective measures to prevent future breaches

12. Policy Updates

Changes to Privacy Policy

We may update this privacy policy when:

• Services or data practices change
• New laws or regulations require updates
• Technology or security measures evolve

Notification of Changes

Changes will be communicated through:

• Website updates with new effective date
• Email notifications to registered clients
• Prominent notices for significant changes

13. Contact Information

Privacy Inquiries

For privacy-related questions or requests:

• Email: [email protected]
• Phone: +254 113 301 244
• Address: Westlands, Nairobi, Kenya (delivery only, no walk-in pickup) 00100
• Response Time: Within 5 business days

Data Protection Officer

Our Data Protection Officer handles:

• Privacy policy compliance
• Data subject requests
• Breach investigations
• Regulatory communications

14. Legal Framework

Applicable Laws

This privacy policy complies with:

• Kenya Data Protection Act 2019
• EU General Data Protection Regulation (GDPR)
• Communications Authority of Kenya guidelines
• Industry best practices for security companies

15. Google API Services and Gmail Integration

Use of Google User Data

Qyvea Limited Kenya's internal admin dashboard uses the Gmail API, authorized via Google OAuth, solely to send outreach emails on behalf of the authorized Qyvea account holder. Specifically, we access:

• Permission to send email through the connected Gmail account (gmail.send scope)
• The connected account's email address, to identify the sending account

Limited Use Disclosure

Qyvea's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google account data is used only to send outreach emails initiated and approved by an authorized Qyvea administrator
• We do not use Gmail data to serve advertisements
• We do not sell, rent, or transfer Google user data to third parties
• We do not allow humans to read Gmail data except as necessary for security purposes, to comply with applicable law, or with the account holder's explicit consent
• No Gmail message content is used to train generalized AI or machine learning models
• Access is restricted to a single authorized administrator account and revocable at any time via Google Account permissions or the Qyvea admin dashboard

Data Stored

We store only the OAuth refresh token and connected sender email address, encrypted at rest, for the purpose of maintaining the authorized connection. We do not store the contents of your Gmail inbox, contacts, or any data beyond what is needed to send outreach emails you approve.

16. Sign in with Google (customers)

You can create an account or sign in on qyvea.co.ke with your Google account instead of a password. This section explains what we receive from Google, why, and how you stay in control. It applies to the “Continue with Google” option on our online store, run by Qyvea Limited, Westlands, Nairobi, Kenya.

What we receive from Google

• Your name, email address and profile picture, using only the basic sign-in permissions (openid, email and profile)
• We do not ask for, and cannot see, your Gmail messages, contacts, Google Drive, calendar, location history or any other Google data

Why we use it

• To create your Qyvea account and let you sign in securely
• To show your name in your account, and to pre-fill your name and email when you place an order
• To email you about your orders (approval, payment link, receipt) and to follow up on enquiries you made
• To email you offers and price-drop alerts only if you agreed to receive them. Every such email has an unsubscribe link

Sharing, storage and retention

• We do not sell, rent or give your Google account information to anyone for advertising
• It is stored in our secure database (Supabase) used only for the Qyvea website, and is accessible to the authorised Qyvea administrator
• We keep it while your account is open, and delete it when you ask us to delete your account

Your choices

• Stop Google sign-in at any time: remove Qyvea in your Google Account under Security → Third-party access (myaccount.google.com/permissions)
• Delete your account and data: email [email protected] from the address on your account, or WhatsApp +254 113 301 244. We delete it promptly and confirm by email
• Unsubscribe from marketing: use the unsubscribe link in any marketing email

Qyvea’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

17. Website orders, delivery and payments

What we collect when you order on the website

• Your name, phone number and email address (required, so we can confirm your order and send you the payment link)
• Your delivery location: the area or landmark you type, and, only if you press “Use my current location” and allow it in your browser or phone, the map position of that moment
• The items, quantity, agreed price, delivery fee and payment status of your order

How it is used

• To confirm stock and the final price, arrange delivery to your location, and email you about your order (received, approved, unavailable, paid)
• To issue your receipt, which shows your name, the phone number you paid with and your delivery location
• Your location is used only to deliver that order. We do not track you after the order

Payments

M-Pesa payments are made through Safaricom’s M-Pesa. We receive only the confirmation, the amount, the phone number that paid and the M-Pesa receipt code. We never see or store your M-Pesa PIN. Payments to our Till or bank account are matched to your order by the reference or confirmation code you give us.

Retention

We keep order and payment records for as long as the law requires for accounting and tax purposes, and delete or anonymise them afterwards. You can ask us to correct or delete your personal details at [email protected], subject to those legal record-keeping duties.