Legal

Privacy Policy

Effective date: 5 August 2026 · Last updated: 5 August 2026

This Policy explains how PrintEase collects, uses, stores, discloses and disposes of your personal data, and the rights available to you under the Data Protection Act, No. 24 of 2019 of the Laws of Kenya.

In short

This summary is provided for ease of understanding only. It does not replace the full terms set out below.

We collect only the information we need to print your work and get it back to you.
Your uploaded documents are permanently deleted within 24 hours — printed or not.
Documents you mark as Sensitive are deleted within 1 hour after printing.
After deletion, only the file name and print settings remain, so your order history still makes sense.
Your name, phone number and address are used to identify you and deliver your order — nothing else.
We never sell, rent or trade your personal data, and we never read your documents for any purpose other than printing them.
You can ask us for a copy of your data, or ask us to correct or delete it, at any time.

1. Who we are

PrintEase (“PrintEase”, “we”, “us” or “our”) operates an online printing and delivery platform (the “Platform”) through which customers submit documents for printing and elect to collect them or have them delivered.

For the purposes of the Data Protection Act, No. 24 of 2019 (the “Act”), PrintEase is the Data Controller in respect of all personal data processed through the Platform. Our particulars are:

Registered name: [Registered business name]
Physical address: [Physical address, Nairobi, Kenya]
Postal address: [P.O. Box, Nairobi]
Telephone / WhatsApp: 0742 900 269
Email: [privacy@printease.co.ke]
ODPC registration no.: [Registration number]

This Policy is issued in compliance with Article 31(c) and (d) of the Constitution of Kenya, 2010, the Act, and the Data Protection (General) Regulations, 2021.

2. Scope and acceptance

This Policy applies to all personal data collected through the Platform, whether accessed by mobile device, tablet or desktop computer, and to any related communication we send you by SMS, WhatsApp or push notification.

By registering for an account, submitting a print job, or otherwise using the Platform, you confirm that you have read and understood this Policy and, where consent is the applicable legal basis, that you consent to the processing described in it. If you do not agree with this Policy, please do not use the Platform.

3. Personal data we collect

We collect the following categories of personal data, and no more than is necessary for the purposes set out in Clause 5:

3.1 Account and identity data

Your full name, mobile telephone number, and your account password. Your password is stored only as a salted, one-way cryptographic hash; it is never stored in a readable form and cannot be recovered or read by any member of our staff.

3.2 Location and delivery data

Your house or apartment number and your estate or street name. This information is collected for the sole purpose of identifying your orders and enabling delivery to your door, and is not used to track your movements or build a location profile.

3.3 Print job data

The document you upload; its file name, file type and size; the number of pages; the written instructions you provide; and your chosen print settings (number of copies, colour or black and white, single or double sided, paper size, and collection or delivery preference).

3.4 Payment data

The mobile number used to pay, the amount charged, the payment method and status, and the M-Pesa transaction reference and receipt number issued by Safaricom PLC. We never request, receive or store your M-Pesa PIN, and we do not collect or store bank card details. Payment authorisation takes place entirely on Safaricom's systems.

3.5 Communication data

A record of the service notifications we send you regarding your orders, including the channel used (SMS, WhatsApp or push notification), the trigger event, the message content, the delivery status, and the date and time sent.

3.6 Technical data

Session and authentication tokens, browser push-notification subscription identifiers and their associated encryption keys, and standard server log data such as internet protocol address, device and browser type, and timestamps of access. Server log data is used for security, fraud prevention and diagnostics only.

3.7 Account activity data

Your order history, account credit balance and loyalty points.

3.8 Sensitive personal data

We do not require, and do not knowingly collect, sensitive personal data as defined in section 2 of the Act (including data revealing race, health status, ethnic or social origin, conscience, belief, genetic or biometric data, property details, marital status, family details, or sex) as part of registration or ordering. Where a document you submit for printing happens to contain such data, Clause 6 applies, and we strongly encourage you to mark that document as Sensitive on upload.

4. Lawful basis for processing

We process your personal data only where a lawful basis under section 30 of the Act applies, as follows:

Purpose	Lawful basis
Creating and maintaining your account	Performance of a contract
Receiving, printing and preparing your documents	Performance of a contract
Delivering your order to your stated address	Performance of a contract
Processing payments and issuing receipts	Performance of a contract; compliance with legal obligation
Sending order status notifications by SMS or WhatsApp	Performance of a contract
Sending browser push notifications	Your consent, freely given and withdrawable
Retaining accounting and tax records	Compliance with a legal obligation (Tax Procedures Act, 2015)
Preventing fraud and securing the Platform	Our legitimate interests, balanced against your rights

5. How we use your data, and the limits we place on ourselves

All personal data we collect is used exclusively within the Platform for the delivery of the printing service you have requested. In particular:

Your name and phone number are used to create your user profile, to authenticate you when you log in, to identify which orders belong to you, and to contact you about those orders.
Your house number and estate are used solely to identify your orders at our premises and to enable our delivery personnel to locate you.
Your documents and print instructions are used solely to produce the physical printout you have ordered.
Your payment details are used solely to collect payment for, and reconcile, the order concerned.

We expressly undertake that we do not:

sell, rent, trade or otherwise commercially exploit your personal data;
disclose your personal data to third parties for those parties' own marketing purposes;
read, copy, retain, scan or analyse the contents of your documents for any purpose other than producing the printout you ordered;
use your personal data for advertising or behavioural profiling; or
subject you to a decision based solely on automated processing which produces legal effects concerning you, within the meaning of section 35 of the Act.

Where we wish to use your personal data for any purpose that is incompatible with those set out above, we will first seek your express consent.

6. Your documents: handling, and automatic deletion

We recognise that the documents you submit are the most private information you entrust to us. The following provisions govern their handling and are binding on us.

6.1 Storage and access

Uploaded documents are held in access-controlled object storage. They may be accessed only by authorised print operators, and only to the extent necessary to produce your printout. Every such access is subject to internal access controls and staff confidentiality undertakings. Documents are never stored on personal devices or removable media.

6.2 Standard retention period: 24 hours

Every document uploaded to the Platform is permanently and irreversibly deleted no later than twenty-four (24) hours after upload. Deletion is performed automatically by a scheduled system process and occurs whether or not the document has been printed, collected or paid for. No manual step, and no request from you, is required for this deletion to take effect.

6.3 Documents marked “Sensitive”: 1 hour

You may designate any document as Sensitive at the point of upload. A document so designated is permanently and irreversibly deleted no later than one (1) hour after printing is completed, and in any event no later than twenty-four (24) hours after upload if it is not printed. We recommend that you use this designation for documents containing identification numbers, medical records, financial statements, legal instruments, academic certificates, or any other information whose disclosure could cause you harm.

6.4 What survives deletion

Once a document is deleted, the only information retained is the file name, together with the associated print settings, page count, cost and order timestamps. This limited record is retained in your order history so that you can identify and reorder past jobs, and so that we can resolve billing disputes and meet our statutory record-keeping obligations. The contents of the document are not recoverable by us, by our staff, or by any third party, once deletion has occurred.

6.5 Derived and converted copies

Where a document is converted into another format for printing purposes (for example, conversion of a word-processing document into PDF), the converted copy is treated as part of the same document and is subject to the identical deletion timelines set out above.

6.6 Physical printouts

Printouts awaiting collection are stored securely at our premises. Printouts that remain uncollected for more than [30] days are securely destroyed by shredding. Failed, spoiled or duplicate printouts are shredded immediately and are not placed in general waste.

7. Retention schedule

In accordance with section 39 of the Act, we retain personal data only for as long as is necessary for the purpose for which it was collected, or for such longer period as the law requires:

Category of data	Retention period
Uploaded document contents (standard)	Maximum 24 hours from upload
Uploaded document contents (marked Sensitive)	Maximum 1 hour after printing
Document file name and print settings	Duration of account, then 5 years
Account profile (name, phone, address)	Duration of account, then 12 months
Payment and transaction records	5 years (Tax Procedures Act, 2015)
Notification logs	12 months
Push notification subscriptions	Until revoked or account closed
Server security logs	90 days
Uncollected physical printouts	[30] days, then shredded

At the expiry of the applicable period, data is deleted or irreversibly anonymised. Where you close your account, we delete your profile data within the period stated above, save for records we are legally obliged to retain.

8. Disclosure to third parties

We disclose personal data only where it is necessary to deliver the service, and only to the following categories of recipient:

Safaricom PLC, for the processing of M-Pesa payments. The data disclosed is limited to your paying mobile number and the transaction amount and reference.
Licensed messaging providers, for the transmission of SMS and WhatsApp order notifications. The data disclosed is limited to your mobile number and the notification text.
Delivery personnel, for the purpose of completing delivery. The data disclosed is limited to your name, mobile number, house number and estate. Delivery personnel are never given access to the contents of your documents.
Hosting and infrastructure providers, who store data on our behalf under contract and on our documented instructions only.
Professional advisers (auditors, legal counsel), where required and subject to professional confidentiality.
Public authorities, where disclosure is required by a written law, a court order, or a lawful order of a competent authority. Where we are lawfully permitted to do so, we will notify you of any such request before complying.

Every data processor acting on our behalf is engaged under a written contract that meets the requirements of section 42 of the Act, and is prohibited from processing your data for its own purposes.

9. Transfers outside Kenya

We store personal data on servers located in Kenya wherever it is practicable to do so. Where a processor engaged by us is located outside Kenya, we transfer personal data only where the conditions in sections 48 and 49 of the Act are satisfied — that is, where we have confirmed that the recipient affords an appropriate level of protection through binding contractual safeguards, or where you have given explicit consent after being informed of the possible risks, or where the transfer is necessary for the performance of our contract with you.

10. Security of your data

In discharge of our obligations under section 41 of the Act, we implement appropriate technical and organisational measures to safeguard personal data, including:

encryption of data in transit using industry-standard transport layer security;
one-way salted hashing of all account passwords;
token-based authentication with expiring sessions;
role-based access controls limiting staff access to the minimum necessary;
automated, verifiable deletion of document contents in accordance with Clause 6; and
periodic review of our security practices.

No system can be guaranteed absolutely secure. You are responsible for keeping your account password confidential and for notifying us immediately if you suspect unauthorised access to your account.

10.1 Notification of breaches

Where a personal data breach occurs that presents a real risk of harm to you, we will notify the Office of the Data Protection Commissioner within seventy-two (72) hours of becoming aware of it, and will communicate the breach to you in writing without undue delay, in accordance with section 43 of the Act.

11. Your rights as a data subject

Under section 26 of the Act, you have the right:

to be informed of the use to which your personal data is put;
to access your personal data in our custody, and to be given a copy of it;
to object to the processing of all or part of your personal data;
to correction of false or misleading data about you;
to deletion of false or misleading data about you;
to request erasure of your personal data where it is no longer necessary for the purpose for which it was collected;
to restrict processing in defined circumstances;
to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible;
to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal; and
to lodge a complaint with the Data Commissioner.

You may update your name, phone number, house number and estate at any time from the Profile section of the Platform. You may disable SMS, WhatsApp or push notifications at any time from the same section, or through your browser settings.

12. How to exercise your rights

To exercise any of the rights in Clause 11, contact us using the details in Clause 17. We may ask you to verify your identity before acting on your request, in order to protect your data from disclosure to a third party.

We will acknowledge your request within seven (7) days of receipt and will respond substantively without undue delay. We do not charge a fee for responding to a request, unless the request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee reflecting our administrative costs, or decline to act, giving reasons in writing.

13. Children's data

The Platform is intended for use by persons aged eighteen (18) years and above. In accordance with section 33 of the Act, we do not knowingly process the personal data of a child except with the consent of a parent or guardian and where the processing is in the best interests of the child. If you become aware that a child has registered an account without such consent, please contact us and we will delete the account and associated data.

14. Cookies and local storage

The Platform uses a small number of strictly necessary cookies and browser storage entries, namely a session cookie recording your logged-in state and locally stored authentication tokens. These are essential for the Platform to function and cannot be disabled without preventing you from logging in.

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioural tracking technologies. You may clear this data at any time through your browser settings or by logging out.

15. Push notifications

If you grant permission, we send browser push notifications about the status of your print jobs. This permission is entirely optional, is requested separately from account registration, and may be withdrawn at any time through your browser's site settings or from your Profile. Withdrawal does not affect your ability to use the Platform, and we will continue to notify you by SMS where you have not disabled that channel.

16. Changes to this Policy

We may amend this Policy from time to time to reflect changes in our services or in applicable law. The revised Policy will be published on this page with an updated effective date. Where a change materially affects your rights or the manner in which we process your data, we will notify you through the Platform or by SMS before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

17. Contact and complaints

Questions, requests and complaints regarding this Policy or our handling of your personal data should be directed to our Data Protection Officer:

Data Protection Officer: [Name of officer]
Email: [privacy@printease.co.ke]
Telephone / WhatsApp: 0742 900 269
Postal address: [P.O. Box, Nairobi]

If you are dissatisfied with our response, you have the right under section 56 of the Act to lodge a complaint with:

Authority: Office of the Data Protection Commissioner
Website: www.odpc.go.ke
Complaints email: complaints@odpc.go.ke

18. Governing law

This Policy is governed by and construed in accordance with the laws of Kenya, and in particular the Data Protection Act, No. 24 of 2019 and the Data Protection (General) Regulations, 2021. Any dispute arising out of it is subject to the jurisdiction of the courts of Kenya and to the complaints procedure of the Office of the Data Protection Commissioner.