Privacy Policy

Bomba Networks Limited ("we," "our," or "us") operates the Bomba WiFi mobile application and internet services (the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services, in compliance with the Kenya Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.

1. Information We Collect

A. Personal Information (With Consent)

We collect personal information that you voluntarily provide to us with your explicit consent when registering for or using our services. This may include:

• Contact Information: Your name, email address, and phone number.
• Account Information: Username, password, and payment details (processed securely by our third-party payment processors).
• Identity Verification Information: National ID number or passport number, as required for compliance with Kenya's SIM registration regulations and the Kenya Information and Communications Act.
• Location Data: The physical location of the hotspot you are connecting to, collected only at the time of connection.

B. Automatically Collected Information (Legitimate Interest)

When you access our hotspots and use our Services, we may automatically collect:

• Device Information: Device type, operating system, unique device identifiers (e.g., MAC address), mobile network information, and IP address.
• Connection Data: Time and duration of your connection, data usage, and connection logs required for network management.
• Usage Data: Anonymous usage statistics to improve our services.

2. Legal Basis for Processing (Kenya Data Protection Act, 2019)

Under the Kenya Data Protection Act, we process your personal data based on the following legal grounds:

• Consent (Section 31): We obtain your explicit consent before collecting any personal information. You have the right to withdraw consent at any time.
• Performance of a Contract: Processing is necessary to provide you with the internet services you have requested.
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services and network security, provided these interests are not overridden by your rights.
• Compliance with Legal Obligations: Processing is necessary to comply with Kenyan laws, including the Kenya Information and Communications Act and anti-terrorism regulations.

3. How We Use Your Information

We use the collected information for the following purposes:

• To Provide Services: To authenticate your device, connect you to our hotspots, manage your account, and process payments.
• To Improve Services: To analyze usage trends, monitor network performance, and develop new features.
• To Communicate with You: To send service-related announcements, technical notices, and security alerts.
• For Security: To protect our network, verify your identity, and prevent fraudulent activity.
• For Legal Compliance: To comply with Kenyan laws and regulatory requirements.

4. Marketing and Promotional Communications (OPT-IN ONLY)

In compliance with Section 33 of the Kenya Data Protection Act and the Kenya Information and Communications (Consumer Protection) Regulations, 2010:

• We will ONLY send you marketing or promotional messages if you have given us your EXPLICIT CONSENT to do so.
• You will be presented with a clear opt-in checkbox during registration and payment to receive promotional communications.
• We will NEVER send you marketing messages without your prior consent.
• Every marketing message will include a clear and easy opt-out mechanism.
• You can withdraw your consent at any time by contacting us or updating your preferences in your account settings.
• We do not share your personal data with third parties for their own marketing purposes.

5. Data Subject Rights (Your Rights Under Kenyan Law)

Under the Kenya Data Protection Act, 2019 (Section 26), you have the following rights regarding your personal data:

• Right to be Informed: You have the right to be informed about the collection and use of your personal data (this Privacy Policy fulfills this right).
• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct any inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): You can request the deletion of your personal data under certain conditions.
• Right to Restrict Processing: You can request that we temporarily or permanently stop processing your personal data.
• Right to Data Portability: You can request a structured, commonly used, and machine-readable copy of your data for transfer to another service.
• Right to Object: You can object to our processing of your personal data, including for direct marketing.
• Rights in relation to Automated Decision-making: You have the right not to be subject to a decision based solely on automated processing.

To exercise any of these rights, please contact us using the details provided in Section 11. We will respond to your request within 7 days as required by the Data Protection (General) Regulations, 2021.

6. Data Retention

We will retain your personal data only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by Kenyan law:

• Account Data: Retained for as long as your account is active and for 12 months after account closure.
• Transaction Data: Retained for 7 years to comply with tax and financial regulations under the Kenya Tax Procedures Act.
• Connection Logs: Retained for 12 months as required by the Kenya Information and Communications Act for security purposes.
• Marketing Consent Records: Retained for 3 years after consent withdrawal to document compliance.

When we no longer need to process your data, we will securely delete or anonymize it.

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit using SSL/TLS protocols.
• Secure storage with access controls and authentication requirements.
• Regular security audits and vulnerability assessments.
• Staff training on data protection and privacy.
• Data breach response procedures as required by Section 43 of the Kenya Data Protection Act.

In the event of a data breach, we will notify the Office of the Data Protection Commissioner and affected individuals within 72 hours as required by law.

8. International Data Transfers

Your data is primarily processed and stored within Kenya. In some cases, we may use service providers located outside of Kenya (e.g., cloud hosting providers). In such instances, we ensure that:

• The transfer is necessary for the performance of our services.
• Appropriate safeguards are in place in accordance with Section 48 of the Kenya Data Protection Act.
• The recipient country has adequate data protection laws or we have contractual agreements ensuring the same level of protection.

9. Cookies and Tracking Technologies

Our website and app use cookies and similar tracking technologies to enhance user experience. We obtain your consent before placing non-essential cookies. You can manage your cookie preferences through your browser settings.

10. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately. If we learn that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers.

11. Data Protection Officer and Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to lodge a complaint, please contact our Data Protection Officer (DPO):

Supervisory Authority: You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated:

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page with an updated "Last Updated" date.
• Sending you an email notification (if you have provided your email and consented to communications).
• Displaying a notice on our website and app.

We encourage you to review this Privacy Policy periodically for any changes.