Last updated 20 October 2026
This policy explains how Stellium handles personal data, in line with the Data Protection Act, 2019 of Kenya. It covers visitors to our website, the people who use Stellium, and the people whose details our customers record in it.
Our role
For the records an organisation keeps in Stellium, such as member, donor, employee and supplier details, that organisation is the data controller and Stellium acts as its data processor. We process that data only to provide the service, on the organisation's instructions. For account holders and website visitors, Stellium is the data controller.
What we collect
- Account details: names, email addresses, phone numbers and the organisation you belong to.
- Records you enter: financial transactions, giving, payroll and HR information.
- Payment details needed to process M-Pesa transactions, such as phone numbers and transaction references.
- Demo requests: the details you submit through our contact form.
- Technical data: IP addresses, browser information and security logs used to keep the service secure.
How we use it
- To provide, secure and support the service.
- To send service messages such as sign-in codes, approval notifications and invoices.
- To respond to demo requests and enquiries.
- To meet legal and accounting obligations.
We do not sell personal data, and we do not use your organisation's records for advertising.
How we protect it
Each organisation's data is isolated from every other organisation's. Access is protected by role-based permissions and two-factor authentication, every change is recorded in an audit trail that cannot be edited, and data is backed up regularly.
Sharing
We share data only with service providers who help us run Stellium, such as hosting, email delivery and payment providers like Safaricom, and only as far as they need it to provide their service. We may also disclose data where the law requires it.
Retention
We keep account data while your organisation's subscription is active, and financial records for as long as needed to meet legal and accounting requirements. When an organisation closes its account, we delete or anonymise its data within a reasonable period, unless the law requires us to keep it.
Your rights
You have the right to be informed about, to access, to correct and, where applicable, to delete your personal data, and to object to its processing. If your data was entered by an organisation that uses Stellium, please contact that organisation first. You may also lodge a complaint with the Office of the Data Protection Commissioner.
Contact
To exercise your rights or ask about this policy, reach us through our contact page.