Privacy notice

How Wavu handles personal data under Kenya's Data Protection Act, 2019 and its regulations.

1. Two roles

• Operators' customers (people who buy WiFi). Each operator is the data controller for its own customers. Wavu is the operator's data processor: we process this data only to run the operator's hotspot, on the operator's instructions, and never sell it or use it for our own marketing.
• Operators and their staff (people who use the console). For account data Wavu is the data controller.

2. What we process for operators (as processor)

• Phone numbers used to pay by M-Pesa, and M-Pesa receipt numbers and amounts.
• Device MAC addresses and the IP addresses the hotspot gives them.
• Packages bought, login times, data used and session times.
• Phone numbers a voucher or receipt is sent to by SMS.

Purpose: let customers buy and use internet packages, prevent abuse (device limits, rate limits), recover access after a phone changes its MAC address, and give the operator sales reports. We don't collect names, browsing history or the sites customers visit.

3. What we process about operators (as controller)

• Business name, owner and staff names, emails and phone numbers, password hashes.
• Router details, M-Pesa (Daraja) credentials, which we store encrypted.
• Wavu bills and payments, sign-in times and IP addresses, and an audit log of changes.

Purpose: provide and bill the service, keep it secure, and give support. Legal basis: performance of our contract with you, our legal obligations, and our legitimate interest in keeping the service secure.

4. Who else handles the data (sub-processors)

• Google Cloud (servers in Belgium, region europe-west1).
• Supabase (database, hosted in the European Union).
• Safaricom (M-Pesa payments through the operator's own Daraja app).
• Africa's Talking (SMS receipts and alerts), when SMS is turned on.

Data is stored outside Kenya, in the European Union, which has data protection at least equal to Kenya's. [Transfer safeguards under sections 48–50 of the Act, and any ODPC registration of Corelabz Technologies as controller/processor, to be confirmed by counsel.]

5. How long we keep it

• Payment records: as long as the operator's account exists plus 7 years, for tax and accounting. [Confirm period.]
• Session and usage records: [12 months], then deleted or anonymised.
• When an operator leaves, we export their data on request and delete it within [90 days], except what the law requires us to keep.

6. Security

Encrypted connections everywhere, secrets encrypted at rest, each operator's data separated from every other operator's, staff access limited and logged. We tell affected operators, and the Data Commissioner where required, about a personal data breach within 72 hours of becoming aware of it.

7. Your rights

You can ask to see, correct, delete or move your personal data, or object to how it is used. Hotspot customers should ask the operator whose WiFi they used; we help the operator answer. Operators and staff can write to [privacy contact email]. You can also complain to the Office of the Data Protection Commissioner (odpc.go.ke).