Privacy Policy

This Privacy Policy applies to all personal data processed by BridgeERP Limited and its affiliates in connection with our products and services, including:

• Cloud ERP Platform — all modules (Accounting, Inventory, Sales, HR, CRM, Manufacturing, and suite products such as EduPrime, HMS, Courier, MFI, Insurance and Hotel Suite)
• Point of Sale — BridgeERP POS, SupremePOS and white-label POS deployments
• Websites — mybridgeerp.com, aminitechsolutions.com and all subdomains
• Mobile Applications — including PesaBridge, BridgePay and companion apps
• APIs and Integrations — any third-party service connected through our platform

This policy does not apply to third-party services that you access through our platform. We encourage you to review the privacy policies of any third-party service you connect.

BridgeERP Limited is the data controller for personal data collected through our websites and marketing activities. When you use our cloud ERP platform to store and process your own business data (customer records, employee records, financial data), you are the data controller and BridgeERP acts as a data processor on your behalf, governed by our Subscription Agreement.

For questions about data processing, contact our Data Protection team at or write to:

Data Protection Officer
BridgeERP Limited
Elysee Plaza, Suite 12, 3rd Floor
Kilimani Road, Nairobi, Kenya
Phone: +254 746 883 809

a. Data You Provide Directly

• Account Information — name, email address, phone number, company name, job title
• Billing Information — billing address, payment method details (processed by our payment partners; we do not store full card numbers)
• Support Requests — messages, attachments and call recordings when you contact our support team
• User Content — documents, files, images and data you upload to the platform
• Communication Preferences — marketing opt-in/out choices, language and notification settings

b. Data Collected Automatically

• Device and Browser Data — IP address, browser type and version, operating system, device identifiers, screen resolution
• Usage Data — pages visited, features used, click patterns, session duration, error logs
• Location Data — approximate location derived from IP address (we do not collect precise GPS location unless you explicitly enable it for services like fleet tracking)
• Cookies and Tracking Technologies — as described in our Cookie Policy

c. Data from Third Parties

• SSO Providers — if you sign in via Google, Microsoft or another identity provider, we receive your name, email and profile picture
• Partners and Resellers — contact details shared by authorised BridgeERP partners under our Partnership Agreement
• Public Sources — business contact information from public directories or company websites for sales outreach

We process personal data only for the purposes listed below, each supported by a lawful basis under applicable data protection law:

We do not sell, rent or trade your personal data.

We share personal data only in the following circumstances:

• Service Providers (Sub-processors) — hosting providers, payment processors, email delivery services and analytics tools that help us operate our platform, each bound by data processing agreements
• BridgeERP Affiliates — companies within the BridgeERP group for shared operations (support, billing, development)
• Partners and Resellers — only with your consent, when you engage with a BridgeERP partner for implementation or support
• Legal Requirements — when required by law, regulation, court order or governmental authority
• Business Transfers — in connection with a merger, acquisition, reorganisation or sale of assets (you will be notified and given the opportunity to delete your data)
• With Your Consent — for any other purpose where you have given explicit consent

All sub-processors are contractually required to protect your data to standards equivalent to this policy.

BridgeERP operates internationally. Your data may be transferred to and processed in countries other than your country of residence, including Kenya (where our headquarters are located) and countries where our hosting providers operate.

When we transfer personal data outside of the European Economic Area (EEA), United Kingdom or other jurisdictions with data transfer restrictions, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where the destination country has been deemed to provide adequate data protection
• Binding corporate rules within the BridgeERP group
• Your explicit consent where other mechanisms are not available

For transfers involving Kenyan data subjects, we comply with the requirements of the Kenya Data Protection Act 2019 and guidance from the Office of the Data Protection Commissioner.

We implement industry-standard technical and organisational measures to protect your data:

We retain personal data only as long as necessary for the purposes described in this policy:

• Active accounts — data is retained for the duration of your subscription
• After account closure — we retain a read-only copy for 30 days (so you can reactivate), then delete all service data within 90 days
• Billing records — retained for 7 years as required by tax and financial regulations
• Support records — retained for 3 years after resolution for quality assurance and training
• Marketing data — retained until you withdraw consent or unsubscribe; suppression lists are maintained indefinitely to honour your opt-out
• Server logs — automatically purged after 12 months

When retention periods expire, data is securely deleted or irreversibly anonymised.

Depending on your location and applicable law, you have the following rights regarding your personal data:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — correct inaccurate or incomplete data
• Right to Erasure — request deletion of your data (subject to legal retention requirements)
• Right to Restrict Processing — limit how we use your data in certain circumstances
• Right to Data Portability — receive your data in a structured, machine-readable format
• Right to Object — object to processing based on legitimate interests, including direct marketing
• Right to Withdraw Consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing
• Right Not to Be Subject to Automated Decisions — request human review of decisions made solely by automated processing that significantly affect you

To exercise any of these rights, email or use the contact form. We will respond within 30 days (or sooner where required by law). We may ask you to verify your identity before fulfilling your request.

Right to Complain: If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority. In Kenya, this is the Office of the Data Protection Commissioner (ODPC). In the EU, contact your national supervisory authority.

We use cookies and similar technologies (local storage, pixels, beacons) for essential site functionality, analytics and marketing. You can manage your preferences at any time.

For a complete list of cookies we use and instructions on how to control them, see our Cookie Policy.

Do Not Track: Our sites currently do not respond to browser "Do Not Track" signals. Where a Global Privacy Control (GPC) signal is detected, we treat it as a valid opt-out of sale or sharing under applicable law.

BridgeERP services are designed for business use and are not directed at children. We do not knowingly collect personal data from anyone under the age of 16 (or 13 in jurisdictions where COPPA applies). If we discover that we have inadvertently collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at .

Note for educational institutions: When a school or university uses EduPrime (our education management suite), the institution is the data controller for student data. BridgeERP processes student data solely on the institution's instructions under our Subscription Agreement.

BridgeERP offers AI-powered features under the Bria brand (predictive analytics, at-risk student identification, demand forecasting, automated categorisation). These features:

• Use anonymised and aggregated data for model training — your individual business data is never shared with other customers or used to train models accessible to third parties
• Provide recommendations, not decisions — AI outputs are advisory and require human review before action
• Can be disabled in your account settings if you prefer not to use AI features
• Are subject to regular bias audits and fairness reviews

European Economic Area and United Kingdom

If you are in the EEA or UK, you have the rights set out in Section 9 above. Our legal bases for processing are specified in Section 4. For data transfers, see Section 6. You may lodge a complaint with your national supervisory authority.

California (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect and how it is used; (b) request deletion of your personal information; (c) opt out of the "sale" or "sharing" of personal information (we do not sell personal data); (d) non-discrimination for exercising your rights. To submit a request, email with "California Privacy Request" in the subject line.

Kenya (Data Protection Act 2019)

BridgeERP complies with the Kenya Data Protection Act 2019 and is registered with the Office of the Data Protection Commissioner. Kenyan data subjects may exercise their rights under the Act by contacting us at .

Brazil (LGPD)

Brazilian data subjects have the right to confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing, and the right to revoke consent. Contact us at .

Our platform may contain links to third-party websites, payment gateways (M-Pesa, Airtel Money, PesaPal, Flutterwave) and integrations. We are not responsible for the privacy practices of these services. We recommend you review their privacy policies before providing them with personal data.

We may update this Privacy Policy from time to time. For material changes, we will:

• Post a notice on our website at least 30 days before the changes take effect
• Send an email notification to the account owner of active subscriptions
• Update the "Last Updated" date at the top of this page

Your continued use of our services after the effective date constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account before the new policy takes effect.

If you have questions about this Privacy Policy, want to exercise your data rights, or have a complaint:

Email:
Phone: +254 746 883 809

BridgeERP Limited
Elysee Plaza, Suite 12, 3rd Floor
Kilimani Road, Nairobi, Kenya

We aim to respond to all privacy-related enquiries within 30 days.

• Personal Data — any information that identifies or can identify a living individual
• Service Data — data you create, store or process using BridgeERP services (your business records, customer data, financial data)
• Controller — the entity that determines how and why personal data is processed
• Processor — the entity that processes personal data on behalf of the controller
• Sub-processor — a third party engaged by BridgeERP to process personal data in connection with our services
• Data Subject — the individual whose personal data is being processed