Privacy Policy

This Privacy Policy explains how Optinet Global Links ("Optinet", "we", "us") collects, uses and protects personal data through AfriSecSys (the "Service"). It applies to visitors of our public website and to data processed on behalf of subscribing companies ("Customers") and their staff and guards ("Users").

1. Data We Collect

Depending on how the Service is used, this can include:

• Account data — name, email address, phone number, and password (stored hashed, never in plain text).
• Employee/guard HR data, entered by a Customer — national ID number, KRA PIN, job title, department, employment history, emergency contacts, and uploaded documents such as ID copies or certificates.
• Operational data — attendance records, shift deployments, incident reports, occurrence book entries, and patrol checkpoint scans (which may include a device's location at the time of a scan).
• Financial data — invoices, expenses, payroll figures, and M-Pesa transaction references (we do not receive or store full M-Pesa PINs or banking credentials — those are handled directly by Safaricom's Daraja platform).
• Communications data — messages sent through our contact form, and the content and delivery status of SMS messages sent via the Service.
• Usage data — an audit log of significant actions taken in the Service (who changed what, and when), for accountability and troubleshooting.

2. How We Use It

Personal data is used to: provide and maintain the Service for the Customer that entered it; authenticate users and enforce permissions; send transactional messages such as temporary passwords or password-reset links (by SMS, since no email delivery is configured for this purpose); process payments a Customer initiates; and respond to support or contact requests. We do not sell personal data, and we do not use Customer Data to train any third-party model.

3. Who We Share It With

We share data only as needed to provide the Service:

• Safaricom (M-Pesa Daraja) — to process payments a Customer's client makes or initiates.
• TextSMS — to deliver SMS messages the Service sends on a Customer's behalf, such as login credentials or password resets.
• Law enforcement or regulators — only where legally required to do so.

We do not share personal data with advertisers, data brokers, or analytics companies — no third-party analytics or tracking scripts run on this site or within the Service.

4. Where Data Is Stored

Data is hosted on infrastructure operated by Optinet. Each Customer's data is stored in its own isolated database schema (see our Security page), and connections to the Service are encrypted with TLS.

5. Cookies

We use only the session cookie strictly necessary to keep you signed in. We do not use third-party advertising or analytics cookies.

6. Data Retention

Data is retained for as long as a Customer's account is active, and for a limited period after termination to allow data export, after which it is deleted except where we are required by law to retain it (for example, statutory payroll or tax records).

7. Your Rights

Under Kenya's Data Protection Act, 2019, individuals have the right to request access to, correction of, or deletion of their personal data, and to object to certain processing. For data entered by your employer as part of using the Service, requests are usually best directed to your employer (the Customer) first, since they control that data; we will also action a verified request made directly to us. Reach us via our contact page or at [email protected].

8. Children's Privacy

The Service is intended for business use by adult employees and clients of security companies, and is not directed at children. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions about this Privacy Policy or how your data is handled can be sent via our contact page, or by email to [email protected].