Privacy Policy

When an ISP registers for and uses our Platform, we collect:

• Business name, registration details, and tax identification numbers
• Contact information including name, email address, phone number, and physical address of authorized representatives
• Billing and payment information including bank account details, M-Pesa Till/Paybill numbers, and payment gateway credentials
• MikroTik router configuration data including IP addresses, API credentials, and network topology information
• Service package configurations, pricing structures, and billing cycle preferences
• Staff and administrator account details including names, roles, and access permissions
• Communication preferences and support interaction history
• White-label branding assets including logos, color schemes, and custom domain configurations

On behalf of our Tenants, we process the following End User data:

• Full name, email address, phone number, and physical or installation address
• National identification or passport numbers where required by the Tenant for KYC compliance
• Internet service subscription details including package type, bandwidth allocation, and connection status
• PPPoE and Hotspot authentication credentials (usernames; passwords are stored in hashed format)
• Payment transaction records including amounts, dates, payment methods, and transaction reference numbers
• Network usage data including session duration, data consumption, and bandwidth utilization
• IP addresses assigned during internet sessions
• SMS and communication logs related to billing notifications, payment reminders, and service alerts
• Support tickets and customer service interaction records

When you access our Platform, we automatically collect:

• Device information including device type, operating system, browser type and version, and screen resolution
• IP address, approximate geographic location derived from IP, and internet service provider information
• Usage data including pages visited, features used, click patterns, session duration, and navigation paths
• Referral source, search terms, and campaign attribution data
• Error logs, crash reports, and performance diagnostics
• Cookies, pixel tags, web beacons, and similar tracking technologies (see Section 8)

We may receive information from:

• Payment processors (M-Pesa, KopoKopo, Flutterwave, SasaPay, Stripe, PayStack) regarding transaction confirmations and payment status
• MikroTik routers via API integration regarding network status, user sessions, and bandwidth data
• SMS gateway providers regarding message delivery status
• Domain registrars and SSL certificate providers for white-label configurations
• Publicly available business registries for Tenant verification purposes

• Provisioning, maintaining, and administering Tenant accounts and their subscriber management systems
• Processing billing cycles, generating invoices, and facilitating payment collection through integrated gateways
• Managing MikroTik router integrations including PPPoE/Hotspot user provisioning, bandwidth management, and CoA (Change of Authorization) operations
• Sending transactional communications including billing notifications, payment confirmations, service alerts, and account updates via SMS and email
• Providing RADIUS authentication services for subscriber internet access
• Generating financial reports, analytics dashboards, and business intelligence for Tenants
• Facilitating white-label portal customization and branding

• Analyzing usage patterns to improve Platform features, performance, and user experience
• Conducting aggregated and anonymized statistical analysis for product development
• Monitoring system performance, uptime, and infrastructure health
• Identifying and resolving technical issues, bugs, and security vulnerabilities
• Developing new features and services based on aggregated usage trends

• Detecting, preventing, and investigating unauthorized access, fraud, abuse, and security incidents
• Verifying user identities and authenticating access to accounts and administrative functions
• Monitoring for suspicious payment activities and potential financial fraud
• Enforcing our Terms of Service and Acceptable Use Policy
• Protecting the rights, property, and safety of our Users, Tenants, and the public

• Complying with applicable laws, regulations, legal processes, and governmental requests
• Responding to lawful requests from law enforcement and regulatory authorities
• Maintaining records as required by tax, financial, and telecommunications regulations
• Exercising or defending legal claims and rights
• Fulfilling obligations under the Kenya Data Protection Act 2019, GDPR, CCPA/CPRA, and other applicable privacy frameworks

• Sending service-related announcements, maintenance notifications, and security alerts (these are non-optional)
• Providing customer support and responding to inquiries
• Sending promotional communications about new features, updates, and offers (with your consent, where required)
• Conducting surveys and collecting feedback to improve our services

Processing is necessary for the performance of our contract with you, including account creation, service delivery, billing, payment processing, and technical support. Without this processing, we cannot provide our services.

We process data where we have a legitimate business interest that is not overridden by your rights, including:

• Improving and optimizing our Platform and services
• Ensuring network and information security
• Preventing fraud and unauthorized access
• Conducting business analytics using aggregated, anonymized data
• Marketing our services to existing customers (with easy opt-out)

Where required by law, we obtain your explicit consent before processing, particularly for:

• Sending promotional marketing communications
• Placing non-essential cookies and tracking technologies
• Processing sensitive personal data
• Transferring data to jurisdictions without adequate data protection frameworks

You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We process data where necessary to comply with legal obligations, including tax reporting, financial record-keeping, telecommunications regulations, anti-money laundering requirements, and responding to lawful government requests.

In rare circumstances, we may process data to protect the vital interests of an individual, such as in emergency situations involving threats to personal safety.

We share necessary transaction data with integrated payment gateways to process payments:

• M-Pesa (Safaricom PLC): for mobile money transactions via Till Number and Paybill
• KopoKopo: for M-Pesa payment processing and settlement
• Flutterwave: for card payments and multi-currency transactions
• SasaPay: for mobile wallet and bank transfer processing
• Stripe: for international card payments and recurring billing
• PayStack: for card and bank transfer payments

Each payment processor operates under its own privacy policy and PCI-DSS compliance obligations. We share only the minimum data required to complete transactions.

We engage trusted third-party service providers who process data on our behalf under strict contractual obligations:

• Cloud hosting and infrastructure providers for data storage and computing
• SMS gateway providers for delivering billing notifications and alerts
• Email delivery services for transactional and marketing communications
• Content delivery networks (CDNs) for performance optimization
• Analytics providers for aggregated usage insights
• Customer support tools for ticket management

All sub-processors are bound by Data Processing Agreements (DPAs) that require them to protect your data to standards no less protective than this Policy.

As a multi-tenant platform, data flows between Tenants and their Subscribers are governed as follows:

• Tenants (ISPs) are Data Controllers for their Subscribers' data: they determine what data to collect and how to use it
• Iterative Billing acts as a Data Processor, processing Subscriber data solely on behalf of and under the instructions of the Tenant
• We do not access, use, or share Subscriber data for our own purposes except as necessary to provide the Platform services or as required by law
• Tenants are responsible for obtaining appropriate consents from their Subscribers and for their own compliance with applicable privacy laws
• Subscriber data is logically isolated between Tenants: no Tenant can access another Tenant's data

We may disclose Personal Data when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Enforce our Terms of Service, including investigation of potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect against harm to the rights, property, or safety of Iterative Billing, our Users, or the public as required or permitted by law
• Respond to valid court orders, subpoenas, or warrants issued by courts of competent jurisdiction

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your Personal Data may be transferred as part of that transaction. We will notify affected Users of any change in ownership or control of their Personal Data and any choices they may have regarding their data. The acquiring entity will be bound by the terms of this Privacy Policy with respect to data collected prior to the transfer.

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify any individual. This data may be used for industry analysis, benchmarking, marketing, and other business purposes without restriction.

• Each Tenant's data is logically separated at the database level using tenant-specific identifiers
• Access controls ensure that Tenants can only view, modify, and manage their own data and their Subscribers' data
• Administrative access to cross-tenant data is restricted to authorized Iterative Billing personnel for maintenance and support purposes only
• API endpoints enforce tenant-level authentication and authorization on every request

• Iterative Billing is responsible for the security and privacy of the Platform infrastructure, including data encryption, access controls, and system monitoring
• Tenants are responsible for the accuracy of data they input, the consents they obtain from Subscribers, and their compliance with applicable laws in their jurisdiction
• Tenants are responsible for managing their staff access permissions and ensuring appropriate use of the Platform
• We provide tools and features to assist Tenants with their compliance obligations, but we do not guarantee compliance on their behalf

Subscriber data belongs to the Tenant. Upon termination of a Tenant's account, we will provide data export capabilities and delete Tenant data in accordance with our data retention policy, subject to any legal obligations requiring continued retention.

• M-Pesa transaction details including phone numbers, transaction IDs, amounts, and timestamps
• Bank transfer details including account references and settlement information
• Card payment tokens (we never store full card numbers: these are tokenized by our payment processors)
• Invoice records, payment histories, and account balances
• Refund and credit note records

• All payment processing is handled through PCI-DSS compliant payment processors
• We do not store complete credit card numbers, CVV codes, or PIN numbers on our servers
• Payment API credentials are encrypted at rest using AES-256 encryption
• All payment-related communications are transmitted over TLS 1.2 or higher
• Payment callback endpoints are validated using cryptographic signatures to prevent tampering
• M-Pesa integration follows Safaricom's Daraja API security protocols including OAuth 2.0 authentication

Financial transaction records are retained for a minimum of seven (7) years in compliance with applicable tax and financial regulations, even after account termination. This retention is a legal obligation and is not subject to deletion requests.

• Strictly Necessary Cookies: Essential for Platform functionality including authentication, session management, security tokens, and load balancing. These cannot be disabled.
• Functional Cookies: Remember your preferences such as language, theme (dark/light mode), timezone, and display settings.
• Analytics Cookies: Help us understand how Users interact with the Platform, which features are most popular, and where Users encounter issues. We use aggregated analytics data to improve our services.
• Performance Cookies: Monitor Platform performance, page load times, and error rates to ensure optimal service delivery.

We may use third-party analytics services that set their own cookies. These services process data under their own privacy policies:

• Analytics services for usage pattern analysis
• Error monitoring services for crash reporting and debugging
• Performance monitoring tools for infrastructure optimization

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking essential cookies may impair Platform functionality. Where required by law, we will obtain your consent before placing non-essential cookies.

Our Platform currently does not respond to "Do Not Track" (DNT) browser signals, as there is no universally accepted standard for how to respond to such signals. We will update this policy if a standard is established.

• Active Account Data: Retained for the duration of the account relationship plus thirty (30) days after account closure to facilitate reactivation requests.
• Financial & Transaction Records: Retained for seven (7) years after the transaction date, as required by tax and financial regulations.
• Network & Session Logs: Retained for twelve (12) months for security monitoring and troubleshooting purposes.
• Support Tickets & Communications: Retained for three (3) years after resolution for quality assurance and dispute resolution.
• Analytics & Usage Data: Aggregated and anonymized data may be retained indefinitely. Identifiable usage data is retained for twenty-four (24) months.
• Marketing Consent Records: Retained for the duration of consent plus five (5) years as evidence of lawful processing.
• Backup Data: Encrypted backups are retained for ninety (90) days on a rolling basis and are automatically purged thereafter.

Upon receiving a valid deletion request or upon account termination:

• Active account data will be deleted or anonymized within thirty (30) days
• Data subject to legal retention requirements will be archived securely and access-restricted until the retention period expires
• Backup copies will be purged within ninety (90) days through our automated backup rotation
• We will provide confirmation of deletion upon request
• Certain anonymized or aggregated data derived from your information may persist, as it can no longer be linked to you

When a Tenant terminates their account, we will:

• Provide a data export in a commonly used, machine-readable format upon request within thirty (30) days of termination
• Delete all Tenant and associated Subscriber data within sixty (60) days of termination, subject to legal retention obligations
• Provide written confirmation of data deletion upon request
• Retain financial records as required by law (see Section 7.3)

• Where data is transferred outside of Kenya, the European Economic Area (EEA), or the United Kingdom, we ensure appropriate safeguards are in place
• We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to countries without adequate data protection frameworks
• We assess the data protection laws of recipient countries and implement supplementary measures where necessary
• Our cloud infrastructure providers maintain certifications and compliance frameworks recognized by international data protection authorities

We endeavor to process and store data in regions that provide adequate data protection. Where Tenants have specific data residency requirements, we will work to accommodate such requirements within the capabilities of our infrastructure, subject to additional terms.

• All international data transfers are encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted using AES-256 encryption regardless of storage location
• Access to data from different jurisdictions is logged and auditable
• We maintain Data Processing Agreements with all sub-processors that include international transfer provisions

• End-to-end encryption for data in transit (TLS 1.2+) and at rest (AES-256)
• Secure password hashing using industry-standard algorithms (bcrypt/Argon2)
• Multi-factor authentication (MFA) available for all administrative accounts
• Role-based access control (RBAC) with principle of least privilege
• Regular security patching and vulnerability assessments
• Web Application Firewall (WAF) protection against common attack vectors
• DDoS mitigation and rate limiting on all API endpoints
• Intrusion detection and prevention systems (IDS/IPS)
• Automated security scanning of code and dependencies
• Database encryption and secure key management

• Employee background checks and confidentiality agreements for all staff with data access
• Regular security awareness training for all employees
• Strict access controls: data access is granted on a need-to-know basis only
• Documented incident response procedures and escalation protocols
• Regular internal and external security audits
• Vendor security assessments for all third-party service providers
• Business continuity and disaster recovery plans with regular testing

While we implement industry-leading security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. You acknowledge and accept this inherent risk when using any internet-based service. In the event of a security breach, we will follow our breach notification procedures as outlined in Section 15.

• Right of Access: You may request a copy of the Personal Data we hold about you, along with information about how it is processed.
• Right to Rectification: You may request correction of inaccurate or incomplete Personal Data.
• Right to Erasure (Right to be Forgotten): You may request deletion of your Personal Data, subject to legal retention obligations and legitimate business needs.
• Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances.
• Right to Data Portability: You may request your data in a structured, commonly used, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
• Right Not to be Subject to Automated Decision-Making: You may request human review of decisions made solely by automated means that significantly affect you.

If you are located in Kenya, you have additional rights under the Data Protection Act 2019, including:

• The right to be informed of the use to which your Personal Data is to be put
• The right to object to the processing of your Personal Data
• The right to correction of false or misleading data
• The right to deletion of false or misleading data
• The right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

If you are located in the European Economic Area or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR) and UK GDPR, including all rights listed above plus:

• The right to lodge a complaint with your local supervisory authority
• The right to an effective judicial remedy against a supervisory authority or data controller/processor
• The right to compensation for material or non-material damage resulting from GDPR violations

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what Personal Data is collected, used, shared, or sold
• The right to delete Personal Data held by businesses and their service providers
• The right to opt-out of the sale or sharing of Personal Data (note: we do not sell Personal Data)
• The right to non-discrimination for exercising your privacy rights
• The right to correct inaccurate Personal Data
• The right to limit use and disclosure of Sensitive Personal Information

To exercise any of these rights, please contact us using the details in Section 20. We will respond to your request within thirty (30) days, or within the timeframe required by applicable law. We may need to verify your identity before processing your request. If we cannot fulfill your request, we will explain the reasons and inform you of your right to appeal or lodge a complaint with the relevant supervisory authority.

If you are an End User (Subscriber of an ISP using our Platform), please direct your privacy requests to your ISP in the first instance, as they are the Data Controller for your data. If your ISP is unable to assist, you may contact us directly and we will coordinate with the relevant Tenant to fulfill your request.

Our Iterative AI Engine may be used for:

• Predictive analytics for revenue forecasting and churn prediction
• Automated billing cycle optimization and payment reminder scheduling
• Network anomaly detection and performance optimization recommendations
• Fraud detection and suspicious activity flagging
• Customer segmentation and service recommendation
• Automated report generation and business intelligence insights

• No fully automated decisions are made that produce legal effects or similarly significant effects on individuals without human oversight
• Automated fraud detection flags are reviewed by human operators before any account action is taken
• Tenants retain full control over billing decisions: AI provides recommendations, not binding decisions
• You have the right to request human review of any automated decision that affects you
• We do not use Personal Data for automated profiling that results in discrimination based on protected characteristics

• We may use aggregated, anonymized, and de-identified data to train and improve our AI models
• Individual Tenant or Subscriber data is never used to train AI models that benefit other Tenants without explicit consent
• AI models are regularly audited for bias and accuracy
• Tenants may opt out of having their anonymized data used for AI model improvement by contacting us

• We maintain 24/7 security monitoring and automated breach detection systems
• Upon detecting a potential breach, our incident response team is immediately activated
• We will contain the breach, assess its scope and impact, and begin remediation
• All breach incidents are documented with detailed timelines and impact assessments

• We will notify the relevant supervisory authority (including the Kenya ODPC, ICO, or applicable EU supervisory authority) within seventy-two (72) hours of becoming aware of a breach that poses a risk to individuals' rights and freedoms
• The notification will include the nature of the breach, categories and approximate number of affected individuals, likely consequences, and measures taken to address the breach

• We will notify affected Tenants without undue delay when a breach affects their data or their Subscribers' data
• Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals directly
• Notifications will include a description of the breach, the data affected, steps we are taking, and recommendations for protective measures
• Tenants are responsible for notifying their own Subscribers as required by applicable law, and we will assist them in doing so

• We will conduct a thorough post-incident review to identify root causes and prevent recurrence
• Security measures will be updated based on lessons learned
• Affected parties will be kept informed of remediation progress
• We maintain cyber insurance to help cover costs associated with data breaches

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Kenya, without regard to its conflict of law provisions. For Users located in the European Economic Area, nothing in this section shall deprive you of the protection afforded by mandatory provisions of the law of your country of residence.

Before initiating any formal dispute resolution proceedings, you agree to first contact us and attempt to resolve the dispute informally. We will endeavor to resolve any complaint or dispute within thirty (30) days of receipt.

Any dispute, controversy, or claim arising out of or relating to this Privacy Policy that cannot be resolved informally shall be settled by binding arbitration administered in Nairobi, Kenya, in accordance with the Arbitration Act of Kenya. The arbitration shall be conducted by a single arbitrator mutually agreed upon by the parties. The language of arbitration shall be English. The arbitrator's decision shall be final and binding.

To the maximum extent permitted by applicable law, you agree that any dispute resolution proceedings will be conducted only on an individual basis and not in a class, consolidated, or representative action. If this class action waiver is found to be unenforceable, then the entirety of this arbitration provision shall be null and void with respect to such claim.

For any matters not subject to arbitration, you consent to the exclusive jurisdiction of the courts located in Nairobi, Kenya. Notwithstanding the foregoing, we may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of our rights.

Nothing in this section prevents you from lodging a complaint with the relevant data protection authority in your jurisdiction, including:

• The Office of the Data Protection Commissioner (ODPC) in Kenya
• Your local EU/EEA supervisory authority under the GDPR
• The Information Commissioner's Office (ICO) in the United Kingdom
• The California Attorney General under the CCPA/CPRA