Data Policy

1. What this policy covers

This policy covers customer data: everything your business puts into Nakkei or syncs from QuickBooks Desktop. That includes sales, purchases, stock, assets, projects, customers and suppliers, staff, attendance and payroll records, requests and approvals, attachments and signatures.

How we handle personal data for our own purposes, such as your account and billing, is covered by our Privacy Policy.

2. Your data stays yours

Your business owns its customer data. For any personal data in it, your business is the data controller and Finetek Technologies K Ltd is the data processor. We process customer data only to provide, secure and support Nakkei for you, following your instructions and the Data Protection Act, 2019.

• We do not sell customer data or use it for advertising.
• We do not look at customer data except to provide support you ask for, keep the service secure, or meet a legal requirement.
• Our staff and contractors who can access customer data are bound by confidentiality.

3. QuickBooks Desktop

• Your QuickBooks Desktop company file stays on your own PC or server. Nakkei does not move it to the cloud.
• Only records your business approves are sent to QuickBooks, and changes your accountant makes there are brought back into Nakkei.
• Every exchange with QuickBooks is logged, so you can see what was sent, when and by whom.
• Sending to QuickBooks is off until you switch it on, and you can switch it off at any time.

4. AI features

Nakkei's AI features work on your customer data only to produce results inside your own account, such as answers, summaries and suggestions.

• We use open-weight models, such as Gemma and DeepSeek, hosted privately on our own infrastructure. They do not communicate with outside services, so your data is not sent to a third-party AI provider.
• Inference runs locally on that infrastructure, so Nakkei does not depend on an outside AI service to work.
• Your data is stored in our own PostgreSQL databases, including a vector database used for AI search.
• Embeddings, the numeric representations of text that power AI and search inside the app, are generated by our own services and stored in our own vector database.

5. Staff and sensitive data

HR, attendance and payroll records can include sensitive personal data under the Act, such as biometric data from clock-in devices and health information linked to leave. As the controller, your business is responsible for having a lawful basis for this data and for telling your staff how it is used.

We limit access to this data within Nakkei through roles and permissions that your administrators control.

6. Where your data is hosted

Self-hosted: if your business runs Nakkei on its own servers, customer data stays on infrastructure you control, and you are responsible for securing, backing up and locating those servers. We access a self-hosted installation only when you ask us to, for setup or support.

Nakkei cloud: otherwise Nakkei is hosted with our hosting partner, Amazon Web Services, and customer data may be stored outside Kenya. Backup copies are also kept with Google and DigitalOcean, so the service can fall back to them if our main hosting is unavailable. We transfer data only as Part VI of the Data Protection Act allows, with appropriate safeguards, and can give you details of the safeguards on request. Our data centres are in Frankfurt (Germany), Ireland, Cape Town (South Africa) and Bangalore (India).

7. Security

• End-to-end encryption for data moving between your browser, Nakkei and QuickBooks.
• Multi-factor authentication (MFA) at sign-in, and integration with biometric devices.
• Separate accounts for each business, with access controlled by roles and permissions.
• Multi-level approvals before records are posted, and activity logs for changes and syncs.
• Regular backups: images of our servers are taken daily or weekly, a backup is kept for every month, and copies are kept with a second and third provider (Google and DigitalOcean) as fallbacks.
• Access to production systems limited to the people who need it.

8. Service providers (subprocessors)

We use these providers to run Nakkei. Each is bound by a contract that protects customer data.

[To confirm: any other providers that handle customer data, such as email delivery]

We will keep this list up to date and tell customers about new providers.

9. If something goes wrong

If we become aware of a breach affecting customer data, we will tell the affected customers without delay, and where reasonably practicable within 48 hours, as the Data Protection Act requires of processors. We will share what we know, what we are doing about it, and the information you need to notify the ODPC and anyone affected.

10. Export, retention and deletion

• While your subscription is active you control your data and can export it. Your financial records also stay in your own QuickBooks company file.
• When a subscription ends, we keep customer data for a maximum of 60 days so you can export it, after which it is deleted.
• Deleted data drops out of our backups as older backups are replaced.
• We keep data longer only where the law requires it, and tell you if that applies.

11. Your responsibilities

• Have a lawful basis for the personal data you put into Nakkei, and tell the people concerned how it is used.
• Give users only the access they need, and remove access when someone leaves.
• Keep the PC or server that runs QuickBooks Desktop secure and backed up.
• Pass on to us any data protection requests that need our help.

12. Contact us

Questions about this policy, requests about customer data, or security concerns: email digital@nakkei.com or reach us below.

• Email: digital@nakkei.com
• Phone: +254 706 059 906
• Post: Chandaria Innovation Centre, Kenyatta University, Nairobi, Kenya