This policy explains how Frostwood Limited ("Frostwood", "we", "us") collects, uses and protects personal data in the Frostwood Bulk SMS service, in line with the Data Protection Act, 2019 of Kenya and its regulations. It applies to our customers and their team members, to people who visit this website, and to people who receive SMS messages sent through our service.
1. Who we are and our role
- Controller. For account, billing, payment and website data, Frostwood is the data controller.
- Processor. For contact lists and messages that customers upload or send, the customer is the data controller and Frostwood processes the data only on the customer's instructions to deliver their messages. Each customer is responsible for having a lawful basis, such as consent, to message its recipients.
Privacy questions and requests: info@frostwood.co.ke.
2. What we collect
- Account data: name, work email, mobile number, organisation name and details, role, password (stored only as a secure hash) and two-factor settings.
- Verification and sender ID documents: business registration certificates, authorisation letters and similar documents you upload.
- Payment data: M-Pesa receipt numbers, amounts, dates, your account reference, and the payer name and phone number that Safaricom provides. We never see or store M-Pesa PINs.
- Contact data uploaded by customers: recipients' phone numbers, names, custom fields, group membership, consent source and opt-out status.
- Messages and delivery records: message text, sender ID, send time, segments, and the network's acceptance and delivery reports.
- Technical and security data: sign-in times, IP address, browser type, API request logs and an audit trail of sensitive actions.
- Correspondence: support tickets, contact form messages and emails.
3. Why we use it and our lawful basis
- To provide the service (accounts, sending messages, delivery reports, sender ID registration): performance of our contract with the customer.
- To process payments, keep accounts and meet tax and anti-fraud obligations: contract and legal obligation.
- To verify businesses, prevent spam, fraud and abuse, and secure the service: legal obligation and our legitimate interests in a safe, lawful messaging service.
- To send service emails and SMS such as verification codes, receipts, sender ID decisions and low-balance warnings: contract.
- To send product news: only with consent, and you can opt out at any time.
We do not sell personal data, use it for advertising, or make decisions about anyone by automated means that have legal or similarly significant effects.
4. Who we share it with
Only as needed to run the service, and under contracts that require them to protect the data:
- HostPinnacle, our SMS delivery partner, and the mobile networks (Safaricom, Airtel, Telkom), to deliver messages and register sender IDs.
- Safaricom, to process M-Pesa payments and refunds.
- Our hosting, email and backup providers, to run the platform.
- Authorities, when the law requires it, such as a court order or a lawful request from a regulator.
If a provider stores data outside Kenya, we transfer it only with the safeguards required by Part VI of the Data Protection Act, 2019.
5. How long we keep it
- Message text: 90 days after sending, then deleted. Delivery records without text: 365 days.
- Uploaded contact files: 7 days after import. Generated exports: 24 hours.
- Contacts and opt-outs: until the customer deletes them or closes the account. Opt-outs are kept so the number is not messaged again.
- Payment, invoice and accounting records: at least 5 years, as required by Kenyan tax law.
- Sender ID documents: while the sender ID is in use and for 12 months after.
- Account data: while the account is open, then up to 12 months to resolve queries, unless the law requires longer.
- Security and audit logs: up to 24 months.
6. How we protect it
Data is encrypted in transit (HTTPS) and sensitive fields, including message text, are encrypted at rest. Access is limited by role, and staff use two-factor sign-in. Each customer's data is separated from every other customer's. Full phone numbers and message text are hidden from routine logs, and sensitive actions are recorded in an audit trail. If a breach is likely to put your rights at risk, we will tell the Data Commissioner within 72 hours and inform affected people without delay.
7. Your rights
Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, and to:
- access your personal data;
- object to its processing;
- correct false or misleading data;
- delete data that is no longer needed, subject to records the law requires us to keep;
- receive your data in a portable format.
Email info@frostwood.co.ke. We may ask you to confirm your identity, and we aim to respond within 7 days. If your request concerns messages sent by one of our customers, we will pass it to that organisation and help it respond. You can also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8. If you receive our customers' messages
Your number reached us because an organisation you deal with uploaded it to send you messages. To stop promotional messages, see Stop receiving messages.
9. Cookies
We use only the cookies needed to keep you signed in and protect forms from forgery. We do not use advertising or tracking cookies.
10. Children
The service is for organisations and is not directed at children. Customers must not upload children's data without the consent of a parent or guardian.
11. Changes
We will post any change here with a new effective date, and email account owners about significant changes.