Kyfaru — Designing Solutions Powering Africa's Future

Your Responsibilities as System Owner

Once a system is handed over, the Client becomes the System Owner and assumes full responsibility for:

How the system is operated and the purposes for which it is used.
All personal data collected from the Client's customers through the system.
Compliance with all applicable Kenyan and international laws in connection with the system's operation.
Keeping system software, plugins, and dependencies updated — especially security-related updates.
All content published on or through the system.

ℹ️

Kyfaru's liability for the system ends at handover unless the Client has engaged an ongoing Managed Services or Monthly Maintenance Retainer arrangement.

Permitted Use

Clients are permitted to:

✓Use the system for its intended, documented business purpose.

✓Add content, products, users, and data as the system was designed to accommodate.

✓Engage Kyfaru for additional development, features, or maintenance.

✓Transfer ownership of the system to another legal entity, provided written notice is given to Kyfaru and the transfer complies with all applicable laws.

✓Engage other developers after credential handover, subject to the restrictions in the Modifications section below.

Prohibited Use

Clients must NOT use systems built by Kyfaru to:

✕Engage in any activity that is unlawful under the laws of Kenya or any other applicable jurisdiction.

✕Store, transmit, or facilitate the distribution of malicious code, spyware, ransomware, or any harmful software.

✕Infringe the intellectual property rights of any third party.

✕Collect personal data from individuals without a compliant privacy policy and proper consent mechanism.

✕Process personal data in violation of the Kenya Data Protection Act 2019 or applicable data protection laws.

✕Process financial payments outside licensed and regulated payment channels.

✕Operate a business or service without holding all required licences, permits, and regulatory approvals.

✕Engage in fraud, deception, phishing, or any activity intended to mislead users or third parties.

Modifications

The Client may:

Add, edit, or remove content within the CMS or admin interface without restriction.
Engage other developers to work on the system after credential handover.

The Client must NOT:

Modify the system's core architecture, database schema, or infrastructure without first notifying Kyfaru in writing. Such modifications void any applicable warranty or support agreement.
Use code, components, or systems built by Kyfaru in other projects without obtaining a separate written licence from Kyfaru.

Data and Privacy Compliance

Where the Client's system collects, stores, or processes personal data of third parties, the Client acts as the Data Controller in respect of that data. As Data Controller, the Client must:

Publish a legally compliant Privacy Policy on their system before going live.
Implement proper consent mechanisms before collecting personal data from users.
Register as a Data Controller with the Office of the Data Protection Commissioner (ODPC) if required under the Kenya Data Protection Act 2019.
Take full responsibility for any data breaches, regulatory investigations, or penalties arising from the Client's management or mismanagement of the system.

🏛️

For guidance on data protection obligations, visit the Office of the Data Protection Commissioner.

Consequences of Misuse

Where Kyfaru has reasonable grounds to believe that a system it built is being used in violation of this Acceptable Use Policy, Kyfaru reserves the right to:

Withdraw all support and maintenance services for the system immediately and without refund of any prepaid fees.
Publicly disassociate from the system, including removing the system from Kyfaru's portfolio and public references.
Pursue appropriate legal remedies for any reputational, financial, or legal harm caused to Kyfaru as a result of the Client's misuse.