Privacy Notice

1. Who we are

Netinfosec Solutions Limited ("we") is the data controller for the personal data described here. Contact us at info@netinfosec.co.ke, P.O. Box 67679-00200, City Square, Nairobi, Kenya, office: Kasarani, Nairobi County, Kenya.

2. What we collect

• Contact details: your name, company, phone number and email address.
• Delivery details: delivery address and town.
• Order details: what you bought, prices, and the payment method. If you pay by M-Pesa we record the transaction code you give us. We never ask for or store M-Pesa PINs or card numbers.
• Account details: your password, stored only in scrambled (hashed) form, and when you agreed to these terms.
• Messages: what you tell us in quotation and support requests.
• Technical data: your IP address, used to protect the site against abuse, and one essential cookie that keeps your cart and sign-in working.

3. Why we use it, and the lawful basis

• To process, deliver and support your orders, and run your account: necessary to perform our contract with you.
• To keep invoices and sales records: required by Kenyan tax law.
• To keep the site and your account secure and prevent fraud: our legitimate interests.
• Anything else: only with your consent, which you can withdraw at any time.

We do not sell your data and we do not send marketing messages unless you separately agree to receive them.

4. Who we share it with

• Couriers and delivery riders: your name, phone and delivery address, only to deliver your order.
• Safaricom (M-Pesa) when you choose to pay by M-Pesa.
• Our website hosting provider, which stores the data on our behalf. Its servers may be outside Kenya; where data leaves Kenya we rely on the safeguards the Act requires.
• Government authorities, only where the law requires us to.

5. How long we keep it

• Orders, invoices and payment records: for as long as tax law requires (currently at least five years).
• Your account: while it is open. When you ask us to delete it, we erase it except for records the law makes us keep.
• Quotation and support requests: up to two years.
• Security logs: up to twelve months.

6. Your rights

Under section 26 of the Data Protection Act, 2019 you have the right to be told how your data is used, to access it, to object to its use, to have wrong or misleading data corrected, and to have it deleted. You may also ask for a copy in a portable format and withdraw consent at any time.

Signed-in customers can update their details, download their data and ask for deletion from My account. Otherwise email info@netinfosec.co.ke. We respond within the time limits set by the Data Protection (General) Regulations, 2021.

7. How we protect it

The site uses encrypted connections (HTTPS), passwords are hashed, and only staff who need your data to serve you can see it.

8. Children

Our shop is meant for adults and businesses. We do not knowingly collect data from children.

9. Complaints

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

10. Changes

When this notice changes we update the version date above and, where the change matters, ask for your agreement again at your next order.