LiveSoko
Engine.

SECTION 7: LEGAL CLASSIFICATION OF DATA ROLES

• 7.1 Merchant as Data Controller: Under the Act, the Merchant is the sole **Data Controller** of all Customer and buyer personal data (including name, telephone number, TikTok handle, and physical delivery address) gathered through the hosted storefront (/shop/:slug) or manual input channels.
• 7.2 Company as Data Processor: SoftLogic Tech operates strictly as a **Data Processor**, providing the technological infrastructure and localized tools to facilitate the Merchant's operations. The Merchant is responsible for obtaining all necessary prior, explicit, and informed consents from Customers prior to compiling profiles, recording locations, or evaluating trust behavior.

SECTION 8: CRYPTOGRAPHIC TELEMETRY SYNC AND MODEL TRAINING

• 8.1 Anonymized Aggregation License: The Merchant hereby grants SoftLogic Tech a perpetual, irrevocable, worldwide, royalty-free, fully sub-licensable license to capture, retrieve, analyze, and store anonymized transaction metadata, system operational telemetry, and interface telemetry.
• 8.2 Absolute Cryptographic PII Obliteration (HMAC-SHA256 Protocol): To ensure absolute compliance with statutory privacy regulations and the instructions of the Office of the Data Protection Commissioner (ODPC), all localized telemetry synchronization background processes employ a secure, one-way salted HMAC-SHA256 cryptographic hashing algorithm. Under this structural protocol:
  • All Personally Identifiable Information (PII)—specifically including customer phone numbers, customer names, transaction codes, and physical delivery coordinates—is irreversibly transposed into a secure, non-reconstructable mathematical numeric hash utilizing a secure server-side dynamic key ("TELEMETRY_SALT").
  • Neither SoftLogic Tech, the Merchant, nor any external third-party possesses the technical capability to decrypt, reverse-engineer, reconstitute, or associate these hashed representations with any real-world individual, ensuring permanent and absolute anonymity.
• 8.3 Predictive Analytics and Heuristic Model Training: The resulting cryptographically isolated and aggregated telemetry datasets are collected for the exclusive purpose of:
  • Calibrating predictive logistics matrices, regional transit routing engines, and delivery timeline estimation structures.
  • Optimizing network load-balancing and scaling the decentralized SaaS storefront architecture.
  • Technical training, parameter adjustment, and mathematical instruction of proprietary predictive statistical matrices, neural-algorithmic behavioral engines, machine-learning regression layers, and heuristic categorization vectors (collectively, the "Future Models") to enhance platform efficiency, auto-matching success rates, and generalized merchant analytics.

SECTION 9: STATUTORY INDEMNIFICATION CLAUSE

9.1 Merchant Indemnity for Privacy Breaches: The Merchant agrees to indemnify, defend, and hold harmless SoftLogic Tech, its officers, directors, and employees, from and against any and all administrative fines, penalties, damages, liabilities, losses, costs, and expenses (including reasonable legal fees) arising out of or relating to any regulatory audits, investigations, or claims brought by the **Office of the Data Protection Commissioner (ODPC)** or any data subject, due to the Merchant's failure to obtain proper customer consent, secure their localized infrastructure, or comply with their statutory obligations as a Data Controller.

SECTION 10: DATA RETENTION, SECURITY MEASURES, AND CROSS-BORDER TRANSFERS

• 10.1 Retention Schedule: SoftLogic Tech retains personal data for no longer than necessary to fulfill the operational requirements of the SaaS platform. Primary transactional logs and order histories are maintained for the active duration of the Merchant's subscription. Upon account termination, localized records are systematically purged or anonymized within fourteen (14) days.
• 10.2 Security Controls: In compliance with Section 41 of the Act, all database instances, customer profiles, and session registers employ advanced administrative and technical safeguards. This includes SSL/TLS protocols for all data in transit, isolated SQLite storage mechanisms, and strictly restricted access control policies.
• 10.3 Cross-Border Hosting Safekeeping: The SaaS infrastructure is hosted on secure, isolated cloud servers. By utilizing the platform, the Merchant acknowledges and agrees that anonymized datasets or operational metadata may be processed across secure international servers under strict encryption, guaranteeing compliance with Section 48 of the Act.

SECTION 11: DATA SUBJECT RIGHTS AND COMPLIANCE CONTACT

• 11.1 Exercise of Rights: Pursuant to Section 26 of the Act, all individuals whose data is processed (including Merchants and their buyers) possess the right to:
  • Access their compiled personal data.
  • Request correction, rectification, or updates of inaccurate records.
  • Object to processing or request systematic erasure of their records.
• 11.2 Privacy Liaison Contact: Any requests, regulatory notices, or compliance inquiries regarding data processing, access, or erasure under the Act must be submitted to our Legal & Privacy Division via email at legal@softlogic.co.ke.