Privacy Policy

1. Data Controller

NetBill Technologies Ltd, a company registered in Kenya, acts as the Data Controller under the General Data Protection Regulation (GDPR) and Kenya's Data Protection Act 2019. We are responsible for determining the purposes and means of processing personal data collected through our services.

As a Data Controller, we are committed to the principles of lawfulness, fairness, and transparency in all our data processing activities. We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk associated with processing your personal data.

2. Lawful Basis for Processing

We process personal data under the following legal grounds:

• Article 6(1)(b) GDPR (Contract Performance): Processing necessary for the performance of our contract with you to provide our services. This includes processing required to create and maintain your account, process payments, and deliver the core functionality of our platform.
• Article 6(1)(f) GDPR (Legitimate Interests): Processing necessary for our legitimate interests, such as improving our services, detecting and preventing fraud, ensuring network security, and conducting business analytics. We always balance our interests against your privacy rights.
• Article 6(1)(a) GDPR (Consent): Processing based on your explicit consent, particularly for marketing communications and certain types of data analytics. You have the right to withdraw this consent at any time.
• Article 6(1)(c) GDPR (Legal Obligation): Processing necessary for compliance with a legal obligation to which we are subject, such as maintaining records for tax purposes or responding to valid legal requests from authorities.

For any processing activities not covered by these legal grounds, we will seek your explicit consent before processing your personal data.

3. Data Categories

We collect and process various categories of personal data, depending on how you interact with our services:

• Identity Data: First name, last name, username or similar identifier, title, business name, and position/role.
• Contact Data: Email address, telephone numbers, billing address, delivery address, business address, and communication preferences.
• Financial Data: Bank account details, payment card details, MPesa transaction records, billing history, and payment history. Payment card information is processed by our payment service providers and is not stored on our servers.
• Technical Data: IP address, login credentials (encrypted), browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device information, and other technology identifiers on the devices you use to access our services.
• Usage Data: Information about how you use our services, including API calls, feature utilization metrics, bandwidth consumption, session duration, page views, navigation paths, timing data, and other diagnostic data.
• Customer Data: Information about your customers that you provide to us for billing purposes. You remain the controller of this data, and we process it only according to your instructions.
• Communication Data: Information contained in our communications, including support tickets, feedback, survey responses, and correspondence.
• Marketing Data: Your preferences in receiving marketing communications from us and our third parties, and your communication preferences.

We do not knowingly collect any Special Categories of Personal Data (such as details about race, ethnicity, religious beliefs, health data, or biometric data) unless specifically required for identity verification purposes with your explicit consent.

4. International Transfers

4.1 Data may be transferred to and processed in AWS EU (Frankfurt) regions under the protection of EU Standard Contractual Clauses (SCCs). These contractual safeguards ensure that your data receives an adequate level of protection consistent with GDPR requirements, even when processed outside your country of residence.

4.2 Enterprise customers may request localized data residency options to comply with specific regulatory requirements applicable to their industry or region. Additional fees may apply for custom data residency solutions.

4.3 We have implemented appropriate technical and organizational measures to ensure that transfers of personal data outside the EEA, Kenya, or your country of residence are subject to appropriate safeguards. These include:

• Encryption during transit and at rest
• Regular security assessments of third-party service providers
• Contractual commitments from service providers regarding data protection
• Limiting data access to authorized personnel only

5. Data Subject Rights

Under applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access (Article 15 GDPR): You have the right to request copies of your personal data that we hold. We may require identity verification before fulfilling such requests.
• Right to Rectification (Article 16 GDPR): You have the right to request correction of any inaccurate or incomplete personal data that we hold about you.
• Right to Erasure (Article 17 GDPR): You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to Restriction of Processing (Article 18 GDPR): You have the right to request a restriction on the processing of your personal data in certain situations, such as when you contest the accuracy of the data.
• Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit this data to another controller without hindrance from us.
• Right to Object (Article 21 GDPR): You have the right to object to processing of your personal data that is based on our legitimate interests. We will cease such processing unless we demonstrate compelling legitimate grounds that override your interests.
• Rights Related to Automated Decision Making (Article 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on your consent before its withdrawal.

To exercise any of these rights, please submit your request to privacy@netbill.app. We will respond to your request within 30 calendar days. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests received.

Please note: While we will make every effort to accommodate your request, there may be circumstances where we are legally entitled or required to continue processing your data despite your request. In such cases, we will explain our decision in our response to you.

6. Security Measures

Protecting your personal data is of paramount importance to us. We have implemented comprehensive security measures to prevent unauthorized access, use, or disclosure of your information. These measures include:

• ISO 27001-certified infrastructure: Our systems adhere to internationally recognized standards for information security management systems.
• AES-256 encryption: We employ industry-leading encryption standards for data both at rest and in transit. This ensures that your sensitive information remains protected throughout its lifecycle in our systems.
• Annual penetration testing: We conduct regular security assessments by independent third-party security experts to identify and address potential vulnerabilities in our systems.
• Role-based access controls (RBAC): We restrict access to personal data to authorized personnel on a need-to-know basis, with robust authentication mechanisms in place.
• Continuous monitoring: Our security team employs 24/7 monitoring systems to detect and respond to suspicious activities or potential security incidents.
• Regular security training: All employees undergo mandatory security awareness training and must adhere to our comprehensive data protection policies.
• Disaster recovery and business continuity plans: We maintain robust backup and recovery procedures to ensure data availability in the event of system failures or other disruptions.

While we implement these safeguards to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We continuously evaluate and enhance our security measures as technology evolves and new threats emerge. We encourage you to help us maintain the security of your account by using strong, unique passwords and keeping your login credentials confidential.

7. Third Party Processors

To provide our services effectively, we engage trusted third-party service providers who may process your personal data on our behalf. All third-party processors are contractually obligated to process data in accordance with our instructions and in compliance with applicable data protection laws. These third parties include:

• Payment Processors: Stripe, MPesa, and other financial institutions that process payments on our behalf. These entities only receive the information necessary to process your transactions and are prohibited from using your personal data for any other purposes.
• Cloud Providers: Contabo and AWS, who provide the infrastructure on which our services operate. These providers meet stringent security and compliance requirements.
• Analytics Providers: Google Analytics (with IP anonymization enabled) to help us understand how our services are used. We configure these services to respect your privacy and minimize data collection.
• Customer Support Tools: Platforms that help us provide responsive customer service and technical support.
• Email Service Providers: Services that help us deliver transactional emails and, with your consent, marketing communications.
• Monitoring and Error Tracking: Services that help us identify and fix technical issues to improve platform stability and performance.

We carefully select our third-party processors based on their data security practices and compliance commitments. A comprehensive list of our sub-processors is available upon request as part of our Data Processing Agreement (DPA). We regularly review our third-party relationships to ensure continued compliance with our data protection standards.

8. Breach Notification

In the unlikely event of a personal data breach that may pose a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and other applicable laws.
• Inform affected users without undue delay, providing information about the nature of the breach, likely consequences, and measures taken or proposed to address the breach and mitigate potential adverse effects.
• Document all breaches, including facts, effects, and remedial actions taken, to comply with our accountability obligations.
• Conduct a thorough investigation to identify the cause of the breach and implement measures to prevent similar incidents in the future.

Our breach notification process is designed to provide timely, transparent, and actionable information in the event of a security incident affecting your personal data. We maintain a dedicated incident response team that is trained to handle data breaches efficiently and in compliance with regulatory requirements.

9. Retention Period

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Different retention periods apply to different types of data, depending on their purpose and relevance:

• Account information: Retained for the duration of your account with us, and for a period of up to 24 months after account closure for legal compliance and business continuity purposes.
• Financial records: Retained for a minimum of 7 years to comply with tax and accounting requirements.
• Marketing preferences: Retained until you withdraw your consent or opt out of marketing communications.
• Communication records: Retained for up to 36 months to ensure continuity of service and address recurring issues.
• Technical logs: Retained for up to 90 days for security and performance monitoring purposes.

We regularly review our retention policies to ensure that we do not keep data for longer than necessary. When personal data is no longer needed, we securely delete or anonymize it in accordance with our data disposal procedures.

10. Children's Privacy

Our services are not intended for use by individuals under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from Children. If you are a parent or guardian and you believe that your child has provided us with personal data, please contact us immediately. If we become aware that we have collected personal data from Children without verification of parental consent, we will take steps to remove that information from our servers.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website and platform. These technologies help us deliver essential features, analyze usage patterns, and personalize content.

We categorize cookies as follows:

• Essential cookies: Required for the operation of our services. These cookies enable core functionality such as security, network management, and account authentication. You cannot opt out of these cookies.
• Analytical/Performance cookies: Allow us to recognize and count the number of visitors and see how visitors move around our website. This helps us improve the way our website works.
• Functionality cookies: Used to recognize you when you return to our website. This enables us to personalize our content for you and remember your preferences.
• Targeting cookies: Record your visit to our website, the pages you have visited, and the links you have followed. We may use this information to make our website and the advertising displayed on it more relevant to your interests.

You can control cookies through your browser settings and other tools. Please note that blocking some types of cookies may impact your experience of our services. For detailed information about the cookies we use and how to manage them, please refer to our Cookie Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

For significant changes that materially affect your rights or how we use your personal data, we will provide more prominent notice, such as sending you an email notification. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Your continued use of our services following the posting of changes to this Privacy Policy will constitute your acknowledgment and acceptance of those changes.

13. Dispute Resolution

If you have concerns about our data practices or the exercise of your rights, we encourage you to contact us directly first. We are committed to resolving complaints about your privacy and our collection or use of your personal data.

If you believe that we have not adequately addressed your concerns, you have the right to:

• Lodge a complaint with a supervisory authority, particularly in the European Union member state where you work, reside, or where an alleged infringement occurred.
• File a complaint with the Data Commissioner's Office in Kenya under the Data Protection Act 2019.
• Seek other remedies available under applicable data protection laws.

We are committed to cooperating with the appropriate regulatory authorities to resolve any complaints regarding the transfer of personal data that cannot be resolved between us directly.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer at:

Email: privacy@netbill.app
Phone: +254111460483

We strive to respond to all inquiries within 48 business hours. For urgent privacy-related matters, please indicate "URGENT" in your email subject line.