Enzz Privacy Policy

Version: 2.0, replacing version 1.0 of 2 October 2026

Effective date: 14 October 2026

This is the privacy policy for everything Enzz offers. It explains what we collect, why, who we share it with, and your rights. Each product also has its own policy with the full detail for that product; where the two differ, the product's policy applies to that product.

Enzz is operated by Enzz Technologies Limited ("Enzz", "we", "us"), a subsidiary of RONEP Engineering Solutions Limited, Nakuru, Kenya.

• Website: https://enzz.co.ke
• Email: support@enzz.co.ke, enzz@enzz.co.ke
• Phone: +254 702 737 117

1. What this policy covers

Products marked "In development" are not yet open to the public. Their policies describe how they are designed and will be confirmed before launch.

2. What we promise across every product

1. We do not sell personal information.
2. No advertising trackers. Our apps contain no advertising SDKs and no third-party analytics SDKs, and we do not collect advertising IDs.
3. We collect what the product needs and no more. We do not ask for a National ID, and we do not use fingerprints, face scans or other biometrics to identify you. Where an app offers a fingerprint or face lock, the check is done by your phone and we never receive it.
4. Location only when you use it. We read your location only while you are using a feature that needs it. We never track location in the background.
5. Permissions when needed. An app asks for the camera, microphone, location or notifications only when you use the feature that needs it, and works without it if you refuse.
6. Your content is not used to train AI models.
7. A person, not an AI model, makes the decisions that matter. AI in our products drafts, summarises and suggests. It does not decide on its own whether you are hired, what a learner's level is, or what is sent or paid in your name.
8. The people our products are for are not charged to be found. Jobseekers never pay on AOIS. Shoppers never pay to use Pata.

3. What each product collects, in brief

The full lists are in each product's policy.

Enzz Business / Biashara

• About you: username, email, password, phone, role; business name, type, county, sub-county, ward, KRA PIN.
• Your business: products, prices, stock, sales, receipts, expenses, credit, promotions, purchase orders, reports.
• Your public shop page: logo, banner, description, services, photos, videos, updates, opening hours, delivery prices, contact handles, map pin, and public social media posts you choose to show.
• People you record: employees (including job title, employment type, gender, salary), customers who buy on credit, suppliers.
• Orders from Pata shoppers: their contact, the order, and delivery address and note.
• Assistant: what you type or say to it and the business data needed to answer; the Telegram or WhatsApp account you link.
• Payments: plan purchases through Google Play in the Android app, or by M-Pesa on the web (the phone number, amount and receipt number). We never see your card details or M-Pesa PIN.
• Permissions: camera, microphone, location (to pin your shop), notifications, biometrics (on-device only).

Enzz Pata

• About you: your email address or phone number, verified by a code sent to your email, or on WhatsApp for a phone number; or your Google account email.
• Where you shop: the county, sub-county and ward you choose, and your location while you look for nearby shops or a delivery fee.
• Orders: the shop, items, total, pickup or delivery, and delivery address and note.
• Reviews: ratings and comments, shown without your name or contact.
• Assistant: the questions you type.
• Permissions: location, notifications. No camera, microphone or contacts.
• Payments: none. You pay the shop directly.

Enzz Taalo

• Teachers and parents: name; a teacher's email, school, grades and learning areas.
• Learners (children): name, gender, grade, learning areas, an access PIN; photos, audio and video of their schoolwork; marks, observations, remarks; competency status and history; generated summaries and suggestions.
• Not collected: date of birth, home address, identity numbers, health information.
• Permissions: camera, microphone, media files, notifications.

AOIS

• Jobseekers: name, phone number, county and area, skills, interests, phone type and preferred channel, matches, ratings, certificates, teams.
• Employers: name, phone number, type, county, listings, phone confirmation, verification.
• Public listings: vacancy and course notices from public sources, with where each came from.
• Not collected: National ID, biometrics, location tracking.

Enzz Agent

• Account: email, password, account name.
• Your work: projects, to-dos, instructions, uploaded files, and what agents produce.
• Optional: a connected mailbox (credentials encrypted; only email from senders you list), your own AI keys (encrypted).
• Records: usage, balance, payments (M-Pesa phone number, amount, receipt), audit log.

4. The website and contact form

When you use the contact form at enzz.co.ke we collect your name, email address, any phone number you give, and your message, and use them only to reply to you and keep a record of the conversation. Our servers and hosting provider receive your IP address and basic request data when you visit.

The website does not use advertising or analytics cookies. Videos from YouTube load only when you press play, and then come from YouTube's privacy-enhanced service.

5. How your information moves between products

Our products are connected, and this is the only information that moves between them:

We do not otherwise combine your information across products. Having an account in one product does not create one in another.

6. Why we are allowed to use your information

Under the Kenya Data Protection Act, 2019 we rely on:

• Contract: to provide the product you signed up for.
• Consent: for device permissions, notifications, linking a chat account, sharing a learner's competencies with AOIS, and adding a child to Taalo (given by a parent or guardian through the school). You can withdraw consent at any time.
• Legitimate interests: keeping the services secure, preventing misuse, and improving them, where this does not override your rights.
• Legal obligation: keeping financial and tax records, and answering lawful requests.

7. Who we share information with

We share information only as needed to run the products.

Other users, as part of the product

• A shop you order from sees your order and contact. Shops are independent businesses.
• A shop's public page is visible to everyone using Pata.
• An employer you are matched to on AOIS sees your profile so they can offer work.
• A learner's teachers, and their parent or guardian, see that learner's record. Nobody else does.
• Within a business, owners see employees' activity and employees see what their role allows.

Service providers

Social media players. A shop page on Pata can show the shop's own public posts from Facebook, Instagram, TikTok or YouTube. A post loads only when you tap it; that platform then receives your IP address and device details under its own privacy policy.

Other cases. We share information when the law requires it, to protect the rights and safety of our users or ourselves, or in a business transfer such as a merger or sale, in which case this policy continues to apply.

8. Artificial intelligence

Several products use AI models run by other companies.

• We send a model only what the feature needs: your question and the data needed to answer it, a photo of a receipt or test paper, the curriculum topic for a set of questions, or the files for a task you gave an agent.
• We do not send your information to train models.
• AI output can be wrong. It is shown to you as a draft, a summary or a suggestion, and in Biashara and Enzz Agent an action is carried out only after you confirm it.
• In Taalo, a learner's competency status is worked out by fixed rules from the evidence a teacher recorded, not by a model.
• In AOIS, matching is done by fixed rules today. If AI is added, the AOIS policy will be updated first.

9. Children

• Taalo holds information about learners, most of whom are under 18. They are added only by their teacher or school with a parent's or guardian's agreement, their information is used only for their education, and they are never shown advertising or profiled for marketing. See the Taalo policy.
• Every other product is for adults. Biashara, Pata, AOIS and Enzz Agent are not directed at anyone under 18 and we do not knowingly collect children's information there. If you believe a child has given us information, contact us and we will delete it.

10. Security

Information is encrypted when it travels between your device and our servers. Passwords, sign-in codes and staff keys are stored only in scrambled form, and secrets such as mailbox passwords and AI keys are encrypted. Access by our own staff to personal details is limited to named people with a reason, and is logged. No system is completely secure; please use strong passwords and keep your phone locked.

If a breach of your personal data is likely to put you at real risk, we will tell you and the Office of the Data Protection Commissioner as the law requires.

11. How long we keep information

We keep your information while your account is open or your school or business uses the product. When you delete your account we delete it from our active systems, apart from records we must keep by law, such as tax and financial records; backups are overwritten on a rolling schedule. The exact rules for each product, including what happens to orders, reviews and ratings that involve other people, are in that product's policy.

12. Your rights and how to use them

Under the Kenya Data Protection Act, 2019 you have the right to be informed how your data is used, to access it, to have it corrected, to object to or restrict its use, to have it erased, and to receive it in a portable format.

For any right, in any product, contact support@enzz.co.ke from the email address or phone number on your account. We respond within 30 days. For a child, a parent or guardian makes the request.

You may also complain to the Office of the Data Protection Commissioner of Kenya: https://www.odpc.go.ke.

13. International transfers

Some of our service providers store or process data outside Kenya. Where this happens we rely on safeguards permitted under the Kenya Data Protection Act, 2019. Before a product opens in another country we will publish the terms that apply there.

14. Changes to this policy

We may update this policy. We will change the version and date above and, for significant changes, tell you in the product or by email. Earlier versions are available on request.

15. Contact us

Enzz Technologies Limited, Nakuru, Kenya Email: support@enzz.co.ke, enzz@enzz.co.ke Phone: +254 702 737 117 Website: https://enzz.co.ke