Customer Privacy Policy
Draft for legal review.
This policy explains how WaterPAP Solutions ("WaterPAP", "we", "us"), collects and uses your personal data when you visit our website, request a quote or booking, create an account, order water delivery, exhauster services or tank cleaning, or talk to us. We are the data controller for this data under the Kenya Data Protection Act, 2019 (the "Act").
1. Data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name or business name, mobile number, email address | You, or a WaterPAP agent who registers you |
| Account | Your PIN (stored only in scrambled, hashed form), sign-in records, one-time codes we send by WhatsApp or SMS | You and our systems |
| Service and location | Delivery and saved addresses, map position of an address you pick, tank details (location, floor, size, material), access notes such as gate or caretaker details | You, and Google Maps when you search for an address |
| Orders | What you ordered, when, the price, the truck and driver assigned, delivery status and times | You and our systems |
| Payments | Amounts paid, M-Pesa or other payment references, balances, payment terms and due dates | You, our staff and our payment records |
| Communications | WhatsApp chats, calls, SMS, quote and booking requests and their notes | You |
| Technical | Device and browser type, IP address, app version, basic logs needed to run and secure the service | Your device |
We do not collect sensitive personal data (as defined in the Act) about customers, and we do not track your device's location.
2. How and why we use it
| Purpose | Lawful basis under the Act |
|---|---|
| Creating and securing your account, and verifying your phone number | Performance of our contract with you |
| Pricing, confirming, scheduling and delivering your orders, including passing the delivery details to the partner and driver doing it | Performance of our contract |
| Sending order updates (booked, on the way, delivered) and payment reminders by WhatsApp or SMS | Performance of our contract; legitimate interest in being paid |
| Answering quote and booking requests and chats | Steps you asked for before entering a contract |
| Invoicing, accounting, tax (including KRA eTIMS) and record keeping | Legal obligation |
| Preventing fraud and misuse, and keeping our systems secure | Legitimate interest |
| Improving our service and planning coverage, using combined figures | Legitimate interest |
| Telling you about offers and new services | Your consent, which you can withdraw at any time by replying STOP or telling us |
You can ask us to stop sending payment reminders at any time; this does not change what you owe.
3. Who we share it with
We never sell your personal data. We share only what each party needs:
- Delivery partners and their drivers, independent transport companies that deliver for WaterPAP: your name, phone number, delivery address, tank details and access notes for the order they carry out. They must keep it confidential and use it only for your delivery.
- WaterPAP sales agents who look after your account: your contact details, orders and payment status.
- Service providers who process data for us under contract: hosting (Railway, Netlify), mapping and address search (Google Maps Platform), messaging (Meta's WhatsApp Business Platform, Advanta SMS), push notifications for our driver app (Google Firebase), and email delivery.
- Payment providers such as Safaricom M-Pesa, when you pay.
- Authorities, such as the Kenya Revenue Authority, when the law requires it, and professional advisers.
- A buyer or successor if our business is reorganised or sold, under the same protections.
4. Transfers outside Kenya
Some of our service providers store or process data outside Kenya, including in the United States and the European Union. We transfer data only where the Act allows it, with appropriate safeguards such as contractual protections, and only what the service needs.
5. How long we keep it
- Account and order records: while your account is open and for 7 years after your last order, for tax and accounting.
- Payment and invoice records: 7 years, as tax law requires.
- Quote or booking requests that don't become orders: up to 12 months.
- One-time sign-in codes: minutes; technical logs: up to 90 days.
When data is no longer needed we delete it or make it anonymous.
6. Your rights
Under the Act you have the right to:
- be told how your data is used (this policy);
- access the personal data we hold about you;
- correct data that is wrong or incomplete (you can edit your name and addresses in your account);
- have data deleted, unless we must keep it by law (for example invoices);
- object to processing based on our legitimate interests, and to direct marketing;
- withdraw consent at any time;
- receive your data in a portable format; and
- complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
To use any of these rights, contact us as below. We'll answer within the time the Act allows, and may ask you to confirm who you are.
7. Security
We protect your data with encrypted connections (HTTPS), hashed PINs, access limited to staff who need it, and signed sign-in tokens. Partners and drivers see only the orders they work on. No system is completely secure; if a breach affects your data we will tell you and the Data Protection Commissioner as the Act requires.
8. Cookies and similar technology
Our customer website uses one essential cookie to keep you signed in. Our apps store your sign-in securely on your device. We don't use advertising or tracking cookies. Our public website loads fonts from Google Fonts, which receives your IP address to deliver them.
9. Children
Our services are for adults. We don't knowingly collect data from children under 18.
10. Changes and contact
We may update this policy. We'll post the new version here with its effective date and tell account holders of important changes.
Data protection contact: WaterPAP Solutions, email info@waterpap.com, phone +254 798 844 488.