Privacy policy

This privacy policy explains how Purple Cloud Ltd ("Purple Cloud", "we", "us", "our"), which manages and operates Purple Router Kenya, collects, uses, shares and protects personal data. It is written to meet the Kenya Data Protection Act, 2019 and its regulations. Each section starts with a short summary marked “In short”. The summaries are only a guide; the full text of each section is what applies. This policy should be read together with our terms of service.

1. Who we are and our role

In short: we control a few account records. For your customers’ data, you are in charge and we only process it for you.

• As a data controller, we decide how to use the account records listed in section 2, about the internet service providers ("ISPs") that use Purple Router and their admin contacts, and the limited data we collect from website visitors and people who contact us.
• As a data processor, we process personal data about an ISP’s own customers ("Subscribers") only on behalf of that ISP and on its instructions, to provide the service. The ISP is the data controller for that data. It is responsible for having a lawful basis to collect it and for informing its Subscribers.
• If you are a Subscriber of an ISP that uses Purple Router, please contact your ISP. We do not deal with Subscribers directly; where the law requires, we will pass your request to your ISP and help it respond.

2. What we keep

In short: only the records we need to run your account and bill you.

Purple Router is software as a service (SaaS), charged per router. We keep only:

• The account owner: the ISP that owns the account, and its admin contact person (name, email and phone number).
• Company details: the company name and the business details you give us.
• Router licences: which routers are licensed on your account, both active and expired.
• Payments you pay us: only the payments your ISP makes to Purple Cloud Ltd for Purple Router, meaning your router licence fees, with amounts, dates, receipts and invoices. We do not keep records of the payments your customers make to you.

Our website also keeps basic server logs, such as IP address, browser and pages visited, for a limited time for security, and anything you choose to send us by email or form.

3. What is protected

In short: everything else is locked behind two-factor authentication and end-to-end encryption.

All other details are protected behind two-factor authentication (email and SMS) and end-to-end encryption. This includes your Subscribers’ details, their accounts and plans, the payments they make to you, their messages, your routers and network data, and all other data in your account. It is stored and transmitted only in encrypted form, to provide the service to you.

Because this data is end-to-end encrypted, keeping access to your account, your email and your two-factor phone is your responsibility. If that access is lost, we may not be able to recover the data.

4. How we use the records we keep

• To create and run your account, and to let your admins sign in securely.
• To license and bill your routers, and keep accounting and tax records.
• To give support and send service messages, such as security alerts, invoices and changes to our terms.
• To keep the service secure, prevent fraud and misuse, and investigate problems.
• To send product updates to your admin contact. You can opt out of marketing at any time. Service messages needed to run your account will still be sent.
• To meet our legal duties and protect our rights.

We do not sell personal data. We do not use Subscriber data for our own marketing.

5. Our lawful bases

• Contract: to provide the service you signed up for and bill you.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.
• Legitimate interests: to secure the service, prevent fraud and improve the service, in ways that do not override your rights.
• Consent: where we ask for it, for example for optional marketing. You can withdraw consent at any time.
• Your instructions as controller: for Subscriber data we process on your behalf.

6. Who we share data with

In short: only with the providers that help run the service, your chosen payment and SMS providers, and authorities when the law requires.

• Service providers that help us run Purple Router, such as hosting, email and SMS delivery providers, under contracts that require them to protect the data and use it only for us.
• Payment and SMS providers that you choose, such as Safaricom, banks and SMS providers, to complete payments and send messages under their own terms and privacy policies.
• Authorities, courts or regulators where the law requires it, or where needed to protect our rights, our users or the public.
• A buyer or successor if our business is reorganised, merged or sold, subject to this policy.

7. Payments

In short: the only payments we keep are the ones you pay us.

• Payments you pay us. When your ISP pays Purple Cloud Ltd for Purple Router (your router licence fees), we keep the amount, date, receipt and invoice. We need these for billing, tax and accounting.
• Payments your customers pay you. Your customers pay you, the ISP, through M-Pesa, Safaricom Daraja or your bank, and the money settles to you. We never receive or hold that money, and we do not keep those payment records. Any details needed to match those payments in your account are protected behind two-factor authentication and end-to-end encryption.

8. Transfers outside Kenya

Some service providers may store or process data outside Kenya. When this happens, we transfer data only as allowed by the Kenya Data Protection Act, 2019, with appropriate safeguards. ISPs on Enterprise can choose to self-host Purple Router on their own servers.

9. Security, and your part

In short: we protect the service; you protect your logins.

All data other than the records in section 2 is protected behind two-factor authentication (email and SMS) and end-to-end encryption. We also use access controls, secure tunnels to routers, an audit log of actions, and backups. No system is completely secure, so we cannot guarantee absolute security.

You must keep two-factor authentication switched on, keep your email and phone secure, give each staff member their own login, and remove access when people leave. We are not responsible for loss caused by a failure to do so.

9A. Misuse, attacks and evidence

To protect Purple Router, our customers and the public, we monitor the service for security threats. If an account or person tries to copy, clone, attack or harm the service, we may keep and use the relevant logs and account records as evidence, suspend the account, and share that information with our legal advisers, the courts, the police and other authorities, as allowed by the Kenya Data Protection Act, 2019 and other laws.

10. If something goes wrong

If a personal data breach is likely to put people at risk, we will notify the Office of the Data Protection Commissioner within 72 hours where the law requires, and inform the affected ISP without undue delay so it can meet its own duties.

11. How long we keep data

• Account records (account owner, company details, router licences): while your account is active, and afterwards for as long as needed for legal, tax, accounting and dispute purposes.
• Payments you pay us (router licence fees): for as long as tax and accounting laws require.
• Encrypted account data: while your account is active. After it closes, you may request an export within 30 days. After that, we may delete it, unless the law requires us to keep it.
• Server logs: for a limited period needed for security and troubleshooting.

12. Your rights

In short: you can ask to see, correct or delete your data.

Under the Kenya Data Protection Act, 2019 you have the right to be informed, to access your data, to correct it, to have it deleted, to object to or restrict its processing, and to data portability, subject to the limits in the law. To use your rights, email support@purplerouter.com. We will need to verify your identity first, and we may refuse requests that are unfounded, excessive or not allowed by law. Subscribers should contact their ISP first, as the ISP controls their data.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner of Kenya.

13. Cookies

Our website and dashboard use cookies and similar storage that are needed for them to work, such as keeping you signed in and remembering simple settings. We do not use advertising cookies. If we add analytics, we will update this policy first.

14. Children

Purple Router is a business service and is not meant for children. We do not knowingly collect children’s data for our own purposes.

15. Changes to this policy

We may update this policy. We will post the new version on this page with a new date and, for material changes, tell the account owner by email or in the dashboard.

16. Contact us

Purple Cloud Ltd, which manages Purple Router Kenya. Email support@purplerouter.com.