Privacy Policy

Microplus ("we," "us," or "our") is a financial technology software platform operated by PSL, incorporated and operating under the laws of Kenya. Our platform is accessible at microplus.co.ke and provides Sacco management, microfinance management, and digital banking software solutions to organisations across Kenya, Tanzania, Uganda, Burundi, Rwanda, and the broader African continent.

We collect personal data in the following categories depending on how you interact with Microplus:

A. Website Visitors

• Name, email address, phone number (submitted via contact or get-started forms)
• IP address, browser type, device type, and pages visited
• Referral source and approximate geographic location

B. Platform Users (Administrators & Staff of Client Organisations)

• Full name, national ID or staff number, work email, phone number
• Login credentials (passwords stored in hashed, salted form)
• System access logs, actions taken within the platform

C. End Members / Clients (Processed on behalf of your Organisation)

When Saccos, MFIs, or other organisations use Microplus to manage their members or clients, the following data may be processed on the organisation's behalf:

This end-member data is processed strictly under the instruction of the client organisation, which remains the data controller for that data.

We use personal data for the following purposes:

• Service delivery: Providing, operating, and maintaining the Microplus platform and its features (core banking, loans, deposits, reports, multi-branch management).
• Account management: Creating and administering user accounts, authenticating users, and managing access controls.
• M-Pesa & API integrations: Facilitating seamless payment processing, USSD sessions, and SMS alerts via third-party APIs.
• Communication: Sending transactional notifications, system alerts, and responding to support enquiries.
• Product improvement: Analysing platform usage patterns (in aggregate) to improve features, performance, and reliability.
• Marketing (with consent): Sending updates about new features, products, or relevant industry news to contacts who have opted in.
• Legal compliance: Meeting obligations under Kenyan law including the Data Protection Act, Anti-Money Laundering (AML) requirements, CBK regulations, and tax obligations.
• Fraud prevention & security: Monitoring for suspicious activities and protecting platform integrity.

Under the Data Protection Act, 2019, we rely on the following lawful bases:

We do not sell personal data. We may share data with the following categories of parties under appropriate safeguards:

• Client organisations: Saccos, MFIs, and cooperatives that use Microplus and are responsible for their members' data.
• Service providers & sub-processors: Cloud hosting providers, SMS gateway operators, email delivery services, and analytics tools — bound by data processing agreements.
• M-Pesa / Safaricom & API partners: For processing payment and USSD transactions (see Section 6).
• Regulators & government authorities: Where required by law — including the Office of the Data Protection Commissioner (ODPC), CBK, Kenya Revenue Authority (KRA), or law enforcement with a valid legal order.
• Professional advisors: Lawyers, auditors, and insurers who are bound by confidentiality obligations.

Any third party that receives personal data from us is required to maintain its confidentiality and use it only for the stated purpose.

Microplus integrates with M-Pesa (Safaricom) APIs, USSD APIs, bulk SMS APIs services to facilitate real-time financial transactions. When these integrations are used:

• Transaction data, including phone numbers and amounts, is transmitted to Safaricom or the relevant API provider to complete the transaction.
• Such data is subject to the privacy policies of those third-party providers. We encourage you to review Safaricom's Privacy Policy.
• We retain transaction records as required for audit, reconciliation, and regulatory compliance purposes.
• USSD session data is processed transiently and is not retained beyond what is operationally necessary.

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law:

When data is no longer needed, it is securely deleted or anonymised.

The Data Protection Act, 2019 grants you the following rights regarding your personal data:

• Right to be informed: To know how your data is being collected and used.
• Right of access: To request a copy of the personal data we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete data.
• Right to erasure: To request deletion of your data (subject to legal retention obligations).
• Right to object: To object to certain types of processing, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, to withdraw it at any time.
• Right to data portability: To receive your data in a structured, machine-readable format.

To exercise your rights directly with Microplus, contact us at info@microplus.co.ke. We will respond within 21 days as required by law.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

• Role-based access controls limiting data access to authorised personnel only
• Secure, hashed storage of passwords (no plaintext storage)
• Regular security assessments and vulnerability monitoring
• Audit logs of all significant system activity
• Multi-branch data isolation to prevent cross-organisation data leakage

Our website uses cookies and similar technologies to improve your browsing experience and understand how visitors interact with our site. We use:

• Strictly necessary cookies: Essential for the website to function (e.g., session management). Cannot be disabled.
• Analytics cookies: Help us understand site traffic and usage patterns (e.g., page views, device types). Used in aggregate form.
• Marketing/preference cookies: Used only with your consent to remember your preferences and deliver relevant content.

You can manage or withdraw cookie consent at any time through your browser settings. Disabling certain cookies may affect website functionality.

Microplus serves organisations across Kenya, Tanzania, Uganda, Burundi, Rwanda, and other African countries.

Microplus is a business-to-business (B2B) platform intended for use by organisations and their authorised staff. Our services are not directed at children under the age of 18.

If a client organisation processes data relating to minors as part of their membership records (e.g., junior Sacco accounts), the organisation bears responsibility for ensuring appropriate consent is obtained from a parent or guardian in compliance with applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Notify registered platform users via email or in-platform notification
• Where required, seek fresh consent before processing data under new terms

We encourage you to review this policy periodically. Continued use of our platform after changes take effect constitutes acceptance of the updated policy.