1. Who we are
PulseLynk Networks Limited ("PulseLynk", "we") provides fibre internet to apartment buildings in Nairobi and surrounding counties. We are the data controller for the personal data described in this policy. Our Data Protection contact can be reached at privacy@pulselynk.co.ke.
2. What we collect
Information you give us
- Application & account details: full name, mobile number, email address, national ID/passport number, building name, house/unit number, chosen package and installation preferences.
- Communications: messages you send via our contact form, WhatsApp, email or phone, and notes from support calls.
- Coverage requests: your name, phone number and building details when you ask us to survey a building.
Information we collect automatically
- Service data: connection status, router/optical terminal serial numbers, port assignments, bandwidth usage totals, uptime and fault logs — needed to operate and troubleshoot your line.
- Website data: IP address, browser type, pages visited and referring page, collected through server logs and privacy-respecting analytics.
Information from third parties
- Payment confirmations from Safaricom M-PESA (see section 6).
- Building information from landlords or caretakers, such as unit lists, used to plan installations.
We do not inspect the content of your internet traffic, the websites you visit or the messages you send over our network, except as strictly required by Kenyan law or a lawful court order.
3. How we use your data
- To process your application, schedule installation and provide, bill and support the Service.
- To send service messages: installation confirmations, payment reminders, outage notices and security alerts (by SMS, WhatsApp, email or phone).
- To verify your identity and comply with subscriber registration requirements of the Communications Authority of Kenya.
- To detect and prevent fraud, abuse of the network and breaches of our Terms.
- To plan network expansion (for example, counting coverage requests per building).
- To improve our website and services using aggregated, de-identified statistics.
- With your consent, to tell you about new packages or offers. You can opt out at any time by replying STOP or contacting us.
4. Lawful basis
Under the Data Protection Act, 2019, we rely on: performance of a contract (providing the Service you applied for); legal obligation (subscriber registration, tax and lawful-interception requirements); legitimate interests (network security, fraud prevention, service improvement) balanced against your rights; and consent (marketing messages and optional data such as your email address).
5. Who we share it with
We never sell your personal data. We share it only with:
- Our field technicians and support staff, who see only what they need to install and support your line.
- Service providers acting on our instructions under contract: SMS gateways, email delivery, cloud hosting (data hosted in Kenya or in jurisdictions with adequate protection), and payment processors.
- Safaricom PLC, to reconcile M-PESA payments to your account.
- Building management or landlords: only confirmation that a unit is connected, where required for building access — never your usage or payment details.
- Regulators and law enforcement where required by Kenyan law, a court order or the Communications Authority of Kenya.
- A buyer or successor in the event of a merger or sale of the business, under the same protections.
6. MPESA & payment data
When you pay via Lipa na M-PESA, Safaricom sends us a confirmation containing your M-PESA registered name, phone number, the amount, the transaction code and the account number you entered. We use this solely to credit your account and issue receipts. We never receive or store your M-PESA PIN. Where we offer STK-push (a payment prompt sent to your phone), we send only your phone number and amount to Safaricom's Daraja API over an encrypted connection.
7. How long we keep it
- Account and billing records: for the duration of your subscription and 7 years afterwards, as required by Kenyan tax and telecommunications regulations.
- Unsuccessful or withdrawn applications: 12 months, then deleted or anonymised.
- Coverage requests: until the building is connected or 24 months, whichever is sooner.
- Support conversations: 24 months.
- Website server logs: 90 days.
8. How we protect it
We use encryption in transit (HTTPS/TLS) for our website and portal, encrypted storage for identity documents, role-based access controls so staff only see what their role requires, audit logs of access to customer records, and regular backups stored securely. Payment credentials such as Daraja API keys are stored encrypted and rotated periodically. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the ODPC within 72 hours as the law requires.
9. Your rights
Under the Data Protection Act, 2019 you have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data;
- Delete your data where we no longer have a lawful reason to keep it;
- Object to or restrict certain processing, including direct marketing;
- Port your data to another provider in a machine-readable format;
- Withdraw consent at any time where processing is based on consent.
To exercise any right, email privacy@pulselynk.co.ke or write to the address below. We respond within 14 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner at odpc.go.ke.
10. Cookies & website analytics
Our website uses one strictly necessary session cookie (pulselynk_session) to keep forms working securely and to protect against cross-site request forgery. We do not use advertising cookies or cross-site trackers. If we use analytics, it is configured to anonymise IP addresses and does not build individual profiles. You can block cookies in your browser; the application form may not work correctly if you do.
11. Children
Our Service is contracted by adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes & contact
We may update this policy from time to time; the "last updated" date above will change and material changes will be notified by SMS or email. Questions or requests:
PulseLynk Networks Limited — Data Protection Officer
Mirema Drive, Roysambu, Nairobi
Email: privacy@pulselynk.co.ke · Phone: 0702 234 878