Skip to content
Toggle navigation menu
Merchant LoginGet Started
PolicyData Processing Records (ROPA)

Data Processing Records (ROPA)

Our statutory Record of Processing Activities.

Your data, protected
Updated 3rd March 2026
Data Processing Records (ROPA) illustration
Last updated
3rd March 2026

Entity: Fusion Labs Limited (Budj)

1. Overview

This document records the categories of personal data processed by Budj, the purposes of processing, and the third parties involved, as required by the Data Protection Act, 2019 (Kenya).

2. Categories of Data Subjects

  • Users: Individuals using the Budj App to earn cashback.
  • Merchants: Business owners and representatives using the Merchant Dashboard.
  • Admins: Employees of Fusion Labs Limited managing the platform.

3. Categories of Personal Data

CategoryData ElementsPurpose
IdentityName, Business NameAccount creation, identification
ContactPhone Number, EmailM-Pesa integration, OTP, communication
TransactionalM-Pesa Transaction IDs, Amount, Merchant IDCashback calculation, reporting, accounting
Device/TechnicalIP Address, User Agent, Device Name, Platform, FCM TokenSecurity, Fraud prevention, Push notifications
LocationGPS Coordinates (Latitude/Longitude)Radius exclusivity, nearby offers

4. Purposes of Processing

  • Facilitating M-Pesa based cashback and loyalty rewards.
  • Personalizing user experience with location-based offers.
  • Fraud detection and prevention (IP/Device tracking).
  • Platform monitoring and error tracking (Sentry).
  • Transactional and marketing communications (SMS/Push).

5. Third-Party Data Recipients

  • Safaricom (M-Pesa): Payment processing and transaction verification.
  • Amazon Web Services (AWS): Cloud hosting (EC2), document storage (S3), and carrier lookup (Pinpoint).
  • Firebase (Google): Push notification delivery (FCM).
  • Sentry: Error reporting and platform stability monitoring.

6. Data Transfers

Personal data is primarily stored in cloud servers (AWS) and processed within the Republic of Kenya and relevant cloud service regions.

7. Retention Periods

  • Financial Records: 7 years (per Kenyan tax law).
  • User Account Data: Duration of active account plus a 1-year grace period after deletion request.
  • Log Data: 90 days for detailed debugging logs.

8. Contact Us

If you have any questions about this ROPA or our data practices, please contact us at:

Fusion Labs Limited