Privacy Policy

This Privacy Policy explains how SimbaHost (Datacare Limited) collects, uses, discloses, and safeguards your personal data when you use our website or services. We comply with the Kenya Data Protection Act 2019 and the regulations issued by the Office of the Data Protection Commissioner (ODPC).

1. Data controller

Datacare Limited, trading as SimbaHost, is the data controller. Our registered office is Block C2, Mayfair Maisonettes, Mpaka Road, Westlands, Nairobi (P.O. Box 60871–00200, Nairobi). Our Data Protection Officer is contactable at dpo@simbahost.co.ke.

2. What we collect

2.1 Information you give us

• Account data: name, email, phone, company name, billing address, KRA PIN.
• Payment data: M-Pesa phone number, last 4 digits of card, transaction references. We never store full card numbers. They are tokenised by our payment processor.
• Service data: domains you register, hosting account usernames, VPS IPs, email contents you choose to share via support tickets.

2.2 Information collected automatically

• Usage data: pages visited, links clicked, session duration. Only collected if you consent to the “analytics” cookie category.
• Device data: IP address, browser, operating system, device type. Used for fraud prevention and to keep the service running.
• Cookies: see our cookie consent banner; you can change preferences any time from the link in the footer.

3. Lawful basis & purposes

4. Who we share data with

• Payment processors: Safaricom (M-Pesa Daraja), Paystack (card payments; your card details are entered on Paystack's page and never reach us), our partner banks for bank transfer reconciliation.
• Infrastructure providers: our database and authentication platform, our CDN and DNS network, our server and data-centre providers, our domain registrars and the .KE registry (KENIC), our SSL certificate suppliers, and our live-chat provider (only if you consent). We will name any of them on request: write to dpo@simbahost.co.ke.
• Statutory authorities: KRA (eTIMS tax invoices), CAK / ODPC (where lawfully required), law enforcement (only on valid court order).

We do not sell your personal data. Where data leaves Kenya, transfers are protected by contractual safeguards in line with section 48 of the Kenya Data Protection Act.

5. Retention

• Active account data: while your account is active.
• Billing records / invoices: 7 years after the transaction (KRA requirement).
• Audit logs / security logs: 24 months.
• On account closure, we anonymise other personal data within 30 days, except where law requires longer retention.

6. Your rights

Under the Kenya Data Protection Act 2019 you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion (subject to retention obligations above)
• Request a portable export of your data
• Object to certain processing
• Withdraw consent at any time where processing relies on consent
• Lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke

Exercise these rights from the “Privacy” tab of your dashboard profile, or email dpo@simbahost.co.ke. We respond within 7 working days.

7. Security

We use industry-standard safeguards: TLS in transit, encrypted storage at rest, role-based access control, audit logging, regular vulnerability scans, and a published vulnerability disclosure programme (see our security.txt).

8. Children

Our services are not directed at children under 18. We do not knowingly collect data from minors.

9. Changes

We will notify you of material changes to this policy via email and via a banner on the customer dashboard at least 30 days before they take effect.

Questions about this document? Email legal@simbahost.co.ke or contact our support team.