Privacy Policy

1.Introduction

This Privacy Policy explains how Belvara (“Belvara,” “we,” “us,” or “our”) collects, receives, records, organises, structures, stores, adapts, retrieves, consults, uses, shares, transmits, discloses, combines, restricts, erases, destroys, transfers and otherwise processes Personal Data.

Belvara provides business management software, digital business tools, websites, applications, integrations, artificial intelligence functionality, business resources and related products and services designed to help businesses manage and understand their operations.

This Policy applies to Personal Data processed through or in connection with Belvara websites and domains, web and mobile applications, Merchant OS, Retail, Pickup Operations, Belvara Assistant AI, calculators, generators, templates, APIs, integrations, accounts, trials, subscriptions, support, sales, marketing, surveys, events, communications and any service or product that links to or incorporates this Policy, collectively the “Services.”

Belvara is based in Nairobi, Kenya and provides the Services internationally. Where mandatory local privacy or data-protection law gives an individual stronger or additional rights, those mandatory rights apply to the extent legally applicable. Nothing in this Policy excludes, waives, restricts or contracts out of a right or obligation that cannot lawfully be excluded, waived, restricted or contracted out.

2.Belvara

For purposes of this Privacy Policy, the relevant Belvara contracting entity is referred to as “Belvara.” Belvara, Nairobi, Kenya. Privacy and data-protection enquiries: privacy@belvara.co.ke. Security reports: security@belvara.co.ke. Legal enquiries: legal@belvara.co.ke. Customer support: support@belvara.co.ke. General enquiries: hello@belvara.co.ke. Where applicable law requires a data-protection officer, regional representative or another designated privacy contact, Belvara will publish the required details in this Policy or another legally appropriate notice.

3.When Belvara Acts as a Controller

Belvara may act as a data controller, business, responsible party or equivalent entity where Belvara determines the purposes and means of processing Personal Data. This may include information relating to account holders, prospective customers, business owners, administrators, employees and authorised users, website visitors, free-tool users, people who contact Belvara, suppliers, service providers, partners, job applicants, subscribers, billing contacts, research participants and other individuals with whom Belvara has a direct relationship. Belvara may also act as an independent controller for security, fraud prevention, billing, legal compliance, service administration, product improvement, dispute resolution and protection of legal rights.

4.When Belvara Acts as a Processor

Businesses using Belvara may upload, import, enter, generate, transmit, synchronise, access, organise or otherwise process Personal Data about customers, buyers, suppliers, employees, contractors, merchants, recipients, delivery contacts, account holders, payers, debtors, business partners and other individuals. The relevant customer will generally determine why and how that Personal Data is processed and will generally act as controller or equivalent; Belvara will generally act as processor, service provider, operator or equivalent. The Belvara Global Data Processing Addendum, customer agreement, product and integration terms, customer configuration and documented instructions may also govern this processing. A single interaction may involve different legal roles for different processing activities.

5.Customer Responsibilities

Customers are responsible for ensuring that Personal Data they process through Belvara is collected, used, disclosed and otherwise processed lawfully. Where applicable, customers must identify a lawful basis, provide privacy notices, obtain consent, honour rights, comply with direct-marketing laws, maintain relevant and accurate information, restrict access, configure roles and permissions, protect credentials, ensure authority to upload or connect Personal Data, use integrations lawfully and comply with sector-specific obligations. Where Belvara acts solely as processor, individuals should ordinarily direct privacy requests to the relevant customer; where required by law or contract, Belvara may assist.

6.Personal Data

“Personal Data” or “Personal Information” means information relating to an identified or reasonably identifiable natural person, household or other protected individual or unit where applicable law provides such protection. The meaning may differ between jurisdictions.

7.Customer Data

“Customer Data” means data, content, records or information submitted to, stored in, imported into, transmitted through, generated within or otherwise processed through the Services by or on behalf of a Belvara customer. Customer Data may include Personal Data and non-personal business information.

8.Sensitive Personal Data

“Sensitive Personal Data,” “Sensitive Personal Information,” “special category data” or similar terminology means information given additional protection under applicable law.

• Financial accounts and account credentials
• Government identifiers and precise geolocation
• Health, biometric and genetic information
• Race or ethnicity, religion and philosophical beliefs
• Political opinions, union membership, sex life and sexual orientation
• Citizenship, immigration status and other legally protected information

9.Account and Identity Information

Belvara may process full name, username, business name, job title, role, email address, telephone number, country, region, account identifiers, authentication and login information, authorised-user information, profile information, preferences, language, account status, subscription status and other information required to create or administer an account.

10.Business Information

Belvara may process business name, business type, industry, location, registration details, trading names, branches, stores, pickup locations, websites, social channels, tax information, taxpayer identifiers, invoice settings, payment methods, sales channels, products, variants, suppliers, inventory, purchasing records, product costs, pricing, discounts, expenses, revenue, sales, margins, targets, fulfilment information, financial information, operational metrics and reports. Business information may be Personal Data where it relates to an individual, sole proprietor, partner or identifiable person.

11.Customer and CRM Information

Where a business uses CRM, sales, payment, instalment, fulfilment or related functionality, Customer Data may include customer names, telephone numbers, email addresses, identifiers, delivery and billing addresses, order and purchase history, returns, refunds, credits, preferences, communications, payment status and references, instalment arrangements, balances, segmentation data, notes and related information.

12.Transaction and Payment Information

Depending on the payment method and integrations used, Belvara may process transaction amounts, currency, payment method and status, payer information, transaction IDs, payment references, Till, PayBill, Pochi or other mobile-money information, bank references, reconciliation and settlement information, refunds, reversals, cash-payment records, split and partial payments, marketplace settlement information, receivables and related metadata. Payment providers may process information independently under their own policies. Belvara does not require mobile-money PINs, banking passwords, authentication-only one-time passwords or full payment-card authentication credentials, and users should never disclose such credentials to support personnel or place them in free-text fields.

13.Instalment and Deferred Payment Information

Where a business uses instalment, partial-payment, Lipa PolePole or similar functionality, Belvara may process customer identity and contact details, purchase information, agreed payment schedules, amounts, due dates, payment history, outstanding balances, reminders, payment status, grace or overdue status, cancellation or completion status and related records. Customers remain responsible for complying with laws applicable to payment or credit-like arrangements.

14.Tax and Compliance Data

Where Belvara offers tax, invoicing, electronic invoicing or compliance functionality, it may process taxpayer identifiers, business registration data, invoices, customer and supplier information, tax rates and classifications, transaction information, electronic tax document identifiers, authorisation information, correction documents, credit notes, debit notes and reporting records. Where Belvara connects to a tax authority, tax system, electronic invoicing platform or authorised intermediary, relevant information may be transmitted to and received from that third party.

15.Inventory, Purchasing and Supplier Information

Belvara may process supplier names and contacts, purchase orders, supplier invoices, goods-received records, stock levels and movements, transfers, counts, damage or write-off information, product and landed cost, import and customs information, purchase history, supplier returns, payment status and related operational records.

16.Fulfilment, Pickup and Delivery Information

Belvara may process recipient names and telephone numbers, pickup location, delivery destination and address, order identifiers, delivery instructions, courier and rider information, collection and confirmation status, pickup and delivery status and fulfilment history. Relevant information may be transmitted to a third-party fulfilment, courier, rider, bus, pickup or logistics service.

17.Marketplace and Ecommerce Information

When a customer connects a marketplace, ecommerce service or online store, Belvara may receive account and store information, products, variants, inventory, customers, orders, returns, refunds, fulfilment and settlement data, payment information, synchronisation records, integration permissions and metadata. The data available depends on the integration selected and permissions granted.

18.Communications and Support Information

When an individual communicates with Belvara, it may process messages, emails, support tickets, attachments, screenshots, recordings where lawfully made, call notes, feedback, complaints, bug reports, survey responses, troubleshooting information, device information supplied for support and related correspondence.

19.Device, Usage and Technical Information

Belvara may automatically process IP address, device type, operating system, browser, language, approximate IP-derived location, device identifiers, timestamps, page views, sessions, navigation paths, clicks, feature usage, error logs, crash information, performance data, referral sources, authentication events, access logs, security events, integration events and related technical information.

20.Cookies and Similar Technologies

Belvara may use cookies, pixels, tags, local storage, SDKs, analytics technologies, browser storage and similar technologies for authentication, security, session management, fraud prevention, preferences, performance, diagnostics, analytics, service improvement, marketing, attribution and advertising where permitted. Where law requires consent for non-essential technologies, Belvara will seek that consent.

21.Belvara Assistant AI and AI Data

When a user interacts with Belvara Assistant AI or another AI-powered feature, Belvara may process prompts, questions, instructions, files, relevant authorised business records, account context, generated responses, feedback, usage information, safety signals and metadata. AI functionality may rely on third-party infrastructure, model providers or subprocessors. Users must not intentionally submit Personal Data or Sensitive Personal Data unless it is necessary, lawful, authorised and the feature is intended to process it.

22.Free Tools, Calculators, Templates and Generators

Some tools operate entirely within a user’s browser. Where a tool does not transmit user-entered information to Belvara, Belvara does not receive that input merely because the tool was used. Where a feature requires transmission to save a document, email a result, generate a file, use cloud storage or AI, synchronise information or submit a form, the relevant information may be transmitted as required.

23.Marketing and Engagement Information

Belvara may process marketing preferences, subscription status, campaign interactions, email engagement, communications history, referral and campaign source, event participation, lead source, form submissions, survey responses and related engagement information.

24.Information From Other Sources

Belvara may receive Personal Data from businesses, other account users, merchants, customers, suppliers, marketplaces, ecommerce platforms, payment providers, banks, mobile-money providers, tax systems, fulfilment providers, authentication and communications providers, fraud-prevention providers, business partners, service providers, public sources, authorised data providers and other lawful sources.

25.Providing the Services

Belvara may process Personal Data to create accounts, authenticate users, administer permissions, operate dashboards, process sales and payments, manage inventory, purchasing, customers, suppliers, orders, returns, refunds, fulfilment and instalments, generate documents, provide reporting and analytics, operate integrations, reconcile transactions, provide tax-related and AI functionality, process files and provide other requested Services.

26.Account and Subscription Administration

Belvara may process Personal Data for account configuration, subscription administration, trials, billing, renewal, plan changes, user invitations, permissions, authentication, account recovery, account closure and administrative communications.

27.Customer Support

Belvara may process Personal Data to answer questions, investigate reports, diagnose issues, troubleshoot, resolve complaints, restore service, provide technical assistance, improve documentation and maintain support records.

28.Security, Fraud Prevention and Abuse Prevention

Belvara may process Personal Data to authenticate users, secure accounts, investigate unusual activity, prevent fraud and abuse, detect malicious activity, prevent unauthorised access, maintain logs, investigate incidents, enforce permissions and protect Belvara, customers, users and third parties.

29.Product Improvement and Development

Belvara may process information to understand use, improve reliability, fix bugs, test functionality, conduct research, evaluate performance, improve user experience, develop features, evaluate product-market fit, improve automation and AI-assisted functionality, generate statistics and plan future products. Where reasonably possible, Belvara may use aggregated or de-identified information.

30.Personalisation and Business Insights

Belvara may process information to provide relevant dashboards, business insights, recommendations, alerts, reminders, reports, summaries, operational prompts, business trends and other account-specific functionality.

31.Communications

Belvara may communicate regarding account activity, security, service updates, outages, billing, subscriptions, support, product changes, legal and privacy changes, compliance, administrative matters and other service-related matters.

32.Marketing

Where legally permitted, Belvara may send promotional communications, advertise, personalise marketing, measure campaigns, conduct attribution, segment audiences, analyse acquisition, promote products and resources and conduct market research. Where consent is required, Belvara will rely on consent. Users may unsubscribe through the relevant communication or by contacting Belvara.

33.Legal Compliance

Belvara may process Personal Data to comply with privacy and data-protection laws, tax and accounting obligations, regulatory obligations, court orders, lawful government requests, sanctions or screening obligations, recordkeeping requirements, valid law-enforcement requests and other legal obligations.

34.Enforcement and Protection of Rights

Belvara may process information to enforce agreements, collect amounts due, investigate suspected violations or misuse, prevent circumvention, protect intellectual property, preserve evidence, establish, exercise or defend legal claims and resolve disputes.

35.Corporate Transactions

Personal Data may be processed where reasonably necessary in connection with financing, fundraising, investment, due diligence, merger, acquisition, restructuring, reorganisation, sale of assets, sale of shares or business interests, insolvency, bankruptcy, transfer of business or another corporate transaction.

36.Contract

Where applicable, Belvara may process Personal Data because processing is necessary to enter into a contract, provide the Services, administer an account, manage a subscription, provide support, fulfil a request or perform another contractual obligation.

37.Legitimate Interests

Where permitted, Belvara may rely on legitimate interests in operating and improving Belvara, developing products, protecting users and systems, preventing fraud and misuse, maintaining security, understanding usage, providing support, enforcing contracts, collecting debts, conducting permitted marketing, analysing business performance and protecting legal rights. Where required, Belvara will assess and balance those interests against affected individuals’ rights and interests.

38.Legal Obligation

Belvara may process Personal Data where required to comply with a legal obligation.

39.Consent

Belvara may rely on consent where required or appropriate. Consent may generally be withdrawn at any time, subject to applicable law. Withdrawal does not affect processing already carried out lawfully before withdrawal.

40.Vital Interests and Other Lawful Bases

Where applicable law permits, Belvara may process Personal Data to protect vital interests or under another lawful basis recognised by applicable law.

41.Ownership and Control of Customer Data

As between Belvara and the relevant customer, the customer retains the rights it has in Customer Data, subject to applicable law and the agreement with Belvara. Belvara does not claim ownership of a customer’s Personal Data merely because it is processed through Belvara.

42.Permitted Processing of Customer Data

Belvara may process Customer Data to provide the Services, follow lawful customer instructions, provide support, maintain security, prevent fraud, investigate abuse, comply with law, enforce agreements, protect Belvara’s rights, operate and improve functionality where legally and contractually permitted, and as otherwise permitted under the applicable agreement, DPA or law.

43.Prohibited or Unlawful Customer Data

Customers must not use Belvara to unlawfully collect, store, disclose, profile, monitor or otherwise process Personal Data. Belvara may restrict, suspend, remove, quarantine, preserve or disclose Customer Data where reasonably necessary to comply with law, respond to lawful orders, investigate abuse, protect the Services, protect users or third parties, prevent harm or enforce agreements, subject to applicable law and contract.

44.Organisation Administrators, Authorised Users and Delegated Access

A business or organisation may grant access through administrator and staff accounts, role-, location- and feature-based permissions, reporting permissions, delegated or temporary access, integrations and other controls. Depending on configuration, an Authorised User may view Customer Data, access customer, supplier, sales, finance, inventory and operational records, create or edit records, generate reports, export information, manage locations and integrations, add or remove users, change permissions, manage billing, review activity and configure products. The Customer determines who receives access, what a person may see or do, and when access changes or ends. Organisation-managed account users should understand that an employer, business owner or administrator may access information associated with the workspace. Belvara may retain access, permission and activity logs.

45.Service Providers and Subprocessors

Belvara uses third-party service providers for cloud hosting and application delivery, databases, authentication, storage and backups, security and monitoring, communications, support, approved AI functionality, document processing, developer infrastructure and other operations. Where a provider processes Customer Personal Data on Belvara’s behalf, Belvara treats it as a Subprocessor where applicable and uses appropriate contractual and organisational safeguards. Belvara maintains a separate Subprocessor List.

46.Payment Providers

Belvara may disclose relevant information to mobile-money providers, banks, payment processors, gateways, acquirers, settlement providers and related financial-service providers where required to process, verify, reconcile, refund, investigate or administer a transaction.

47.Tax and Regulatory Systems

Where a customer uses tax or compliance functionality, Belvara may disclose relevant data to tax authorities, government systems, authorised intermediaries, electronic invoicing providers and compliance service providers.

48.Customer-Requested Integrations

Where a customer activates an integration, Belvara may disclose relevant information to the selected provider. Customers decide whether to activate an integration and are responsible for reviewing permissions and third-party terms.

49.Professional Advisers

Belvara may disclose information where reasonably necessary to lawyers, accountants, auditors, insurers, financial advisers, security advisers, consultants and other professional advisers.

50.Corporate Affiliates

If Belvara creates or becomes part of a corporate group, Personal Data may be shared among related entities where legally permitted and reasonably necessary.

51.Legal and Regulatory Disclosure

Belvara may disclose Personal Data where reasonably necessary or permitted to comply with law, legal process, court orders, regulators, government authorities or law enforcement; protect Belvara, users, third parties, property or safety; investigate fraud; enforce agreements; preserve evidence; or establish, exercise or defend legal claims. Where legally permitted and appropriate, Belvara may challenge unlawful, invalid, excessive or overbroad requests.

52.Corporate Transactions

Personal Data may be disclosed to potential or actual investors, lenders, purchasers, acquirers, successors, advisers, financiers, transaction counterparties and related parties where reasonably necessary for a legitimate corporate transaction.

53.User Direction, Permissions or Consent

Belvara may disclose or make information available where an individual or Customer directs or requests disclosure, authorises an integration, invites an Authorised User, assigns a role, generates or shares an export, enables a feature that requires transmission, configures the Services to make information available or provides legally valid consent. Customer-controlled permissions are treated as processing on the Customer’s instructions, subject to Belvara’s security and legal obligations.

54.Sale, Sharing and Targeted Advertising

Belvara does not operate a business model based on selling Personal Data for money. Some privacy laws define sale, sharing, targeted advertising or similar concepts more broadly. If Belvara activates advertising, remarketing, audience-building, attribution or similar technologies, disclosures to advertising providers may fall within those definitions even where Belvara is not paid for the Personal Data itself. Where applicable law provides an opt-out right, Belvara will provide the required mechanism and honour legally recognised opt-out signals. Cookie use is described in the Belvara Global Cookie & Tracking Technologies Policy and live Cookie Settings or Privacy Choices interface.

55.Aggregation and De-Identification

Belvara may generate aggregated, statistical or de-identified information from information processed through the Services. Where data has been lawfully de-identified so that it is no longer Personal Data, Belvara may use it for analytics, benchmarking, research, forecasting, product development, security, service improvement, business intelligence, machine learning, performance analysis, industry insights, commercial planning and operational analysis. Belvara may retain lawfully de-identified or aggregated information for longer than identifiable Personal Data.

56.AI Providers and AI Data Handling

Belvara may use approved third-party AI service providers, model providers, hosting services or other Subprocessors. When Customer Personal Data is submitted to an AI feature, Belvara Processes it according to the Customer’s instructions and the applicable DPA. Belvara does not instruct third-party AI providers to use Customer Personal Data submitted through Belvara to train general-purpose models for independent purposes unless expressly authorised or clearly disclosed on a lawful basis. Belvara may use aggregated or lawfully de-identified information to improve Services, analytics, safety and product performance where permitted.

57.AI Quality and Limitations

AI-generated content may be incomplete, inaccurate, erroneous, contextually misunderstood or inappropriate. Users are responsible for reviewing outputs before relying on them for business decisions. Belvara does not represent that AI-generated information is legal, accounting, tax, financial, compliance or other regulated advice.

58.Automated Decision-Making

Belvara Assistant AI is designed to assist business users, not replace legally required human judgment. Belvara does not intend to use it as the sole basis for decisions producing legal or similarly significant effects concerning an individual unless it expressly introduces a legally reviewed feature for that purpose. Where applicable law gives rights concerning solely automated decisions or profiling, Belvara will provide those rights to the extent relevant processing is performed by Belvara as Controller.

59.Global Processing

Belvara is designed to support international use. Personal Data may be collected in one country, transmitted through or hosted in another, accessed by authorised personnel in another jurisdiction, processed by international providers or transferred between countries with different privacy laws.

60.Transfer Safeguards

Where applicable law restricts international transfers, Belvara may use adequacy decisions, standard contractual clauses, approved transfer agreements, supplementary contractual or technical safeguards, binding corporate rules, valid consent, legally recognised derogations, contractual safeguards, certification mechanisms or another lawful transfer mechanism.

61.Transfers From Kenya

Where Kenyan data-protection law applies to a transfer outside Kenya, Belvara will use applicable safeguards or legal mechanisms required under Kenyan law.

62.Transfers From the EEA

Where the GDPR applies, transfers outside the EEA may rely on European Commission adequacy decisions, Standard Contractual Clauses, supplementary measures or another permitted transfer mechanism.

63.Transfers From the United Kingdom

Where UK data-protection law applies, transfers may rely on UK adequacy regulations, the UK International Data Transfer Agreement, a valid UK Addendum, another approved safeguard or another lawful mechanism.

64.Regional Representatives

Belvara will appoint or identify a regional representative where applicable law requires it and may publish the representative’s details in this Policy or another appropriate notice.

65.General Retention Principles

Belvara retains Personal Data for as long as reasonably necessary for the purposes for which it was collected or as otherwise required or permitted by law. Retention may depend on the nature and purpose of information, account status, customer instructions, contracts, tax and accounting rules, limitation periods, regulatory requirements, fraud prevention, security, litigation, disputes, investigations, backup cycles and legal claims.

66.Financial, Tax and Compliance Records

Belvara may retain business, transaction, accounting, invoicing, tax or compliance records for the period required by applicable law, even after an account is closed or subscription ends. A deletion request may not require deletion of information that Belvara must lawfully retain.

67.Customer Data After Termination

Where Belvara acts as processor, return, export, retention and deletion of Customer Data may be governed by the customer agreement, DPA, applicable law, technical limitations, backup cycles and legal retention requirements.

68.Backups

Deletion from active production systems may not immediately delete backups. Backup copies may remain until overwritten, rotated, expired, destroyed under normal schedules or otherwise removed where technically feasible and legally required. During that period, backup data may remain isolated except for disaster recovery, security or legal purposes.

69.Legal Holds

Belvara may retain information beyond ordinary periods where reasonably necessary to comply with law or legal process, preserve evidence, investigate suspected wrongdoing, prevent fraud, respond to regulators, resolve disputes or establish, exercise or defend legal claims.

70.Security Measures

Belvara uses administrative, technical and organisational measures designed to protect Personal Data against accidental loss, unlawful destruction, unauthorised access or disclosure, alteration, misuse, unauthorised processing and other reasonably foreseeable risks.

• Authentication and access controls
• Role-based permissions, monitoring and logging
• Encryption, backups and infrastructure protections
• Vendor controls, security testing and incident response
• Internal operational safeguards

71.No Absolute Security Guarantee

No internet-based system, cloud platform, network, database, transmission method or security measure can be guaranteed completely secure. Belvara does not warrant that every incident can be prevented, unauthorised access can never occur, data can never be lost, malicious actors can never bypass safeguards or third-party infrastructure will never experience an incident. Nothing here limits an obligation or liability that cannot legally be limited.

72.User Security Responsibilities

Users are responsible for using secure passwords, maintaining credential confidentiality, using available security features, limiting account access, removing former users, configuring permissions properly, protecting devices, avoiding credential sharing, notifying Belvara of suspected compromise and securing connected third-party accounts.

73.Security Incidents and Personal Data Breaches

Where Belvara becomes aware of a Personal Data breach or relevant security incident, it may investigate, contain, remediate vulnerabilities, preserve evidence, assess risk, notify relevant parties and take other appropriate steps. Where law requires notification to a regulator, customer or affected individual, Belvara will notify in accordance with applicable requirements. Where Belvara acts as processor, it may notify the controller under the applicable contract or DPA.

74.Rights That May Apply

Depending on location and applicable law, individuals may have rights to be informed, confirm processing, access and receive a copy of Personal Data, request correction or deletion, request restriction, object to processing or direct marketing, request portability, withdraw consent, opt out of certain targeted advertising, sale or sharing, limit certain uses of Sensitive Personal Data, object to certain automated decision-making, obtain information about transfers, appeal decisions, lodge complaints and exercise other rights provided by law. These rights are not absolute.

75.Legal Exceptions to Rights

Belvara may retain or continue processing where necessary to comply with law, complete a transaction, provide a requested service, maintain security, prevent fraud, protect another person’s rights, preserve evidence, comply with tax or accounting obligations, establish, exercise or defend legal claims, or rely on another lawful exception.

76.Exercising Privacy Rights

Privacy requests may be submitted to privacy@belvara.co.ke. A request should include enough information to understand the request, identify the relevant account or interaction, determine applicable law where necessary, locate the relevant Personal Data and verify the request where required. Belvara will not require more Personal Data than reasonably necessary and will respond within the timeframe required by applicable law, including permitted extensions.

77.Identity Verification

Belvara may verify a requester before disclosing, correcting, deleting, exporting or otherwise acting on Personal Data. Verification may depend on sensitivity, request type, fraud risk, account information, authentication status and applicable law. Belvara may refuse disclosure where it cannot reasonably verify entitlement.

78.Authorised Agents

Where applicable law permits an authorised agent to submit a request, Belvara may require proof of authority, verification of the individual, signed permission, power of attorney or other legally permitted evidence.

79.Requests Concerning Merchant-Controlled Data

If Personal Data was provided by a business using Belvara, such as a merchant from whom an individual purchased goods, the request should ordinarily be directed to that business. Where Belvara acts solely as processor, the customer generally determines whether and how the request is fulfilled. Belvara may redirect the request, notify or assist the customer, or act directly where required by law or contract.

80.Direct Marketing

Where permitted, Belvara may send information about products, features, business tools, educational content, events, resources, offers, promotions and related services. Where consent is required, Belvara will obtain appropriate consent.

81.Marketing Opt-Out

Individuals may unsubscribe using the relevant communication or by contacting Belvara. Unsubscribing does not prevent non-marketing communications such as security alerts, billing and subscription notices, legal or privacy notices, service messages, support communications and other administrative communications.

82.Categories of Cookies

Belvara may use strictly necessary cookies for authentication, security, account access, session management, fraud prevention and core functionality; functional cookies for settings, preferences, language and display choices; analytics cookies for traffic, feature usage, journeys, performance, errors, engagement and service quality; and advertising or marketing technologies where used and legally permitted for attribution, audience measurement, advertising, campaign optimisation and remarketing.

83.Consent and Cookie Controls

Where prior consent is legally required, non-essential cookies and similar technologies remain disabled until valid consent is provided. Belvara provides Accept All, Reject Non-Essential and Manage Preferences controls where an opt-in banner applies, together with a persistent Cookie Settings or Privacy Choices mechanism. Detailed rules are set out in the Belvara Global Cookie & Tracking Technologies Policy.

84.Browser-Based Opt-Out Signals

Where applicable law requires recognition of a legally valid opt-out preference signal, including Global Privacy Control where applicable, Belvara will honour that signal to the extent legally required. The absence of a signal is not affirmative consent where affirmative consent is otherwise required.

85.Third-Party Services

Belvara may link to or integrate with payment providers, mobile-money services, banks, marketplaces, ecommerce platforms, tax systems, courier and delivery providers, messaging platforms, analytics and authentication providers, AI providers, cloud services, social-media platforms and other business tools. Third parties may independently process Personal Data under their own policies, terms and legal obligations.

86.Customer Responsibility for Third-Party Services

Customers are responsible for deciding whether to use third-party services and for reviewing permissions, privacy, security practices, terms, fees and legal implications before enabling or using them.

87.Children

Belvara is a business-management platform and is not directed to children. Individuals under 18 should not independently create a Belvara business account unless legally permitted and appropriately authorised. Belvara does not knowingly design the Services for behavioural advertising directed at children. If it learns that a child’s Personal Data has been collected or processed unlawfully, it may delete or otherwise address the information as required by law. Customers remain responsible for lawful processing of minors’ Personal Data through Belvara.

88.Kenya

Where Kenya’s Data Protection Act, 2019 and applicable regulations govern the Processing, Belvara will apply requirements concerning lawful, fair and transparent Processing, purpose limitation, minimisation, accuracy, retention, security and cross-border transfers. Eligible Data Subjects may have rights to be informed, access Personal Data, object to Processing, request correction and request deletion. Belvara may be required to register with the Office of the Data Protection Commissioner, and individuals may lodge a complaint with the ODPC where applicable.

89.European Economic Area

Where the GDPR applies, individuals may have rights including access, rectification, erasure, restriction, objection, portability, withdrawal of consent and rights relating to certain automated decision-making. Eligible individuals may lodge a complaint with a competent supervisory authority. If Belvara becomes legally required to appoint an EU representative, it will publish the representative’s details.

90.United Kingdom

Where UK data-protection law applies, individuals may have rights including access, rectification, erasure, restriction, objection, portability, withdrawal of consent and rights relating to certain automated decision-making. Eligible individuals may complain to the Information Commissioner’s Office. If a UK representative becomes legally required, Belvara will publish the representative’s details.

91.Switzerland

Where Swiss data-protection law applies, Belvara will provide rights and protections required by applicable law and will use applicable transfer safeguards where legally required.

92.California

If the California Consumer Privacy Act, as amended, applies, eligible California residents may have rights to know, access, deletion, correction, opt out of sale or sharing, limit certain uses or disclosures of Sensitive Personal Information and avoid unlawful discrimination for exercising applicable rights. Categories may include identifiers, customer-record information, commercial information, internet or network activity, approximate geolocation, professional or employment information, account and transaction information, financial information, inferences and Sensitive Personal Information. Belvara does not discriminate against individuals for exercising applicable rights and will provide required privacy-choice mechanisms and honour qualifying opt-out signals such as Global Privacy Control.

93.Other United States Privacy Laws

Residents of U.S. states with applicable comprehensive privacy laws may have rights including access, correction, deletion, portability, targeted-advertising opt-out, sale opt-out, certain profiling opt-outs, appeal rights and other rights created by applicable law. Belvara will provide those rights to the extent the law applies to Belvara and the relevant processing.

94.South Africa

Where South Africa’s Protection of Personal Information Act applies, Belvara will process Personal Information consistently with applicable requirements. Eligible individuals may have the right to lodge complaints with the Information Regulator of South Africa.

95.Brazil

Where Brazil’s Lei Geral de Proteção de Dados applies, Belvara will use an applicable lawful basis and provide transparency and Data Subject rights. Transfers will use a legally permitted mechanism where required. Individuals may contact privacy@belvara.co.ke concerning LGPD rights or international-transfer information.

96.Canada

Where Canadian federal or provincial privacy law applies, Belvara will provide required transparency, access, correction, consent and other legally required protections.

97.Australia and New Zealand

Where applicable Australian or New Zealand privacy law applies, Belvara will provide rights and protections required by relevant law.

98.Other Countries

The absence of a country-specific section does not mean Belvara disregards that country’s law. Where another jurisdiction’s mandatory privacy law applies, Belvara will comply with requirements legally applicable to its processing.

99.Legal Requests

Belvara may receive requests for information from courts, regulators, tax authorities, government agencies, law-enforcement agencies, supervisory authorities and other legally authorised bodies. It may disclose information where required by legally valid process or another lawful basis permits disclosure.

100.Review of Requests

Where legally permitted and reasonably practicable, Belvara may review legal validity, request clarification, seek narrowing, reject invalid requests, challenge unlawful requests, disclose only information reasonably required and notify the relevant customer or individual. Notice may be prohibited in some circumstances.

101.Reorganisation, Investment, Financing or Sale

If Belvara participates in a merger, acquisition, financing, fundraising, investment, restructuring, reorganisation, sale of assets or business interests, insolvency, bankruptcy or other transfer of business, Personal Data may be reviewed, transferred or disclosed in connection with that transaction, subject to applicable law. A successor or permitted transferee may continue processing relevant Personal Data in accordance with applicable obligations.

102.Closing a Belvara Account

Customers may close or terminate an account under the applicable subscription agreement or Terms of Service. Closure does not necessarily result in immediate deletion. Belvara may retain information where required by law, necessary for tax, accounting, security, fraud prevention, dispute resolution or legal claims, required by contract, temporarily retained in backups or otherwise permitted by law.

103.Data Minimisation

Belvara seeks to process Personal Data reasonably necessary for relevant purposes. Users should avoid entering unnecessary Personal Data into free-text fields, notes, product descriptions, AI prompts, attachments, support messages, custom fields or other locations not intended for that information.

104.Accuracy

Users are responsible for keeping Personal Data and business records submitted to their account reasonably accurate and up to date where required. Belvara may provide functionality allowing authorised users to update certain information directly.

105.Updates

Belvara may update this Policy to reflect changes to the Services, products, integrations, technology, vendors, AI functionality, law, regulatory guidance, security practices, data practices and corporate or operational changes. The Last Updated date identifies the most recent revision.

106.Material Changes

Where applicable law requires additional notice of material changes, Belvara will provide it using an appropriate method. Where law requires consent to a change in processing, Belvara will seek consent rather than relying solely on continued use.

107.Translations

Belvara may provide translations for convenience. Unless applicable law requires otherwise, the English-language version will be used to interpret this Policy if translations differ. Nothing limits mandatory rights under applicable law.

108.Privacy Contact

For privacy questions, concerns, complaints or rights requests, contact Belvara, Nairobi, Kenya at privacy@belvara.co.ke. Other contact channels are security@belvara.co.ke for security reports, legal@belvara.co.ke for formal legal enquiries, support@belvara.co.ke for customer support and hello@belvara.co.ke for general enquiries. Privacy-rights requests should be directed to privacy@belvara.co.ke. Belvara may request reasonable information to verify identity, authority or account relationship.

109.Complaints

Depending on applicable law, an individual may lodge a complaint with a competent privacy or data-protection authority, including the Office of the Data Protection Commissioner of Kenya, an EU supervisory authority, the UK Information Commissioner’s Office, the Information Regulator of South Africa, an applicable Brazilian, Canadian, Australian, New Zealand, U.S. or other competent authority. Belvara encourages individuals to contact privacy@belvara.co.ke first where appropriate.

110.Related Policies and Agreements

This Policy should be read together with applicable Terms of Service, the Belvara Global Data Processing Addendum, Belvara Global Cookie & Tracking Technologies Policy, Belvara Subprocessor List, Belvara Acceptable Use Policy, subscription terms, product-specific terms, integration terms, marketplace terms and other agreements entered into between Belvara and a customer.

111.Processor Processing

Where Belvara processes Personal Data as processor, the DPA and customer agreement may contain additional terms governing processing instructions, confidentiality, subprocessors, security, international transfers, data-subject requests, incident notification, deletion, return of data and audit or compliance obligations.

112.No Expansion of Legal Obligations

Nothing in this Policy creates rights beyond applicable law or express agreement, creates unagreed contractual obligations, waives a legal defence, admits liability or wrongdoing, admits that a law applies where it does not, voluntarily submits Belvara to an otherwise inapplicable law, creates a private right of action, waives an exemption, limitation, defence or privilege, restricts reliance on a lawful basis, restricts compliance with legal obligations or prevents Belvara from exercising rights available under law. Nothing limits obligations or liabilities that cannot legally be excluded or limited.

113.No Guarantee of Universal Applicability

Privacy laws differ across jurisdictions and change over time. Belvara may supplement this Policy with regional notices, product-specific notices, contractual terms, consent mechanisms, transfer documentation or other disclosures where required.

114.“Including”

References to “including,” “include” or similar terms mean including without limitation unless the context requires otherwise.

115.References to Laws

References to a law include amendments, implementing regulations, successor laws, replacement laws and legally binding subordinate legislation where applicable.

116.Equivalent Legal Terms

Where privacy terminology differs, controller, business, responsible party, processor, service provider, operator, Personal Data and Personal Information should be interpreted consistently with applicable law.

117.Evolution of the Services

Belvara may change, expand, restrict, replace or discontinue products, features, integrations, vendors, infrastructure, hosting arrangements, payment connections, AI or analytics providers, business models, geographic availability and operational processes. Where a change materially affects processing, Belvara will implement legally required notices, consents, contractual measures or safeguards.

118.No Restriction on Lawful Business Operations

Nothing in this Policy prevents Belvara from processing Personal Data where it has a lawful basis and complies with applicable requirements. Belvara may take reasonable actions necessary to operate Services, protect the business, users and systems, comply with law, prevent fraud, enforce agreements, preserve records, respond to disputes, manage risk, improve products and conduct legitimate operations.

119.Belvara’s Privacy Approach

Belvara’s objective is to process Personal Data responsibly while operating a secure, scalable and globally available business platform. Belvara seeks to collect information for legitimate purposes, limit unnecessary processing, protect information appropriately, provide transparency, respect applicable rights, maintain operational flexibility, use service providers responsibly and comply with mandatory privacy laws applicable to its processing.

120.Final Public Version

This Privacy Policy is Belvara’s public privacy notice for the Services described above. Operational details that change more frequently, including active Subprocessors and cookie or tracking technologies, are maintained in Belvara’s current Subprocessor List and live Cookie Settings or Privacy Choices disclosures. Belvara will update this Policy when material privacy practices or applicable legal requirements change.