Privacy Policy

This policy explains how Kicatex Technology collects, uses, stores, and protects information through the PTMS platform.

Effective Date August 2026 Company Kicatex Technology Product Project & Technician Management System (PTMS) Contact info@kicatextechnology.com Jurisdiction Republic of Kenya

Who We Are
Information We Collect
How We Use Your Information
QuickBooks Online Integration
Data Sharing and Third Parties
Data Retention
Security
Your Rights
Cookies and Session Data
Children's Privacy
Changes to This Policy
Contact Us

1. Who We Are

Kicatex Technology operates the Project & Technician Management System (PTMS) ("PTMS"), a web-based platform used to manage projects, expert task assignments, client approvals, payment disbursements, appointment bookings, and financial reporting for organisations and their associated staff.

For the purposes of this policy, Kicatex Technology is the data controller responsible for the information processed through PTMS.

2. Information We Collect

2.1 Information You Provide Directly

Category	Examples	Who Provides It
Account Information	Full name, email address, phone number, role, profile photo	Administrator on account creation
Authentication Data	Hashed passwords, two-factor authentication codes, OTP tokens	User during login setup
Project Data	Project titles, descriptions, milestone details, task assignments, completion statuses	Admins, supervisors, project managers
Quotation Data	Line items, rates, quantities, subtotals, platform fees, WHT amounts	Experts (technicians)
Payment Data	Payment amounts, reference numbers, payment methods, uploaded invoices and statements, proof of payment documents	Experts, COO, Finance staff, Admins
Meeting Data	Meeting titles, agendas, dates, times, attendee lists, acceptance/decline responses and reasons, cancellation reasons	Meeting organisers and attendees
Uploaded Documents	Invoices, statements of accounts, proof of payment files, quotation documents, reference materials	Various roles per workflow step
Communication Preferences	Email and SMS notification opt-in settings	Users in their profile settings

2.2 Information Generated Automatically

Session data — login timestamps, session tokens, IP address, and browser information used to maintain secure authenticated sessions.
Activity logs — records of significant actions within PTMS (e.g. approvals, rejections, payments marked as paid) stored for audit purposes.
OTP tokens — time-limited one-time passwords for two-factor authentication and password reset, stored temporarily and deleted after use or expiry.
Notification logs — records of emails and SMS messages sent through the platform, including delivery status.

2.3 Information from Third-Party Integrations

QuickBooks Online — OAuth access and refresh tokens when the QBO integration is enabled. See Section 4 for full details.
Email provider (SMTP) — delivery receipts for transactional emails sent through the platform.
SMS provider (Africa's Talking) — delivery status for SMS notifications sent through the platform.

3. How We Use Your Information

Purpose	Information Used	Lawful Basis
Providing the PTMS platform and its features	All account and project data	Contract performance
Authenticating users securely	Password hashes, OTP tokens, session data	Contract performance / Legitimate interest
Processing expert payments and disbursements	Payment data, quotation data, uploaded documents	Contract performance
Scheduling and managing meetings	Meeting data, attendee information, availability	Contract performance
Sending transactional notifications	Name, email, phone, event details	Contract performance / Consent
Financial reporting and audit trail	Payment history, fee data, activity logs	Legal obligation / Legitimate interest
Synchronising financial data with QuickBooks Online	Payment amounts, payee details	Consent (admin-enabled integration)
Platform security and fraud prevention	Session data, login activity, IP address	Legitimate interest
Improving the platform	Aggregated, anonymised usage data	Legitimate interest

4. QuickBooks Online Integration

    This section is specifically required by Intuit Inc. as part of the QuickBooks Online application registration process.
  

4.1 What We Access

When a system administrator enables the QuickBooks Online integration, PTMS connects to the organisation's QBO company account via OAuth 2.0 and may read or write the following data:

Write: Vendor records (for experts/payees not already in QBO)
Write: Customer records (for project clients not already in QBO)
Write: Bills and BillPayments (when payment disbursements are recorded in PTMS)
Write: Invoices (for meeting fees and project billing)
Read: Authentication tokens to maintain the OAuth connection

4.2 What We Do NOT Access

Bank account or credit card details
Payroll data or employee records
Existing QBO records not created by PTMS
Tax filing information
Any QBO data outside the scope listed in 4.1

4.3 How QBO Data Is Stored

OAuth access and refresh tokens are stored in the PTMS database on your organisation's own hosting infrastructure. Kicatex Technology does not store QBO data on external or shared servers. All API calls are made directly from your PTMS installation to Intuit's servers over HTTPS.

4.4 Revoking Access

You may disconnect PTMS from QuickBooks Online at any time by using the Disconnect option in PTMS Finance Settings, or by revoking access through your Intuit account settings. Upon disconnection, all stored QBO tokens are deleted from the PTMS database.

4.5 Intuit's Privacy Policy

Your use of QuickBooks Online is also governed by Intuit's Global Privacy Statement. We encourage you to review it.

PTMS uses QBO data solely to synchronise financial records. We do not sell, share, or use QBO data for advertising, analytics beyond your own organisation's reporting, or any purpose not described in this policy.

5. Data Sharing and Third Parties

We do not sell your personal information. We share data only in the following limited circumstances:

Recipient	Purpose	Data Shared
Intuit Inc. (QuickBooks Online)	Financial data synchronisation (if enabled)	Payee names, payment amounts, invoice details
SMTP Email Provider	Delivering transactional emails	Recipient email address, message content
Africa's Talking (SMS)	Delivering SMS notifications (if enabled)	Recipient phone number, message content
Hosting Provider	Infrastructure and data storage	All platform data (stored on your server)
Law enforcement / Regulators	Legal obligation or valid legal process	As required by applicable law

All third-party service providers are engaged under contractual obligations to handle data securely and only for the specified purpose.

6. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy or as required by law:

Active account data — retained for the duration of the account and for a reasonable period after deactivation.
Payment and financial records — retained for a minimum of 7 years in accordance with Kenyan tax and financial regulations.
Activity and audit logs — retained for a minimum of 3 years.
OTP tokens — deleted immediately upon use or after 10-minute expiry, whichever comes first.
Session data — cleared on logout or after session inactivity timeout.
QBO OAuth tokens — deleted immediately upon disconnection of the QuickBooks integration.
Uploaded documents — retained for the duration of the associated project and for a reasonable archival period thereafter.

7. Security

Kicatex Technology implements appropriate technical and organisational measures to protect personal information against unauthorised access, loss, or destruction:

Encryption in transit — all data transmitted between users and PTMS is encrypted using TLS (HTTPS).
Password security — passwords are hashed using bcrypt and are never stored in plain text. PTMS staff cannot retrieve your password.
Two-factor authentication (2FA) — mandatory for all user accounts, with support for email OTP, SMS OTP, and TOTP authenticator apps.
Role-based access control — users can only access data and functionality appropriate to their assigned role and module permissions.
Audit logging — all significant actions are logged with user identity, timestamp, and description.
Account lockout — accounts are temporarily locked after repeated failed login attempts to prevent brute-force attacks.
File upload restrictions — uploaded files are type-validated and stored outside the web root where appropriate.

No system is completely immune to security risks. In the event of a data breach that affects your personal information, we will notify affected users and relevant authorities as required by applicable law.

8. Your Rights

Subject to applicable Kenyan law and the Data Protection Act 2019, you have the following rights regarding your personal information:

Right of access — you may request a copy of the personal information we hold about you.
Right to rectification — you may request correction of inaccurate or incomplete information. Profile details can often be updated directly in your PTMS profile settings.
Right to erasure — in certain circumstances, you may request deletion of your personal information. Note that some records (e.g. financial audit trails) may be retained as required by law.
Right to restrict processing — you may request that we limit how we use your data in certain situations.
Right to data portability — you may request your data in a machine-readable format where technically feasible.
Right to withdraw consent — where processing is based on consent (e.g. SMS notifications), you may withdraw consent at any time via your notification settings.
Right to object — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at info@kicatextechnology.com. We will respond within 30 days.

9. Cookies and Session Data

PTMS uses the following cookies and browser storage:

Session cookie (PHPSESSID) — essential for maintaining your authenticated session. This cookie is deleted when you log out or close your browser. It does not track activity across other websites.
CSRF token cookie — a security token included in forms to prevent cross-site request forgery attacks. Essential for platform security.

PTMS does not use advertising cookies, analytics cookies, or any tracking technology that follows users across websites. No third-party cookies are placed by PTMS itself (third-party integrations such as Google Calendar links open in a new tab and are subject to Google's own cookie policy).

10. Children's Privacy

PTMS is a professional business platform and is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child's information has been collected through our platform, please contact us immediately.

11. Changes to This Policy

Kicatex Technology may update this Privacy Policy from time to time. Changes will be published at this URL with an updated effective date. For material changes, we will notify platform administrators via email. Continued use of PTMS after changes are published constitutes acceptance of the updated policy.

12. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact:

Kicatex Technology
Email: info@kicatextechnology.com
Platform: https://kicatextechnology.com
EULA: https://kicatextechnology.com/eula.php

Last updated: August 2026 · Kicatex Technology · Project & Technician Management System (PTMS)