1. Who we are
Certified Systems ("we", "us") is a software company based in Nairobi, Kenya. We provide Plotika (real estate), LeseniHub (driving schools), CBCHub (CBC schools) and RentalHub (rental property management), and we build custom business software. This policy explains how we handle personal data on our website and in these systems, in line with the Kenya Data Protection Act, 2019.
Contact: info@certifiedsystems.co.ke · +254 702 533 114 · Nairobi, Kenya.
2. Two roles: customer data and account data
Our customers’ data. Companies, schools, driving schools and landlords who use our systems enter records about their own clients, learners, students, tenants and staff. For that data the customer decides why and how it is used (the "data controller") and we act as their service provider (the "data processor"). We only process it to run the system for them.
Our own account and website data. For the people who sign up, contact us or pay us, Certified Systems is the data controller.
3. What we collect
- Account details: business or organisation name, your name, email address, phone number, county or town, and a password (stored only in scrambled, hashed form).
- Subscription and billing records: plan, trial and payment dates, invoices, and the M-Pesa transaction code or payment reference you give us.
- Records you enter in a system: for example plots and clients, students and lessons, learners and fees, or houses, tenants and rent payments, as entered by the customer.
- Messages: what you send through the contact form, by email or by phone, and support requests.
- Technical data: your IP address and basic request details, kept in server logs and used to limit repeated login attempts and to keep the service secure.
We do not run advertising trackers or sell personal data.
4. Why we use it
- To create and run your account and provide the system you signed up for.
- To issue invoices, confirm payments and manage subscriptions, trials and access.
- To send you service emails such as password reset codes and payment notices.
- To give support, answer questions and fix problems.
- To keep the service secure and prevent misuse.
- To meet legal and tax obligations.
Our legal bases are performing our contract with you, meeting legal obligations, our legitimate interest in running a secure service, and your consent where we ask for it.
5. Who we share it with
We do not sell your data. We share it only where needed to run the service:
- Hosting and email providers that store the data and send our emails on our behalf.
- Payment providers such as Safaricom M-Pesa and banks, when you pay us or when a customer records payments.
- Messaging services such as SMS or WhatsApp, only if a customer switches those features on.
- Our website tools: the contact form is delivered by an email-forwarding service, and some pages load fonts from Google Fonts.
- Authorities, when the law requires it.
Within each system, every customer’s records are kept separate and cannot be seen by other customers.
6. Where data is kept and how long
Data is stored on servers run by our hosting provider, in databases separate from our public website. Where a provider is outside Kenya, we only use providers that protect data to a comparable standard.
We keep account data for as long as your account is active and for the period the law requires afterwards (for example invoices for tax purposes). Daily backup copies are kept for about 7 days. When an account is closed and the customer asks us to, we delete or anonymise its records, except where we must keep them by law.
7. How we protect it
- Connections to our systems use HTTPS.
- Passwords are stored hashed, never in plain text.
- Each customer’s records are separated, and access is checked on the server for every request.
- Repeated login attempts are limited, and password resets use short-lived emailed codes.
- Servers are backed up daily.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the Office of the Data Protection Commissioner as the law requires.
8. Children and learners
CBCHub and similar features hold records about learners who are often under 18. The school is responsible for having the right to record this information, including parents’ or guardians’ consent where needed. We process it only on the school’s instructions and do not use it for any other purpose. Our own sign-up and contact services are for adults.
9. Your rights
Under the Data Protection Act you may ask to see the personal data we hold about you, correct it, have it deleted, object to or limit how it is used, and receive a copy in a usable format. If your data is held in a customer’s system, such as a school or a landlord, please also contact that customer, and we will help them respond.
To use any of these rights, email info@certifiedsystems.co.ke. We will reply within a reasonable time and may ask you to confirm who you are. You may also complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).
10. Cookies and browser storage
We do not use advertising or tracking cookies. Our systems store small items in your browser, such as your login session and preferences, and our website may save a copy of itself so it opens quickly and works offline. You can clear this at any time in your browser settings.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell account holders about significant changes.
12. Contact
Certified Systems, Nairobi, Kenya
Email: info@certifiedsystems.co.ke
Phone: +254 702 533 114