Privacy policy

Centranette Systems operates Centranet and is the controller for its own business-account, public-website, sales, support and marketing processing described in this notice. Our contact location is Ruiru 00232, Kenya. Send privacy enquiries and rights requests to privacy@centranetispbilling.com. If a separate agreement identifies another responsible entity for a particular service, consult that agreement and its privacy notice.

For subscriber records operated by an ISP or reseller, that business normally decides why and how the data is used and acts as controller. Centranet processes those records on its instructions, subject to the Data Processing Addendum. A white-label portal does not remove the ISP’s responsibility to identify itself and provide its own privacy notice.

Account and business information includes names, work email addresses, telephone numbers, country, business details, membership, roles, preferences and authentication records. Support and sales records include enquiries, correspondence, order details and information you provide to resolve an issue.

Service records can include subscriber names and contact details, assigned account numbers, plans, invoices, payment references, balances, voucher and session records, router identifiers, IP or MAC addresses, configuration evidence and connection diagnostics. Which records exist depends on the features used and the ISP’s configuration.

Technical records may include request metadata, device/browser details, security events and diagnostic reports. Payment credentials are handled by the configured payment flow; never send us a card PIN, M-Pesa PIN, one-time payment authorization code or unredacted private key through support. Integration secrets entered in authorized settings are sensitive operational information.

We receive information from you, your authorized staff, subscribers using their ISP portal, connected routers, payment and messaging providers, and support or commerce interactions. Business marketing contacts may also come from public professional sources, a referral or a sourced import. A public listing is not itself consent to receive marketing.

Providers may send transaction outcomes, message-delivery events, fraud signals or responses to authorized requests. We limit use of that information to the relevant service, security, accounting, support or separately justified business purpose.

We use account and service information to provide requested services, authenticate users, maintain workspace permissions, fulfil orders, reconcile charges, respond to support and operate connected services. The relevant ground may be contractual necessity, steps requested before a contract, legal obligations, or a legitimate interest that is appropriate and balanced against individual rights.

Consent is used where required, including the optional analytics choices described in the Cookie Policy and consent-based marketing. You may withdraw consent without making earlier lawful processing unlawful. We do not treat consent to essential service processing as permission for unrelated marketing.

We also use proportionate records to prevent abuse, investigate faults, defend legal claims and meet accounting or regulatory requirements. The ISP must establish its own lawful basis for subscriber monitoring and instructions it gives us.

Information is disclosed only as needed to authorized workspace users, relevant service providers, professional advisers, a lawful authority or a party you authorize. Hosting, database, security, error-monitoring, communications and payment providers may receive information necessary for their function. See the Service Providers & Subprocessors register for categories and currently used platform providers.

Your chosen payment gateway, telecommunications provider or social platform may act as an independent controller under its own terms. A reseller’s staff do not automatically gain unrestricted access to every client’s data. Legal requests are assessed for scope and authority; information may be preserved or disclosed where lawfully required.

Centranet serves businesses across countries and uses infrastructure and suppliers that can process information outside your country, including outside Kenya. Hosting location alone does not describe every support, backup or subprocessor access location. Contact us for the applicable provider and location information for your service.

Where a transfer requires safeguards, the responsible controller and processor must establish the applicable legal mechanism and contractual or other required protections. We do not claim that every country provides equivalent protection or that accepting a website banner alone authorizes every international transfer.

We keep information for the purpose for which it is collected and for applicable accounting, regulatory, dispute, security and contractual obligations. Retention depends on the record type, account status, provider and legal requirements; an account closure does not require immediate destruction of invoices or records needed to resolve a disputed payment.

Subscriber data held on an ISP’s behalf follows the applicable processing agreement and lawful instructions. Deleting an active record may not immediately remove restricted backups or provider-held records. Requests are assessed for remaining obligations and communicated limitations. Contact us for the retention period applicable to a particular record and for available export or deletion options.

Marketing opt-out records may be retained in a minimal suppression list so that an opted-out contact is not imported and contacted again. Keeping suppression evidence is different from continuing promotional use of the contact.

You can unsubscribe from promotional email using its unsubscribe link or contact us to object to marketing. For SMS or WhatsApp, use the opt-out method stated in the message or send your request to the contact below. Withdrawing from promotions does not necessarily stop receipts, security warnings, requested verification or essential service notices.

Where enabled and appropriate, marketing systems may record delivery, link clicks and estimated opens. Image blocking, privacy tools and automated scanners can affect these measurements; an open is not reliable proof that a person read a message. We do not claim that email consent automatically covers SMS, WhatsApp or another sender.

Essential browser storage supports login, security, workspace selection, the cart and preferences. Optional public-website analytics is controlled by the cookie choices available in the footer. Read the Cookie Policy for the implemented categories, durations and limitations.

A provider’s external checkout or social site has its own storage and privacy controls. Choosing essential-only on Centranet does not change settings for a separate provider’s website.

Configured workflows may apply payment status, service limits, renewal rules, reminders or network instructions to an account. An ISP remains responsible for the service rules it selects. Administrative assistants may help prepare content, investigate issues or perform authorized tasks; relevant information may be processed by the assistant provider for that task.

We do not promise that automated results are error-free. Contact the responsible ISP about subscriber service decisions and contact Centranet about platform decisions. You may request an explanation, correction or human consideration where the applicable law grants that right. Private messages in the corporate inbox, including verification emails, are excluded from marketing-assistant processing.

Depending on applicable law, you may request information about processing, access to your data, correction, deletion, objection, restriction, portability or withdrawal of consent. Kenya’s Data Protection Act also provides rights concerning objection and qualifying automated decisions. These rights have lawful limits; for example, required accounting records may need to be retained.

Send a request describing the data and relevant workspace or account. We may seek proportionate identity or authority evidence before disclosing or changing records. We will respond within the applicable legal timeframe and explain restrictions or next steps. Do not send passwords or unnecessary identity documents with your initial request.

If your ISP controls the subscriber records, contact it first; we will assist it as required by our processing role. You may complain to the Office of the Data Protection Commissioner in Kenya or the competent authority in your jurisdiction.

We use access restrictions and operational security measures appropriate to the services, but no system or transmission method is invulnerable. Report suspected exposure promptly through the Security & Reporting page. Avoid including sensitive data in screenshots unless needed and shared through an agreed secure channel.

Business account registration is not intended for children. ISPs are responsible for age-appropriate notices and any parental or guardian permissions required for their subscribers. Contact us if you believe information about a child has been processed improperly.

We update this notice when practices or requirements change. The version and date appear on this page; significant changes will be communicated where required. Contact us for a copy of a prior notice relevant to your account.