Privacy Policy

1. Data we collect

We collect data you give us directly and data generated by your use of our services:

• Account data: name, email address, phone number, password (bcrypt-hashed — we never store plain-text passwords).
• Billing data: billing address, payment method reference. Card details are handled entirely by Paystack and M-Pesa — we never see or store raw card numbers or PINs.
• Usage data: pages visited, features used, browser type, approximate location (country/city level only).
• Communications: emails and messages you send us via our contact form or support channels.
• Service data: domain names registered, hosting plans purchased, order history.

We do not log raw payment credentials, PIN entries, or M-Pesa transaction PINs. Internal system logs contain only hashed identifiers — never raw email addresses or phone numbers.

2. How we use your data

• To provision and manage the services you purchase.
• To process payments and send receipts.
• To send service-related notifications (renewal reminders, downtime alerts).
• To respond to support requests and enquiries.
• To improve our products and detect security threats.
• To comply with legal obligations (tax records, regulatory requirements).

We do not sell your personal data. We do not use your data for advertising on third-party platforms.

3. Data sharing

We share your data only where necessary to deliver services:

• Paystack — payment processing (Paystack's privacy policy applies to card data).
• Safaricom / M-Pesa — M-Pesa payment processing.
• WHMCS — hosting and VPS provisioning (our reseller platform).
• Resellerclub / Logicboxes — domain registration (WHOIS data required by ICANN).
• SMTP provider — to send transactional emails.

We do not share data with data brokers, advertising networks, or any parties beyond the above.

4. Data retention

• Account data: retained while your account is active, plus 3 years after closure (for legal/tax compliance).
• Order and payment records: 7 years (Kenya tax law requirement).
• Support communications: 2 years.
• System logs: 90 days, then automatically purged.

5. Your rights (KDPA)

Under the Kenya Data Protection Act 2019, you have the right to:

• Access — request a copy of your personal data.
• Correction — request we correct inaccurate data.
• Deletion — request deletion of your data (subject to legal retention obligations).
• Objection — object to processing of your data for specific purposes.
• Portability — receive your data in a machine-readable format.

To exercise any right, email privacy@favourhost.com. We will respond within 21 days as required by the KDPA.

6. Cookies

We use strictly necessary cookies only: a session cookie to keep you logged in, and a cart cookie to persist your cart between visits. We do not use advertising or tracking cookies. No third-party analytics scripts are loaded without your consent.

7. Security

All data is transmitted over TLS (HTTPS). Passwords are hashed with bcrypt (cost factor 12). Payment credentials are never stored on our servers. We conduct regular security reviews and maintain audit logs of data access. In the event of a breach affecting your personal data, we will notify you and the Office of the Data Protection Commissioner within 72 hours.

8. Changes to this policy

We may update this policy periodically. Material changes will be communicated by email to registered users at least 14 days before they take effect. The "last updated" date at the top of this page always reflects the most recent revision.

9. Contact

For privacy-related queries or to exercise your rights:
Data Controller: Ellatech Solutions
Email: privacy@favourhost.com
Address: Nairobi, Kenya