Segera Finance Reporting ("the Application") is an internal management reporting tool operated by Segera Ltd. It is not offered to the public, not listed on any marketplace, and not available to customers or third parties. Its only users are named members of Segera Ltd management and finance staff.
Data controller: Segera Ltd, Rumuruti Road, Nanyuki, Laikipia County, Kenya.
Contact for all privacy matters: hannes@segera.com.
The Application requests a single OAuth scope,
com.intuit.quickbooks.accounting, and uses it exclusively for read
operations. It retrieves:
| Category | Purpose |
|---|---|
| Profit and loss, balance sheet, cash flow statement, trial balance | Monthly and year-to-date management reporting |
| Accounts receivable and accounts payable ageing detail | Liquidity planning and payment discipline |
| Supplier balances | Creditor control |
| Account, class and cost centre structure | Segment reporting |
These reports contain the names of suppliers, customers and travel agents that Segera Ltd and the Zeitz Foundation transact with, together with amounts and dates. Where such a name identifies an individual — a sole trader, a guest, an employee reimbursement — it constitutes personal data and is treated as described below.
The Application does not request or access payment card data, bank credentials, or the QuickBooks Payments or Payroll APIs.
Besides QuickBooks, the Application processes two further sources:
| Source | Data | Purpose |
|---|---|---|
| ResRequest (via an export of Segera's own booking spreadsheets) | Reservation reference, guest name, arrival and departure date, number of guests, booking value, outstanding balance, booking agent | Occupancy, deposit control and liquidity forecasting |
| Basecamp (Segera's own account) | Post title, batch reference, author, date and approval comments | Matching supplier payments against their documented approval |
From the Basecamp source the Application stores only the fields listed above. Message bodies, sender e-mail addresses, attachment links and the payroll project are not retained.
Processing is carried out in the legitimate interest of Segera Ltd in preparing accurate management accounts and complying with its own statutory reporting duties. Segera Ltd processes this data in accordance with the Kenya Data Protection Act, 2019.
Retrieved reports and the figures derived from them are held in local database files on a single managed computer operated by the consultant named in section 1, located in Germany, together with the OAuth refresh tokens required to maintain the connection. Access to those files is restricted to that operator's account. Transfers between the Application, Intuit, Google and Basecamp run over TLS.
Because processing takes place outside Kenya, this involves a cross-border transfer from Kenya to Germany. Should the Application later be moved to a hosting provider, this section will be updated before that move takes effect.
The reports are intended for named individuals holding management responsibility at Segera Ltd — currently the Chief Executive, the owner's representative, the Finance Manager and the Group Accountant — plus the external consultant who maintains the Application.
The reports are currently not published on the internet. They are generated as files on the operator's computer and shared directly with those individuals. If they are made available over the web at a later date, individual authentication will be in place before that happens; this section will be updated accordingly.
Daily snapshots are retained for seven years, in line with the retention period Segera Ltd applies to its accounting records under Kenyan law. Snapshots exist because the booking and payables position cannot be reconstructed retrospectively; each day's copy is what makes a forecast auditable. OAuth tokens are deleted immediately on disconnection.
An authorised user may revoke the Application's access at any time from within QuickBooks Online under Apps, or via the Application's own disconnect page. Revocation takes effect immediately: the stored refresh token is destroyed and no further data is retrieved.
To request deletion of data already retrieved, or a copy of it, write to hannes@segera.com. Requests are answered within thirty days. Where accounting records must be retained under Kenyan law, that obligation takes precedence over a deletion request, and the requester is told so explicitly.
A confirmed breach affecting personal data is reported to the Office of the Data Protection Commissioner of Kenya and to the affected persons within seventy-two hours of discovery, as required by the Data Protection Act.
Material changes are published on this page with a new version number and effective date. The version in force at the time of processing applies.