Your information should have a reason for being here.

This Privacy Policy covers the main Rexius Lited website and the business activities connected to it, including business enquiries, ERP and digital projects, consulting, Mobi-Tech and shop support, Curves BD x Rexius, Rexius Escapes, partnerships, recruitment and newsletters.

Rexius Lited MHPSS operates through a dedicated platform at mhpss.rexiuslited.co.ke. Because MHPSS can involve more sensitive information, that platform has separate privacy and confidentiality information. General Rexius business channels should not be used to send detailed mental-health information.

Depending on the service, we may collect your name, email address, phone number, organisation, service brief, delivery or booking details, order and invoice references, payment status, product preferences, travel details, fitting information you choose to provide, recruitment information, uploaded CVs, newsletter preferences and communication history.

Our websites and systems may also record technical information such as IP address, browser or device information, timestamps, session activity, system logs and security events where this is necessary to operate and protect the service.

We use information to respond to enquiries, assess and route service requests, fulfil orders, coordinate bookings, deliver consulting or digital projects, issue invoices and receipts, provide customer support, manage recruitment, administer newsletters, maintain business records, prevent abuse and improve service delivery.

Where Rexius processes information on behalf of a client through an ERP or other business system, the purpose and responsibilities may also be defined in the applicable project agreement, data-processing arrangement or client instructions.

Payments may be processed through third-party providers such as M-Pesa, PesaPal, card networks, banks or other approved payment channels. Rexius does not need your card PIN, mobile-money PIN, one-time password or banking password.

We may retain transaction references, invoice and receipt information, payment status and accounting records where required for fulfilment, reconciliation, tax, audit, dispute handling and financial reporting.

ERP and digital projects can involve business records such as users and roles, approvals, invoices, payroll workflow records, inventory, procurement, customer records, reports and audit logs. Access and retention depend on the agreed system, hosting arrangement, user permissions and service scope.

More detail about this category of information is provided on our Data Processing & Platform Data page.

If you contact Rexius through email, WhatsApp, social platforms or other communication providers, those providers may process information under their own terms and privacy practices. Avoid sending passwords, PINs, one-time codes or credentials through ordinary messages.

Some services may rely on hosting, email, cloud, payment, courier, calendar, communication or analytics providers. We use such services only where they support a legitimate operational purpose.

Recruitment information may include your contact details, CV, work history, application responses, role applied for and internal recruitment notes. We use this information to assess applications, communicate about opportunities and maintain appropriate recruitment records.

Submitting an application does not guarantee an interview or employment. You should only provide information relevant to the application.

Where you subscribe to Rexius updates, we use your email address and selected preferences to send relevant communications. You can unsubscribe using the link in a marketing email or the applicable preference process.

Operational messages about an order, booking, application, invoice or active service may still be sent where they are necessary to complete or administer that transaction.

Rexius uses measures appropriate to the system and service, which may include access controls, authenticated user accounts, role permissions, prepared statements, audit logging, protected credentials, backups, secure providers and operational review.

No online system can be promised to be risk-free. We therefore limit access and ask users and clients to protect their own credentials and report suspected security issues promptly.

We keep information for as long as reasonably needed for the service, support, accounting, audit, security, legal or operational purpose for which it was collected. Different record types can have different retention periods.

Requests for access, correction, export or deletion can be reviewed subject to legal, contractual, security and record-keeping obligations.

You can contact Rexius to ask about the personal information connected to your use of the main website and business services, or to request correction where information is inaccurate. We may need to verify your identity before acting on certain requests.

For MHPSS privacy or confidentiality questions, use the dedicated MHPSS privacy information and contact channel rather than ordinary Rexius business channels.