Privacy Policy

This policy explains what personal data 4K Net Billing handles and why. It covers ISPs who use the platform and their customers (people who buy internet from those ISPs). We follow Kenya's Data Protection Act, 2019.

Who is responsible

Each ISP is the data controller for its own customers' data; 4K Net Billing processes that data on the ISP's behalf. For ISP account data (your name, email, phone and business details), we are the controller.

What we collect

• ISP staff: name, email, phone, username and sign-in activity.
• Customers: name, phone, email (optional), address (optional), plan, payments and receipts, support tickets, and the logins used on the network.
• Network usage: session start and end times, data used, device MAC and IP addresses, as reported by the ISP's routers. This is needed to provide and bill the service.
• Hotspot visitors: device MAC address and phone number when buying a package or claiming a free trial.

Why we use it

• To provide internet service and billing: activating plans, taking M-Pesa payments, sending receipts and expiry reminders, and handling support.
• To keep the service secure and working: detecting abuse, outages and fraud.
• To meet legal duties, such as keeping financial records.

We don't sell personal data and don't use it for advertising.

Who it's shared with

• Safaricom (M-Pesa) to take payments, and the SMS provider to deliver messages.
• Our hosting provider, which stores the data on our behalf.
• Authorities, only when the law requires it.

How long we keep it

Account and payment records are kept while the account is active and for up to 7 years afterwards for tax and accounting purposes. Session and usage records are kept for 12 months. ISPs can ask us to delete their customers' data sooner where the law allows.

Your rights

You can ask to see, correct or delete your personal data, or object to how it's used. Customers should contact their ISP first; ISPs and anyone else can contact us at the address below. You can also complain to the Office of the Data Protection Commissioner.

Security

Data is sent over encrypted connections. Passwords are stored hashed, payment and SMS credentials are encrypted, and access is limited to each ISP's own staff.