Privacy Policy

1. Introduction & Legal Framework

At Arc Solutions ("Arc", "we", "us", or "our"), protecting the privacy, confidentiality, and integrity of your salon, barbershop, or spa business records is our highest operational priority.

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed. We operate in strict compliance with the Kenya Data Protection Act, 2019 (Act No. 24 of 2019) and the Data Protection (General) Regulations, 2021, under the regulatory oversight of the Office of the Data Protection Commissioner (ODPC) of Kenya.

2. Data Controller vs. Data Processor Status

Under Section 2 of the Kenya Data Protection Act 2019, operational roles are defined as follows:

• You (The Merchant / Salon Owner) are the Data Controller: You determine the purpose and means of processing personal data regarding your clients, walk-in customers, and employees. You decide which customer details to input, what notes to keep, and when to dispatch appointment confirmations or promotional broadcasts.
• Arc Solutions is the Data Processor: We process personal data solely on your documented behalf and instructions, providing the cloud database, Point of Sale (POS) tools, commission engines, and notification pipelines required to operate your subscription.

3. Information We Collect

3.1 Information You Provide Directly

When you register for Arc, configure your branches, or contact support, we collect:

• Merchant Account Details: Full name, national ID or passport number (where required for business verification), email address, phone number, business trade name, and physical branch address in Kenya.
• Staff & Stylist Profiles: Staff names, telephone numbers, designated salon roles (stylist, barber, cashier, branch manager), and commission rate structures.
• Billing & Subscription Information: M-Pesa billing telephone numbers, transaction receipt codes, chosen billing tier, and statutory tax details (e.g. KRA PIN where required for fiscal invoices). Note: Arc does not store credit card CVV numbers or private M-Pesa PINs.
• Support Correspondence: Records of inquiries, feature feedback, and messages submitted to our help desk.

3.2 Customer & Transaction Data Processed on Your Behalf

As you run your daily counter operations, your workspace processes:

• Customer Directory: Client names, mobile telephone numbers, appointment schedules, service visit history, preferred stylists, and optional hair/skin treatment notes.
• Counter POS & Ticket Logs: Itemized services rendered, retail product sales, cashier IDs, applied discounts, split payment tender logs (Cash, M-Pesa, Card), and cash drawer float adjustments.
• M-Pesa Checkout Reference Data: M-Pesa transaction confirmation codes, transaction amounts, timestamps, and customer phone numbers as provided by the customer or Safaricom M-Pesa confirmation SMS.

3.3 Information Collected Automatically

When accessing Arc via web browsers or mobile PWAs, our systems automatically log:

• Device & Connection Data: IP address, device hardware model, operating system, browser type, and language settings.
• Audit & Security Logs: Sign-in timestamps, failed password attempts, PIN verification logs, and role permission changes.

4. Legal Grounds for Processing (Section 30, Kenya DPA 2019)

We process personal data only where there is a lawful basis under Section 30 of the Act:

• Performance of a Contract: Processing is necessary to deliver the SaaS software services, process your subscription, and provide customer support.
• Legitimate Interests: To maintain platform security, detect fraud or suspicious payment activity, and optimize application performance.
• Legal Compliance: To comply with statutory requirements under the Laws of Kenya, including tax obligations with the Kenya Revenue Authority (KRA) and anti-money laundering inquiries under POCAMLA.
• Consent: Where required for optional marketing broadcasts, notifications, or specific third-party integrations.

5. How We Use Your Information

We use the data we collect and process strictly for legitimate business purposes:

• Provisioning, maintaining, and improving the Arc salon management platform and POS features;
• Calculating staff commissions, tip allocations, and generating itemized stylist payout vouchers;
• Generating daily X-Reports, Z-Reports, and sending automated end-of-day summary reports to the shop owner’s verified WhatsApp or email;
• Transmitting booking confirmations, reminders, and digital payment receipts to your salon clients;
• Administering subscription payments, generating VAT-ready tax invoices, and preventing unauthorized access;
• Investigating and preventing security incidents, abusive messaging, or fraudulent activity.

6. Third-Party Sharing & Sub-Processors

Arc does not sell personal data to third parties. We only share information with trusted third-party service providers who assist us in operating our platform, under strict data protection agreements:

• Telecommunications & Payment Networks: Safaricom (M-Pesa STK push and payment confirmation APIs) and authorized payment gateways to process subscriptions and checkouts.
• Messaging & Notification Gateways: WhatsApp Business API providers, Baileys communication connectors, and SMS aggregators for delivering automated receipts and appointment alerts.
• Transactional Email Services: Encrypted email relay providers (e.g. Brevo, Postmark) for billing receipts and password reset dispatches.
• Cloud Hosting & Infrastructure: Tier-1 data center providers with 24/7 physical security, isolated networks, and encrypted off-site backups.
• Law Enforcement & Regulatory Bodies: We may disclose data if required by law, valid court subpoena, or lawful order from Kenyan regulatory agencies (including the ODPC, Central Bank of Kenya, or National Police Service).

7. Technical & Organizational Security Safeguards

We implement comprehensive technical and organizational measures to safeguard data against unauthorized access, destruction, loss, or alteration:

• Multi-Tenant Logical Isolation: Every database query and transaction is scoped strictly to your unique tenant_id. No salon or merchant can query or access another salon’s data.
• Encryption in Transit & at Rest: All web and API traffic is encrypted using 256-bit SSL/TLS HTTPS protocols. Sensitive credentials, tokens, and database backups are encrypted at rest.
• Cryptographic Password Hashing: Passwords are never stored in plaintext; they are hashed using secure, one-way BCRYPT algorithms. Arc personnel cannot view your passwords.
• Role-Based Access Control (RBAC): Salon owners configure fine-grained permissions to restrict sensitive financial metrics or client phone directories from unauthorized staff members.
• Two-Factor Authentication (OTP): One-time password verification via SMS/WhatsApp is enforced on critical owner login and recovery flows.

8. International Data Transfers

Where personal data is transferred or hosted outside the Republic of Kenya (for example, on certified cloud servers in Frankfurt or Dublin), we ensure that the transfer complies with Section 48 and 49 of the Kenya Data Protection Act 2019. We verify that the receiving jurisdiction provides appropriate safeguards or that the transfer is governed by Standard Contractual Clauses (SCCs) ensuring an adequate level of data protection.

9. Data Retention & Erasure Policy

• Active Subscriptions: Your business records and client history are preserved for the entire lifetime of your active account to maintain multi-year reporting and trend analysis.
• 90-Day Safe Retention on Lapsed Accounts: If your subscription lapses, we retain your records in a secure, inactive state for at least 90 calendar days. This ensures that salon owners who take seasonal breaks do not lose their client databases or historical commission ledgers.
• Permanent Erasure: Upon verified request for account termination, or following the expiration of the retention window, your data is permanently deleted or anonymized from our production systems and offsite backups within thirty (30) days.

10. Your Rights Under the Kenya Data Protection Act (2019)

Under Section 26 of the Act, data subjects (both you as a merchant, and your individual clients) hold the following statutory rights:

• Right to be Informed: To be informed of the use to which your personal data is put.
• Right of Access: To access and receive a copy of personal data in our custody.
• Right to Rectification: To request correction of false, inaccurate, or outdated personal data.
• Right to Erasure ("Right to be Forgotten"): To request deletion of personal data that is no longer necessary or unlawfully processed.
• Right to Data Portability: To receive your customer list, catalog, and sales records in a structured, commonly used, and machine-readable format (CSV/Excel).
• Right to Object: To object to the processing of personal data for direct marketing purposes.

11. Children’s Privacy

Arc Services are strictly designed for commercial use by adult business owners and authorized salon operators aged 18 and older. We do not knowingly solicit or collect personal information from individuals under 18 years of age. If you record appointment details for child clients (e.g. children's haircuts), you warrant as the Data Controller that you have obtained the consent of the child’s parent or legal guardian.

12. Cookies & Tracking Technologies

Arc uses strictly necessary cookies and local storage to maintain authenticated user sessions, prevent Cross-Site Request Forgery (CSRF) attacks, and remember basic user interface preferences (such as selected active branch or dark mode). We do not utilize third-party cross-site advertising tracking cookies.

13. Modifications to this Privacy Policy

We may revise this Privacy Policy periodically to reflect technological advancements, operational changes, or statutory updates issued by the ODPC. Any material modifications will be communicated via in-app notification, email, or a prominent notice on our website prior to taking effect.

14. Contacting Our Data Protection Desk & ODPC Notice

If you have questions regarding this Privacy Policy, wish to exercise your data subject rights, or seek clarification on our data processing practices, please contact our designated Data Protection team:

Right to Lodge a Complaint: If you believe that your personal data has been processed in violation of the Kenya Data Protection Act 2019, you have the statutory right to lodge a formal complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.