Last updated
This policy explains what personal data 247.ke handles, why, who we share it with and your rights under Kenya's Data Protection Act, 2019. It covers this website, our sign-up page and the billing systems we host for internet service providers (ISPs).
Short version: we collect what we need to run billing, we never sell data, and there are no advertising or tracking cookies.
1.Who is responsible
We act in two roles:
- For ISPs who sign up with us, 247.ke is the data controller. We decide how your account information is used.
- For an ISP's own customers (people who buy hotspot packages or PPPoE plans), the ISP is the data controller and 247.ke is the data processor. We handle that data only to run the ISP's billing system, on the ISP's instructions.
If you are a customer of an ISP that uses 247.ke, contact your ISP first about your data. We will help them answer you.
2.Data we collect from ISPs
- Sign-up details: business name, your name, M-Pesa phone number, the bank and account that receive your customers' payments, your chosen system address and plan, and any referral code.
- Subscription payments: M-Pesa transaction codes, amounts and dates.
- Account activity: admin logins, settings changes and logs we keep for security.
- Router and system information: router names, models, online status and VPN addresses, and system health reports such as version and router count.
- Support conversations: calls, WhatsApp messages and screenshots you send us.
3.Data in ISP billing systems
To bill and connect customers, an ISP's system holds:
- names, phone numbers, usernames and account numbers;
- packages bought, expiry times and wallet balances;
- M-Pesa payment records (transaction code, amount, time and the phone number or its masked form);
- device MAC and IP addresses, session times and data usage, needed to connect the right device and enforce packages;
- messages sent through the support chat on the captive portal.
4.Why we use it
| Purpose | Legal basis |
|---|---|
| Creating and running your billing system, including activating customers after they pay | Contract |
| Taking subscription payments and sending renewal reminders and login details by SMS | Contract |
| Support, fixing faults and keeping routers connected | Contract and legitimate interest |
| Security, preventing fraud and abuse, keeping logs | Legitimate interest |
| Keeping financial records | Legal obligation |
We do not use your data, or your customers' data, for advertising, and we do not sell it.
5.Who we share it with
We share only what each service needs to do its job:
- Safaricom (M-Pesa) and the banks you choose, to process payments;
- SMS providers, to deliver text messages;
- hosting and network providers, including cloud servers run by DigitalOcean and Cloudflare's network for security and speed;
- Google Fonts, which serves the fonts on this website, so your browser connects to Google's servers;
- authorities, when Kenyan law requires it.
6.Data stored outside Kenya
Some of our providers store or process data on servers outside Kenya. When this happens, we use providers with strong security and contractual protections, as the Data Protection Act, 2019 requires.
7.How long we keep it
- Account data is kept while your account is active, and for a reasonable time after it closes so you can come back or ask for a copy.
- Payment and financial records are kept for as long as Kenyan tax law requires.
- Security logs and backups are kept for a limited time and then overwritten.
- An ISP decides how long its customers' records are kept, within the limits of the system.
8.Keeping it safe
Connections to our sites use HTTPS. Routers connect to billing over an encrypted WireGuard VPN, and access to servers and data is limited to people who need it. We take regular backups. No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Commissioner as the law requires.
9.Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your data is used (this policy);
- see the data we hold about you;
- correct data that is wrong;
- ask us to delete data, unless we must keep it by law;
- object to some uses, and get your data in a portable format.
To use these rights, contact us on 0738 513 555 (call or WhatsApp). We may ask you to confirm who you are. If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
10.Cookies
We use no advertising or tracking cookies, and no analytics on this website.
| Name | Where | Why | How long |
|---|---|---|---|
cookie_consent | 247.ke | Remembers your choice on the cookie notice | 1 year |
| Session cookie | Sign-up and admin pages | Keeps you logged in and protects forms | Until you log out or close the browser |
| Device and login data | An ISP's captive portal | Reconnects a customer's device to the package they paid for | Set by the ISP's package |
These are all essential to how the service works. Choosing "Essential only" or "Accept" on the notice keeps the same essential cookies. You can open the notice again at any time with Cookie settings at the bottom of every page.
11.Children
Our service is for businesses and is not aimed at children. ISPs are responsible for following the law if their own customers include minors.
12.Changes to this policy
We will update this policy when how we handle data changes. The date at the top shows the latest version. For important changes, we will tell ISPs in advance.
13.Contact
247.ke, Kisumu, Kenya. For privacy questions or requests: 0738 513 555 (call or WhatsApp). See also our contact page.