Privacy Policy

1. Who We Are

Wanjau Ndonga & Associates (“we”, “our”, “us”) is an ICPAK registered tax consultancy firm based in Nairobi, Kenya. We operate the WNA Tax Platform at wna.co.ke. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and services.

2. Information We Collect

We collect the following types of information:

• Account information: Name, email address, phone number, company name, and KRA PIN when you register.
• Payment information: M-Pesa phone number and transaction references. We do not store card numbers or M-Pesa PINs.
• Filing information: Tax filing details, business documents, and financial records you upload to our platform.
• Usage data: Pages visited, browser type, IP address, and session information for security and analytics.

3. How We Use Your Information

We use your information to:

• Provide and manage your tax compliance services
• Process payments and generate invoices
• Send you filing deadline reminders and service notifications via SMS and email
• Comply with KRA and other regulatory requirements
• Improve our platform and services

4. Data Sharing

We do not sell your personal data. We share information only with:

• Kenya Revenue Authority (KRA): As required for tax filing on your behalf.
• Safaricom (M-Pesa): For payment processing via the Daraja API.
• Service providers: SMS (TextSMS Kenya), email (Brevo), and file storage (Cloudinary) — all bound by confidentiality agreements.

5. Data Security

We protect your data using industry-standard security measures including HTTPS encryption, secure session management, password hashing, and access controls. Your financial documents are stored securely on Cloudinary with restricted access. We regularly review our security practices.

6. Data Retention

We retain your account and tax records for a minimum of 7 years as required by Kenyan tax law. You may request deletion of your account data at any time, subject to our legal retention obligations.

7. Your Rights

Under the Kenya Data Protection Act 2019, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal requirements)
• Object to processing of your data for marketing purposes

8. Cookies

We use session cookies to keep you logged in and to maintain your preferences. We do not use third-party tracking cookies. You can disable cookies in your browser settings, but this may affect platform functionality.

9. Contact Us

For any privacy-related questions or to exercise your rights, contact us at: