RoyceTalk Privacy Policy

This Privacy Policy explains how Royce Technologies LTD ("Royce", "we", "us") collects, uses, shares and protects personal data when you useRoyceTalk, our business messaging platform for SMS and WhatsApp (the "Service"), including when businesses connect their WhatsApp numbers to RoyceTalk through the Meta WhatsApp Business Platform.

We process personal data in line with the Kenya Data Protection Act, 2019 and its regulations, and with the Meta Platform Terms and WhatsApp Business policies.

1. Who this policy covers

• Clients: businesses and their staff who create a RoyceTalk account and use it to message their customers.
• End users: people who send messages to, or receive messages from, a business that uses RoyceTalk.

For messages a client sends and receives, the client is the data controller and Royce acts as a data processor on the client's instructions. For client account data, Royce is the data controller.

2. Data we collect

From clients

• Account details: name, business name, email address, phone number and login credentials.
• Billing details: payment records and M-Pesa or other payment transaction references. We do not store full card numbers.
• Usage data: log-ins, actions in the dashboard, IP address, browser and device information.

From WhatsApp, through the Meta WhatsApp Business Platform

When a client connects a WhatsApp Business account to RoyceTalk, we receive:

• WhatsApp Business account, business portfolio and phone number identifiers, and the business profile.
• End users' WhatsApp phone numbers, profile names and, where applicable, business-scoped user IDs.
• Message content and media (text, images, documents, audio, video, locations and contacts) sent or received by the business.
• Message metadata such as timestamps and delivery and read statuses.
• Message templates the client creates.
• If the client connects an existing WhatsApp Business app number and chooses to share it: their WhatsApp contacts and up to six months of past one-to-one chat history, plus messages they later send from the WhatsApp Business app.

From SMS

• Recipient phone numbers, contact lists the client uploads, message content, and delivery reports from mobile network operators and SMS gateways.

3. How we use data

• To provide the Service: sending, receiving, storing and displaying messages for the client.
• To manage message templates, contacts and conversations on the client's behalf.
• To provide AI-assisted replies and support features, only where the client turns them on.
• To bill clients, prevent fraud and spam, and keep the Service secure.
• To provide customer support and to diagnose and fix errors.
• To comply with legal obligations and enforce our terms.

We do not sell personal data, and we do not use WhatsApp message content for advertising or to build profiles of end users. Data received from Meta is used only to provide the Service to the client it belongs to.

4. Legal basis

We process personal data to perform our contract with clients, to comply with legal obligations, for our legitimate interests in running a secure and reliable service, and, where required, with consent. Clients are responsible for having a lawful basis, including any required opt-in, to message their end users.

5. Who we share data with

• Meta Platforms (WhatsApp): WhatsApp messages are sent and received through the WhatsApp Business Platform (Cloud API), and Meta processes them under its own terms and privacy policy.
• SMS gateways and mobile network operators: to deliver SMS messages.
• Hosting and infrastructure providers: to run our servers and databases.
• AI service providers (such as OpenAI and Anthropic): only when a client enables AI features, and only the content needed to generate a response.
• Payment providers (such as M-Pesa): to process payments.
• Email and error-monitoring providers: to send account emails and detect technical faults.
• Authorities: where the law requires it.

Our providers may process data outside Kenya. Where they do, we rely on the safeguards required by the Data Protection Act, 2019, such as contractual protections.

6. How long we keep data

• Messages, contacts and WhatsApp data are kept while the client's account is active, or until the client deletes them.
• When a client disconnects their WhatsApp number or closes their account, we delete the related WhatsApp data within 30 days, unless the law requires us to keep it longer.
• Billing records are kept for as long as Kenyan tax and accounting laws require.

7. Security

We use encryption in transit (HTTPS/TLS), access controls, authentication, and monitoring to protect data. Access tokens issued by Meta are stored securely and used only to operate the client's connected account. No system is completely secure, and we will notify affected clients and the Office of the Data Protection Commissioner of a data breach as the law requires.

8. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your data is used;
• access your personal data;
• correct inaccurate data;
• have your data deleted;
• object to processing; and
• data portability.

End users whose messages are handled by a business on RoyceTalk should usually contact that business first, since it controls their data. We will help the business respond.

9. How to request data deletion

Clients can delete contacts and conversations in RoyceTalk, or ask us to delete their account and all related data. Anyone can request deletion by emailinginfo@roycetechnologies.co.kewith the subject "Data deletion request" and the phone number or account involved. We will confirm the request and complete it within 30 days.

A business can also disconnect its WhatsApp number from RoyceTalk at any time from the WhatsApp Business app (Settings > Account > Business Platform) or from WhatsApp Manager.

10. Children

RoyceTalk is a business service and is not directed at children. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date and, for significant changes, notify clients by email or in the Service.

12. Contact us

Royce Technologies LTD
Vision Plaza, Mombasa Road, Nairobi, Kenya
Email: info@roycetechnologies.co.ke
Phone: +254 722 549 778

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya, atwww.odpc.go.ke.