Privacy notice · Malipay

1 Who we are

Malipay is operated by Elimn Limited, registered in Nairobi, Kenya. We are the data controller responsible for personal data processed through this website.

2 What we collect

When you submit a payment request, we collect: your name, phone and WhatsApp numbers, email (optional), country, customer type (individual or business), business name and KRA PIN (optional), the RMB amount, payment purpose, supplier/beneficiary details, and any documents you upload (typically an invoice or proforma invoice). We also collect technical data such as your IP address and browser user-agent for security and audit purposes.

3 Why we collect it

We process your personal data to (a) review and progress your payment request, (b) contact you about your request, (c) meet our legal and compliance obligations, including anti-money-laundering checks, and (d) defend or prosecute legal claims if needed.

4 Legal basis

We rely on your consent (Kenya DPA 2019 §32) when you submit a request and accept these terms, on contract performance to deliver the service you requested, and on legitimate interests and legal obligations for security, fraud prevention, and statutory record keeping.

5 Who we share it with

We share the minimum necessary information with licensed payment or remittance partners that execute the transfer on your behalf. Our hosting and infrastructure providers (Vercel, Neon, Cloudflare) may process data on our behalf under written processor agreements. We do not sell your personal data to anyone.

6 Cross-border transfers

Beneficiary details (the supplier's name and receiving account) are transferred to China to complete the payment. Hosting providers operate globally; data is stored in regions that provide adequate safeguards.

7 How long we keep it

We retain request records and documents for six (6) years from submission to meet Kenyan tax and bookkeeping requirements under the Income Tax Act and the Companies Act, then delete or anonymise them.

8 Your rights

You have the right to access your data, correct it, request deletion, restrict processing, object to processing, and withdraw consent. Contact us on WhatsApp or by email to exercise these rights. We will respond within thirty (30) days as required by the Data Protection (General) Regulations, 2021.

9 Cookies

We use essential cookies to keep the site functional. Analytics cookies are only set after you grant consent through the cookie banner.

10 Complaints

If you believe we have mishandled your data you may complain to us first and, if unsatisfied, to the Office of the Data Protection Commissioner (Kenya).

11 Contact

For privacy questions contact: Elimn Limited, Nairobi, Kenya, via the WhatsApp number shown in the footer.