Legal

Privacy Policy

How Rely collects, uses and protects personal data under Kenya’s Data Protection Act, 2019.

Last updated: 1 August 2026

1. Introduction

This Privacy Policy explains how Rely (“Rely”, “we”, “us”) processes personal data in connection with Rely Finance and related websites and services.

We process personal data in accordance with the Constitution of Kenya, 2010 (including Article 31 on privacy), the Data Protection Act, 2019 (“DPA”), the Data Protection (General) Regulations, 2021 and guidance of the Office of the Data Protection Commissioner (ODPC) where applicable.

Depending on the context, Rely may act as a data controller (for example, account and billing data of our customers’ administrators) or as a data processor (for example, employee payroll data you upload for your organisation). Our Data Processing Agreement describes processor obligations when we process on your documented instructions.

2. Data controller / contact

For personal data we control, the controller is Rely, operating Rely Finance at https://finance.rely.co.ke.

Privacy and data protection requests: support@rely.co.ke. You may also contact the ODPC regarding unresolved complaints under the DPA.

3. Scope

This Policy covers visitors to our marketing site, trial and paid users, organisation administrators and members and individuals whose data is entered by customers (for example employees), to the extent we process that data.

It does not cover third-party websites or services we link to. Customer organisations remain responsible for their own privacy notices to employees and other data subjects when they use our tools as controllers.

4. Categories of personal data

Depending on how the Service is used, we may process:

Identity and contact data: name, email, phone, organisation name, role, authentication identifiers
Account and security data: login events, session tokens, device/browser metadata, IP address, multi-factor settings
Billing and commercial data: plan, invoices, payment references, tax registration details you provide
Employment and payroll-related data you submit: employee identifiers, compensation, bank/mobile money details, statutory numbers (e.g. KRA PIN, NSSF, NHIF/SHIF-related identifiers), deductions, timesheets and payslip content
Finance operations data: customers, vendors, invoices, bills, payments, journals, inventory, attachments and audit logs
Support communications and feedback
Usage and technical logs needed to operate, secure and improve the Service

Sensitive personal data

Payroll and HR data may include sensitive personal data under the DPA (for example information revealing financial status or other special categories if you choose to store them). You must only submit such data where you have a lawful basis and any required consent or employment-law authorisation. We process it only as needed to provide the Service on your instructions.

5. How we collect data

Directly from you when you register, configure the product or contact support
From your organisation’s administrators and authorised users
Automatically via cookies, local storage, logs and similar technologies when you use the Service
From identity providers (for example Rely OAuth / Rely Auth) when you sign in
From payment providers for payment status (we minimise storage of full card data; cards are typically handled by PCI-compliant providers)

6. Purposes and legal bases

Under the DPA, we rely on one or more of: performance of a contract; legitimate interests (balanced against your rights); legal obligation; consent (where required); and vital interests in rare cases.

Provide, maintain and secure the Service (contract / legitimate interests)
Authenticate users and prevent fraud and abuse (legitimate interests / legal obligation)
Bill subscriptions and usage and keep accounting records (contract / legal obligation)
Process Customer Data as processor on documented instructions (contract with your organisation)
Send service notices (security, billing, material product changes) (contract / legitimate interests)
Respond to support requests (contract / legitimate interests)
Improve product reliability and UX using aggregated or de-identified analytics where feasible (legitimate interests)
Comply with law, regulators and valid legal process (legal obligation)

Marketing

We do not sell personal data. If we send optional marketing, we will do so in line with applicable law and offer an unsubscribe mechanism. Service and security messages are not marketing.

7. Cookies and similar technologies

We use essential cookies and similar storage for authentication, session security, load balancing and preferences. We may use limited analytics cookies or first-party telemetry to understand product usage. You can control cookies through browser settings; disabling essential cookies may break sign-in.

Where non-essential cookies require consent under applicable rules, we will obtain it via an appropriate mechanism.

9. Cross-border transfers

We primarily aim to process and store Service data in a manner appropriate for Kenyan customers. If personal data is transferred outside Kenya, we will ensure an appropriate legal basis and safeguards as required by the DPA (for example adequacy, contractual clauses or other permitted mechanisms) and inform controllers where required.

10. Security

We implement technical and organisational measures appropriate to the risk, which may include encryption in transit, access controls, tenant isolation patterns, logging, vulnerability management and staff confidentiality obligations. No method of transmission or storage is perfectly secure; please use strong authentication practices and report suspected incidents promptly.

11. Retention

We retain personal data only as long as needed for the purposes above, including to provide the Service, resolve disputes, enforce agreements and meet legal retention duties (for example tax and accounting).

When we act as processor, retention and deletion follow the customer’s instructions and our Data Processing Agreement, subject to legal holds. Backups may persist for a limited period before expiry.

12. Your rights under the DPA

Subject to the DPA and applicable exceptions, data subjects may have rights to:

Be informed of processing
Access personal data
Object to processing in certain cases
Correction of inaccurate data
Deletion in certain cases
Restriction of processing in certain cases
Data portability where applicable
Withdraw consent where processing is based on consent

How to exercise rights

Contact support@rely.co.ke. If we process data only as a processor for your employer or service provider, we may direct you to that organisation as controller or assist them to respond.

We may need to verify identity before acting on a request. You may lodge a complaint with the ODPC if you believe your rights have been infringed.

13. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children for account registration. If you believe we have, contact us to delete it, unless retention is required by law or legitimate employment processing by a controller.

14. Automated decision-making

Payroll and finance calculations are rule-based tools you configure and run. We do not make solely automated decisions that produce legal or similarly significant effects about individuals without human involvement by your organisation, except where a feature is clearly described otherwise. You remain responsible for decisions based on outputs.

15. Changes

We may update this Policy by posting a revised version with a new “Last updated” date. Material changes will be highlighted by reasonable means where practicable.

16. Contact

Questions: support@rely.co.ke

Billing: billing@rely.co.ke

Website: https://finance.rely.co.ke

These documents are provided for transparency with customers of Rely Finance in Kenya. They do not constitute legal advice. For advice specific to your organisation, consult a qualified Kenyan advocate.