This Privacy Policy explains how TalkSasa Ltd collects, uses, stores, protects, and discloses personal data in compliance with the Kenya Data Protection Act No. 24 of 2019, the Kenya Information and Communications Act, and all applicable regulations. By using any TalkSasa service, you consent to the practices described in this Policy.

1. Who We Are

TalkSasa Ltd ("TalkSasa," "We," "Us") is a technology company registered in Kenya providing Bulk SMS, Sender ID Registration, Domain Registration, Web Hosting, and Email Hosting services. We are a data controller in respect of personal data collected from our clients and website visitors.

Data Controller Contact:
Email: info@talksasa.com
Phone: +254 712 295 880 | +254 781 000 403
Website: www.talksasa.com

2. Personal Data We Collect

2.1 Data You Provide Directly

When you register, purchase a service, or contact us, we may collect:

Full name and identity information.
Business name and registration details.
Email address, phone number, and physical/postal address.
Payment information (processed securely; TalkSasa does not store full card numbers).
Domain registrant/WHOIS details (name, address, email, phone — as required by ICANN/KENIC).
Sender ID registration details including business registration documents and use-case declarations.
Content and data uploaded to hosting accounts.

2.2 Data Collected Automatically

When you visit our website, we automatically collect:

IP address and browser type.
Pages visited, time spent, and referring URLs.
Cookies and similar tracking data (see Section 9).

2.3 Data from Third Parties

We may receive data about you from payment processors, domain registries, or mobile network operators in the course of providing Services.

3. How We Use Your Data

We process your personal data strictly for the following purposes:

To provision, manage, and maintain the Services you have subscribed to.
To communicate service updates, renewal notices, invoices, and support information.
To comply with domain registration requirements of ICANN, KENIC, and other registries (WHOIS publication).
To process payments and prevent fraud.
To comply with legal obligations, including requests from law enforcement and regulatory authorities.
To enforce our Terms and Conditions.
To improve our services and website experience.

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

4. Legal Basis for Processing

Under the Kenya Data Protection Act 2019, our processing is based on:

Contract Performance: Processing necessary to deliver the Services you have purchased.
Legal Obligation: Processing required to comply with Kenyan law, court orders, or regulatory requirements.
Legitimate Interests: Processing to detect fraud, enforce our Terms, and maintain service security.
Consent: Where we rely on your consent (e.g., marketing communications), you may withdraw consent at any time.

5. Disclosure of Your Data

5.1 Third-Party Service Providers

We share your data with trusted third parties solely to provide our Services, including:

Domain registries (ICANN-accredited, KENIC) — for domain registration and WHOIS publication.
Mobile network operators — for Sender ID registration and SMS delivery.
Payment processors — for secure transaction processing.
Hosting infrastructure providers — for data center and server operations.

All third-party providers are contractually required to handle your data in compliance with applicable data protection laws.

5.2 Legal and Regulatory Disclosure

TalkSasa will disclose Client data to government authorities, law enforcement, courts, or regulatory bodies when:

Required by a valid court order, subpoena, or legal process under Kenyan law.
Required by the Communications Authority of Kenya or other competent authority.
Necessary to prevent, detect, or investigate fraud or illegal activity.
Required to protect the rights, safety, or property of TalkSasa or third parties.

TalkSasa is legally obligated to comply with valid legal orders and will do so without prior notice to the Client where the law so permits.

5.3 Business Transfers

In the event of a merger, acquisition, or asset sale, your personal data may be transferred as part of the transaction. We will notify you by email or a prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.

6. Domain WHOIS Data — Special Notice

6.1 Domain registration requires the publication of registrant contact details in publicly accessible WHOIS databases maintained by ICANN, KENIC, or other registries. By registering a domain through TalkSasa, you acknowledge and consent to this mandatory publication.

6.2 Where available, WHOIS privacy/proxy services may be offered. These are subject to the policies of the relevant registry and are not guaranteed.

6.3 TalkSasa is not liable for any consequences arising from the public disclosure of WHOIS data as required by registry policies.

7. Data Retention

We retain your personal data for as long as necessary to provide the Services and fulfill the purposes in this Policy, subject to the following:

Account data is retained for the duration of your active account plus a minimum of 5 years after account closure, for legal and audit purposes.
Transaction and billing records are retained for a minimum of 7 years in compliance with Kenyan tax and financial regulations.
SMS logs and message metadata may be retained for up to 1 year for compliance and audit purposes.
Hosting account data is purged 7 days after account suspension due to non-renewal, as stated in our Terms and Conditions.

After the applicable retention period, data is securely deleted or anonymized.

8. Data Security

TalkSasa implements appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

Encryption of sensitive data in transit and at rest.
Access controls and authentication protocols for staff accessing client data.
Regular security assessments of our infrastructure.
Secure payment processing via PCI-DSS compliant payment gateways.

No method of electronic transmission or storage is 100% secure. While we take reasonable precautions, TalkSasa cannot guarantee absolute security. You transmit data to us at your own risk.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to improve your experience. Cookies we use include:

Essential Cookies: Necessary for the website to function. Cannot be disabled.
Analytics Cookies: Help us understand how visitors interact with our website (e.g., Google Analytics). These are anonymized.
Preference Cookies: Remember your settings and preferences.

You can control cookies through your browser settings. Disabling certain cookies may impact website functionality. By continuing to use our website, you consent to our use of cookies as described in this Policy.

10. Your Data Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

Right of Access: To request a copy of the personal data we hold about you.
Right to Rectification: To request correction of inaccurate or incomplete data.
Right to Erasure: To request deletion of your data, subject to legal retention obligations.
Right to Restrict Processing: To request that we limit how we use your data.
Right to Data Portability: To receive your data in a structured, machine-readable format.
Right to Object: To object to processing based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time without affecting prior processing.

To exercise any of these rights, submit a written request to info@talksasa.com. We will respond within 21 days. We may require identity verification before processing requests.

11. Children's Privacy

TalkSasa Services are not directed at or intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly. If you believe a minor has submitted data to us, please contact us immediately at info@talksasa.com.

12. Third-Party Links and Services

Our website may contain links to third-party websites or services. TalkSasa is not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Privacy Policy

TalkSasa reserves the right to update or modify this Privacy Policy at any time. Changes will be posted on our website at www.talksasa.com with a revised effective date. Your continued use of our Services after any changes constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

14. Complaints and Regulatory Authority

If you believe your data protection rights have been violated, you may lodge a complaint with:

TalkSasa directly at info@talksasa.com — we will endeavor to resolve complaints within 21 business days.
The Office of the Data Protection Commissioner (ODPC), Kenya — the supervisory authority for data protection in Kenya (www.odpc.go.ke).

15. Contact the Data Controller

For all privacy-related queries, requests, or concerns, contact TalkSasa at:

Email: info@talksasa.com
Phone: +254 712 295 880 | +254 781 000 403
Website: www.talksasa.com

This Privacy Policy was last updated on 10th August 2024.