Privacy Policy

4.1 Website and Corporate Enquiries

When you visit cogitusoslimited.co.ke or submit an enquiry, we may collect:

• Full name, email address, phone number, company name, product or service interest, project description, budget range, and timeline (via the Get Quote form at /get-quote, processed through Formspree)
• Information you provide when contacting us directly by email, phone (+254 707 211 241), or WhatsApp
• Standard server and browser metadata (such as IP address, browser type, and referring URL) collected by our hosting infrastructure
• Cookie and consent preferences (see Section 13)

Our Contact page provides direct communication channels only; it does not include an embedded web form.

4.2 Arche HR: Human Resources Management System

Arche HR is an HR and payroll platform. We process the following personal data on behalf of organisations (our clients) that deploy Arche HR for their employees:

Employee Identification Data

• Full legal names
• National Identity Card number or Alien ID number
• Passport number (where applicable)
• Date of birth and gender
• Profile photograph
• Personal contact information: phone number, personal email address, physical and postal address

Statutory Compliance Data

• Kenya Revenue Authority (KRA) Personal Identification Number (PIN)
• National Hospital Insurance Fund (NHIF) membership number
• National Social Security Fund (NSSF) membership number

Financial and Payroll Data

• Bank account details (bank name, branch, account number)
• M-Pesa mobile money number for salary disbursement
• Gross salary, net salary, tax brackets, and statutory deductions
• Loan deductions and salary advances

Employment and Performance Data

• Job title, department, and reporting structure
• Date of hire, contract type, probation records
• Leave records and balances
• Time and attendance records
• Performance appraisal records and ratings
• Disciplinary and grievance records

Recruitment Data

• CVs, application forms, and cover letters (job applicants)
• Interview notes and assessment scores
• References and background check outcomes

4.3 Cogitus: College Management System

Cogitus is a combined Student Information System (SIS), Learning Management System (LMS), financial management, and CRM platform for higher education institutions. We process the following data on behalf of educational institutions:

Student Data

• Full names, national ID number, or birth certificate number
• Date of birth, gender, and nationality
• Student photograph
• Programme, course, and unit enrolment records
• Academic results, grades, transcripts, and examination records
• Fees balance, payment history, and financial aid records
• Higher Education Loans Board (HELB) loan records (where applicable)
• Parent or guardian names and contact information
• Student contact information: email, phone number, physical address

Staff Data

• Academic staff: qualifications, teaching assignments, and course allocations
• Administrative staff: employee records comparable to Arche HR data categories

4.4 Arbor: Real Estate CRM & Property Listings Platform

Arbor supports property agencies in managing leads, listings, transactions, and commissions. We process the following data on behalf of real estate agencies:

Client (Buyer/Seller/Tenant/Landlord) Data

• Full names, national ID number
• Contact information: email address, phone number, physical address
• Property preferences, viewing history, and enquiry records
• Offer letters and transaction records
• Financial pre-qualification data: budget ranges, mortgage or loan approval details

Property Data

• Property owner identification and contact details
• Tenant identification and contact details
• Lease agreement particulars: rent amounts, tenure, terms
• Property valuation data

Agent Data

• Agent names, contact information, and licence numbers
• Commission records and disbursement details
• Sales performance records

4.5 Vuka OS: Growth Workspace for DJs & Artists

Vuka OS is a self-serve workspace for DJs and artists covering gig promotion, smart links, pre-saves, fan messaging, and promotional campaigns. Its dedicated Privacy Policy at vukaos.co.ke/privacy governs processing within the product. In summary, we process:

Artist Data

• Name, email address, and optional phone number
• Stage profile and connected social account details, including access tokens (encrypted at rest)
• M-Pesa billing references, invoices, and subscription records
• Platform activity and audit logs

Fan Data

• Names and contact details submitted through opt-in forms (encrypted at rest)
• Consent records and timestamps; fans can withdraw consent at any time from a personal preferences page without creating an account

4.6 Bohari IMS: Inventory & Cost Control

Bohari IMS is a multi-outlet inventory and cost-control platform for restaurants, bistros, and cafés. Its dedicated Privacy Policy at bohari.co.ke/privacy-policy governs processing within the product. In summary, we process:

User Data

• Names, email addresses, phone numbers, and role assignments of a client's staff
• Authentication records, including two-factor settings and sign-in logs
• Actions taken in the platform: receipts, counts, approvals, and their reasons, kept in an append-only audit log

Supplier and Transaction Data

• Supplier names, contact details, and KRA PINs where provided
• Purchase orders, delivery records, supplier invoices, and settlement references
• Subscription billing records, including M-Pesa transaction references

6.1 Arche HR

• Processing monthly payroll and disbursing salaries via M-Pesa and bank transfer
• Calculating and remitting statutory deductions to KRA (PAYE), NHIF, and NSSF
• Managing employee leave requests, approvals, and balances
• Recording and reporting time and attendance
• Conducting and recording employee performance appraisals
• Managing the full recruitment and onboarding lifecycle
• Generating statutory reports: P9A forms, NSSF schedules, NHIF schedules
• Providing HR analytics and workforce insights to authorised administrators

6.2 Cogitus

• Processing student admissions and registrations
• Managing academic records, examination results, and transcripts
• Billing and processing student fee payments
• Managing course allocations and academic timetables
• Operating the Learning Management System (LMS) for course delivery and assessments
• Generating reports for institutional compliance with Kenya's education regulatory bodies
• Communication with students, parents, and guardians

6.3 Arbor

• Managing lead capture, qualification, and sales pipeline for property transactions
• Publishing and updating property listings
• Matching clients to properties based on preferences and budget
• Recording and processing property transaction documentation
• Calculating and disbursing agent commissions
• Providing CRM analytics and performance reporting to agency administrators

6.4 Vuka OS

• Operating the workspace: publishing scheduled content, smart links, pre-save pages, and event RSVP pages
• Delivering opted-in fan messages on WhatsApp and SMS on behalf of the artist who collected the contact
• Generating AI drafts and proposals that require the artist's explicit approval before consequential actions run
• Processing subscription billing and campaign fees via M-Pesa, with VAT-itemised invoices
• Maintaining activity and audit logs, including any time-limited support access

6.5 Bohari IMS

• Recording stock movements, deliveries, stocktakes, and waste across a client's outlets
• Matching supplier invoices against purchase orders and goods received, and recording approvals with their reasons
• Recording settlement references against invoices; Bohari IMS does not disburse funds
• Producing stock, purchase, waste, and variance reports for the client organisation
• Processing subscription billing via M-Pesa

6.6 Corporate Website

• Responding to enquiries and sales leads submitted via the Get Quote form or direct contact channels
• Operating essential website functionality and remembering cookie consent preferences
• Measuring website performance where analytics tools are deployed and consent is given

7.1 Statutory and Regulatory Bodies

Kenya Revenue Authority (KRA)

employee PAYE data transmitted for tax compliance

National Hospital Insurance Fund (NHIF)

employee contribution schedules

National Social Security Fund (NSSF)

employee contribution schedules

Office of the Data Protection Commissioner (ODPC)

as required by the DPA 2019

Ministry of Education / Kenya National Examinations Council (KNEC)

student data as required by law

Lands Registry

property ownership and transaction data for Arbor transactions

7.2 Payment Processors and Financial Partners

Safaricom M-Pesa

for payroll disbursements via Arche HR, subscription and campaign billing in Vuka OS, subscription billing in Bohari IMS, and payment collections

Commercial banks

for salary transfers and financial transaction processing

Payment gateway providers

for fee payments in Cogitus

7.3 Cloud Infrastructure and Service Providers

We use cloud infrastructure providers for hosting, data storage, and platform delivery. Website enquiries submitted through our Get Quote form are processed by Formspree, which acts as a data processor under contractual arrangements. These providers process data only as necessary to deliver the relevant service and are bound by appropriate data processing agreements.

For Vuka OS, delivering the service additionally involves messaging carriers (the WhatsApp Business Platform and SMS providers) for opted-in fan messages, the social platforms an artist connects (Instagram, Facebook, TikTok), and AI model providers for generating drafts, each receiving only the information necessary for that function, as detailed at vukaos.co.ke/privacy.

7.4 Client Organisations (Data Controllers)

As a Data Processor, we process personal data on behalf of our client organisations (the Data Controllers). Data is accessible only to authorised administrators within the client organisation according to role-based access controls configured by the organisation.

7.5 Law Enforcement and Legal Obligations

We may disclose personal data where required by a court order, statute, or lawful authority, or to protect our legal rights and the safety of individuals.

9.1 Technical Measures

• Encryption of data in transit using TLS/HTTPS across all platforms
• Encryption of personal data at rest in our databases
• Role-Based Access Control (RBAC): access to personal data limited to authorised personnel based on their job function
• Multi-factor authentication (MFA) for platform administrators and privileged users
• Regular automated security monitoring and access logging
• Vulnerability scanning and patch management

9.2 Organisational Measures

• Data protection training for staff with access to personal data
• Documented data processing procedures and an internal data protection policy
• Contractual data processing agreements with all third-party processors
• Regular review of access rights as roles change

9.3 Data Breach Notification

In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach, in accordance with Section 43 of the DPA 2019. Where the breach is likely to result in a high risk to the rights of affected data subjects, we will also notify those individuals without undue delay.