This Privacy Policy describes how FundRays Limited ("FundRays", "we", "us") processes personal data when you use the FundRays platform, website, WhatsApp flows and payment pages (the "Service").
FundRays Limited (Business Registration No. PVT-MA157BZL) is the data controller for the personal data processed through the Service. We are in the process of registering as a data controller with the Office of the Data Protection Commissioner ("ODPC"); our registration number will be published here once issued. Our Data Protection Officer can be reached at privacy@fundraised.africa.
| Category | Examples |
|---|---|
| Identity & contact | Your name as entered at payment, your mobile phone number (which is your identity on the Service), and the display name you choose. |
| Transaction data | M-Pesa transaction codes, amounts, dates, the Group and collection paid to, and the nominated settlement account. |
| WhatsApp data | Your WhatsApp number and, where provided by Meta, a business-scoped user identifier and message identifiers used to route messages. |
| Group records | Membership, roles, contributions, streaks and related coordination records for the Groups you belong to. |
| Technical data | IP address, device and browser information, and server logs generated when you use the website or payment page. |
We do not ask for or store your M-Pesa PIN, and we never have access to it. We do not intentionally collect sensitive personal data as defined in the Data Protection Act.
We collect data directly from you (when you set up a Group, make a payment, or message us), automatically (through use of the website), and from Safaricom and Meta as necessary to process payments and deliver messages.
Consistent with section 30 of the Data Protection Act, 2019, we process personal data on the following bases:
We share personal data only as necessary, with:
We do not sell your personal data.
Some of our processors store or process data outside Kenya. Where this occurs, we ensure the transfer meets the conditions in sections 48 and 49 of the Data Protection Act, 2019 — through appropriate safeguards, contractual protections, or another lawful basis — so that your data continues to receive an adequate level of protection.
We retain personal data only as long as necessary for the purposes above and to meet legal, accounting and regulatory obligations, after which it is deleted or anonymised. Transaction records may be retained for the period required by applicable financial and tax law.
Under Part IV of the Data Protection Act, 2019 you have the right to:
To exercise any of these, contact privacy@fundraised.africa. We will respond within the timeframes set by the Act. We may need to verify your identity first.
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss, as required by section 41 of the Data Protection Act, 2019. These include encryption in transit, access controls and authentication on our administrative systems, source-verification of payment callbacks, continuous security monitoring, and least-privilege data access. No system is perfectly secure; in the event of a personal-data breach that poses a real risk of harm, we will notify the ODPC and affected individuals as required by the Act.
Our website uses only the cookies and local storage strictly necessary to operate the Service (for example, to keep a payment session or remember a preference). We do not use third-party advertising or tracking cookies.
The Service is intended for persons aged 18 and over. We do not knowingly collect data from children. If you believe a child's data has been provided to us, contact us and we will delete it.
We may update this Policy from time to time. The current version is always published on this page with its effective date. Material changes will be communicated where practicable.
If you have a concern about how we handle your data, please contact us first at privacy@fundraised.africa. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).