Privacy notice (draft)
What personal information MBEE Technologies collects, why we collect it, who sees it, and the choices and rights you have.
This page is a working draft written to describe how MBEE Technologies intends to operate. It has not yet been reviewed or approved by a qualified Kenyan lawyer and must be before launch. Items that need verification are listed at the end.
Who we are
MBEE Technologies, an independent Kenyan technology company. Legal entity name and registration details are to be inserted when confirmed.
What we collect
- Orders: your name, mobile number, optional email, business details, products and prices you provide, branding and images you upload, and domain registrant details.
- Quote and contact requests: the details you type in the form, including your organisation and project description.
- Payments: amounts, references and status. We do not store card numbers. M-Pesa references you give us are recorded and verified.
- Technical data: limited server logs to keep the service secure. We avoid putting personal data in logs.
Why we use it
- To build, host and support your website and to deliver custom projects.
- To verify payments and issue invoices.
- To respond to your enquiries.
- To send promotional messages only if you separately opt in. The box is never pre-ticked.
Who sees it
Only staff who need it, according to their role. Customers can only see their own orders. Domain registries and payment or messaging providers receive only what they need to do their part.
How long we keep it
Retention periods are to be confirmed. Our intention is to keep order and financial records for the period the law requires and to delete unneeded personal data.
Your rights
You can ask to see, correct or delete your personal data, to withdraw consent for promotional messages and to object to processing. Contact us and we will respond.
To verify with counsel before launch
- Registration as a data controller/processor with the Office of the Data Protection Commissioner and any ongoing obligations.
- Retention periods and lawful bases under the Data Protection Act, 2019.
- Wording for cross-border processing if hosting or tools are outside Kenya.
- Rules for electronic marketing messages and consent records.
- Child data, if any site we build collects it.