Privacy Policy

1. Who we are

Pepe is operated by Pepe IDPP (“Pepe”, “we”). We provide paper process automation software to institutions (our customers). Institutions typically act as data controllers for applicant and staff data; Pepe acts as a processor when processing that data on their instructions.

2. Data we process

Account data: names, emails, roles and authentication credentials for institution staff.

Form and workflow data: information applicants or staff enter into forms, uploads, signatures, comments and audit events.

Technical data: IP addresses, device/browser metadata, logs required for security and reliability.

3. Purposes

To provide, secure and improve the platform; to authenticate users; to route and approve submissions; to send transactional notifications; to meet legal obligations; and to support billing where applicable.

4. Sharing

We do not sell personal data. We share data with subprocessors needed to run the service (e.g. hosting, email delivery, optional payment providers) under written terms, and when required by law.

5. Security & retention

Data is encrypted in transit and at rest where supported. Tenants are logically isolated. Retention follows the institution’s configuration and our Data retention & deletion policy. Contact info@pepe.co.ke for access or deletion requests routed through your institution.