DeriPesa
DeriPesa
Legal Documentation & User Privacy

Terms & Transparency

Clear, straightforward policies regarding your transactions, data privacy, and usage rights.

Terms & ConditionsPrivacy Policy

Privacy Policy

This document can be printed for reference by using the print command in the settings of any browser.

Owner & Data Controller: DeriPesa (Nairobi, Kenya)
Contact Email: support@deripesa.com

1. Introduction

DeriPesa ("we", "us", or "our") is dedicated to protecting your privacy and ensuring your personal information is handled in a secure and responsible manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our web application, or download and use our mobile applications (available on iOS and Android).

By using DeriPesa, you consent to the data practices described in this policy.

2. Information We Collect

We collect information necessary to provide automated financial gateway services between Safaricom M-Pesa and Deriv trading accounts:

A. Personal Information You Provide

  • Contact Details: Full name, email address, and mobile phone number (registered Safaricom M-Pesa line).
  • Trading Account Details: Deriv Account Number (CR ID), Deriv OAuth tokens, or account nickname.
  • Support Inquiries: Information provided when contacting support via WhatsApp, phone, email, or in-app support tickets.

B. Transaction Information

  • Payment Records: M-Pesa transaction reference codes (MPESA Receipt numbers), deposit amounts, withdrawal amounts, exchange rates applied, date and time of transaction, and completion status.
  • Note: DeriPesa never stores or has access to your private M-Pesa PIN. PIN entry is handled exclusively on your personal device through Safaricom’s secure STK push protocol.

C. Automatically Collected Technical Data

  • Device & Connection: IP address, device type, operating system version, browser type, and language settings.
  • Log Files: System activity, error reports, and timestamps for operational reliability and fraud monitoring.

3. Cookies, Tracking & Analytics

A. Web Cookies and Local Storage

Our web application (deripesa.com and its subdomains) utilizes essential cookies and local browser storage to:

  • Maintain your authenticated session securely.
  • Protect against Cross-Site Request Forgery (CSRF).
  • Remember your display preferences and language settings.

B. Google Analytics

We use Google Analytics on our web version to collect aggregated, anonymous telemetry on website traffic and user engagement. Google Analytics uses cookies to gather information such as:

  • Pages visited, duration of visits, and navigation pathways.
  • General geographic location (city/country level).
  • Referring websites and devices used to access the platform.

The data gathered helps us optimize site performance, refine user workflows, and identify system bottlenecks. Google Analytics does not collect sensitive financial credentials or transaction PINs. You can manage or disable cookies via your browser settings or opt out of Google Analytics tracking through the Google Analytics Opt-out Browser Add-on.

4. How We Use Your Information

We process your data for the following legitimate purposes:

  • Transaction Fulfillment: Initiating Safaricom M-Pesa STK pushes and executing automated deposits and cashouts with the Deriv Cashier API.
  • Account Verification: Confirming your Deriv trading credentials and verifying that transaction requests belong to the authorized account holder.
  • Customer Support: Resolving payment discrepancies, verifying failed network transactions, and providing status updates.
  • Fraud Prevention & Compliance: Monitoring for anomalous activity, preventing money laundering (AML), and complying with statutory financial regulations.
  • Platform Optimization: Evaluating platform reliability, uptime, and user experience through web analytics.

5. Sharing & Disclosure of Information

We do not sell, rent, or trade your personal information. We only share data with trusted third parties strictly necessary to deliver our services:

  • Safaricom PLC: To trigger M-Pesa STK prompts and complete automated disbursements via Daraja APIs.
  • Deriv Group: To synchronize payment agent cashier requests, balance verification, and transaction credits/debits.
  • Google Analytics: For anonymized web traffic analysis.
  • Legal & Regulatory Authorities: When required by applicable law, court order, or governmental regulation to investigate fraud or money laundering.

6. Data Security & Storage

We implement industry-standard administrative, technical, and physical safeguards:

  • Encryption: All communication between your device, our servers, Safaricom, and Deriv is encrypted using Transport Layer Security (TLS/HTTPS).
  • Access Controls: Restricted employee access to transactional data on a strict need-to-know basis.
  • Secure Server Infrastructure: Hosted in hardened cloud facilities with continuous monitoring.

While we take rigorous measures to secure your data, no transmission over the internet is 100% impenetrable.

7. Data Retention

We retain transaction history and personal identification details for as long as your account remains active or as required by financial, tax, and anti-money laundering (AML) laws in Kenya (typically up to 7 years for financial audit logs).

8. Your Data Protection Rights

Under applicable data protection laws, you have the right to:

  • Access: Request copies of your personal data held by us.
  • Rectification: Request corrections to incomplete or inaccurate information.
  • Erasure: Request deletion of personal information, provided it does not conflict with legal retention mandates for financial transactions.
  • Opt-out: Disable non-essential cookies via your browser controls.

9. Third-Party Links

Our platform may contain links to external sites (such as Deriv.com, Safaricom, or App Stores). We are not responsible for the privacy practices or content of third-party platforms.

10. Updates to This Policy

We may periodically revise this Privacy Policy to reflect regulatory changes or service enhancements. The revised policy will be posted on this page with an updated revision date.

11. Contact Information

For any inquiries or privacy requests, please reach out to our compliance desk:

Latest update: March 2026