Privacy Policy
Last updated: 6 October 2026
1. Who we are
This policy covers nairohost.site and the client area at clients.hostingke.co.ke. In this policy "we", "our" and "us" mean Edgecom Web Solutions, trading as NairoHost.
config/business.php, and shown as a placeholder
wherever it would otherwise appear:
[company registration number]
[registered street address]
2. What we collect
2.1 When you buy a service
Ordering hosting or a domain requires:
- Full name
- Email address
- Phone number — needed for the M-Pesa STK push and for account recovery
- Physical or postal address — required by domain registries for registrant records
- Company name, where you are buying as a business
- KRA PIN, where a tax invoice is required
We never see or store your full card details or your M-Pesa PIN. Payments are completed by the payment provider, and we receive only a reference and the result.
2.2 When you contact us
The contact form collects your name, email address, the department you have chosen, a subject and your message. The phone number field is optional and is only there so we can call you back if you would rather we did. We use these details to answer your enquiry. We do not add you to a mailing list from a contact form.
2.3 Automatically
Our web server records the IP address, browser, referring page and time of each request, as almost every web server does. These logs are used to keep the service running and to investigate abuse. If — and only if — you accept analytics cookies, Google Analytics also records which pages you view. See the cookies policy for the full list.
3. Why we use it, and on what basis
| What we do | Why | Basis |
|---|---|---|
| Provide hosting, domains and email | It is the service you bought. | Performance of a contract |
| Bill you and issue invoices | To take payment and meet Kenyan tax record-keeping rules. | Contract and legal obligation |
| Register domains with a registry | Registries require registrant contact details. Some publish them in WHOIS. | Contract |
| Answer support tickets and enquiries | To reply to you. | Contract, or your consent on the contact form |
| Send service notices — renewals, expiry, outages | You need to know before a service lapses. | Contract and legitimate interest |
| Send marketing email | Only if you have opted in. Every message carries an unsubscribe link. | Consent |
| Measure site usage | To see which pages are read. Off unless you accept it. | Consent |
| Detect and stop abuse | Spam, fraud and attacks against our servers or yours. | Legitimate interest |
4. Who we share it with
We do not sell your personal data and we do not share it for anyone else's advertising. These are the processors involved in running the service:
| Who | What they receive | Where |
|---|---|---|
| Safaricom PLC (M-Pesa) | Your phone number and the amount, for a payment you initiate. | Kenya |
| Domain registries and registrars | Registrant name, address, email and phone, as the registry requires. | Kenya and abroad, depending on the extension |
| Google Ireland Ltd — Analytics and Tag Manager | Pages viewed, approximate location, device. Only with your consent, with IP anonymisation on. | EU and United States |
| Google Ireland Ltd — Fonts | Your IP address, as part of requesting a font file. No cookie is set. | EU and United States |
| Our email provider | Your email address and the content of messages we send you. | See below |
| Our hosting and server providers | Everything stored in the service, by virtue of hosting it. | See below |
We will also disclose data where a Kenyan court or a competent authority lawfully requires it, and to a buyer if the business is ever sold — in which case this policy travels with it.
5. International transfers
Some of the processors above operate outside Kenya. Where data leaves Kenya we rely on the safeguards in sections 48 and 49 of the Data Protection Act, 2019 and on the transfer terms in each provider's own data processing agreement.
6. How long we keep it
- Account and service records: for as long as you have an active service with us.
- Invoices and payment records: seven years after the transaction, which is the Kenyan tax retention period.
- Support tickets and contact enquiries: two years after the last message.
- Server access logs: rolling, and overwritten as they age out.
- Analytics: for the retention window configured in Google Analytics.
7. Security
Traffic to this site and to the client area is encrypted with TLS. Credentials are hashed, sensitive fields are encrypted at rest, and administrative access is restricted and logged. No system is perfectly secure and we do not claim otherwise. If a breach affects your data we will notify you and the Office of the Data Protection Commissioner as the Act requires.
8. Your rights
Under the Kenya Data Protection Act, 2019 you have the right to:
- be told how your data is used — which is what this page is for;
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have data deleted, where we are not required to keep it;
- object to processing, including direct marketing;
- ask us to restrict processing while a dispute is resolved;
- receive your data in a portable format;
- withdraw consent at any time, without affecting what was done before you withdrew it.
To exercise any of these, email privacy@nairohost.site. We respond within 30 days. If you are not satisfied you can complain to the Office of the Data Protection Commissioner, Kenya.
9. Cookies
Every cookie this site sets is listed, with its purpose and lifetime, in the cookies policy. Nothing beyond what is strictly necessary runs before you accept it, and you can change your choice at any time.
10. Children
Our services are sold to businesses and to adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.
11. Changes
We update this page when what we do changes, and the date at the top changes with it. A material change is emailed to account holders.
12. Contact
Data controller:
Edgecom Web Solutions [registration number to be confirmed]
Email: privacy@nairohost.site
Phone: +254 796 358 081
Address:
Nairobi, Kenya [street address to be confirmed]
Data protection officer:
[to be appointed / named] —
reach data protection at
privacy@nairohost.site