Privacy Policy

1. Data Protection Compliance

Our registration demonstrates our commitment to handling all personal data responsibly, securely, and in full compliance with Kenyan data protection laws.

2. Information We Collect

Information You Provide:

• Name, email, phone number, business details
• M-Pesa transaction data
• Content uploaded for websites or integrations

Technical Information:

• IP addresses, device information, browser details, cookies
• Logs of interactions with our websites and tools

Third-Party Information:

• We may receive information from service providers (e.g., hosting partners, fraud prevention tools)

3. Partner and Reseller Data

If you apply to or join the WPfoss Partner Programme, we collect and hold more about you than we do about an ordinary visitor, because we are paying you money and are required to know who you are.

What we collect from partners

• Full name, email address, phone number and county
• National ID or passport number and date of birth, to identify you and confirm you are over 18
• KRA PIN, which we need before commission can be paid
• A certificate of good conduct, where we ask for one
• M-Pesa number and the name on that account, so commission reaches the right person
• Your commission ledger: every client you introduced, every payment they made, and every payout we sent you
• A record of actions you take in the partner portal, and when

Why we hold it

• To perform our contract with you — paying commission is impossible without an M-Pesa number and a way to identify you
• To meet legal obligations — tax records, and the duty not to engage a minor
• For our legitimate interests — preventing fraud and false commission claims, and settling attribution disputes fairly

How it is protected

• Your KRA PIN is stored encrypted and is decrypted only when a tax filing requires it
• Your M-Pesa number can be changed only by WPfoss staff, never from a partner login, so a compromised account cannot redirect your money
• The partner portal is scoped so no partner can ever see another partner's clients, earnings or identity

Data about prospects you register

When you register a business in the portal, you give us personal data about someone else. You must have their consent before entering it. WPfoss is the data controller for that information and handles it under this policy. You must not keep your own copy of it, and you must delete anything you still hold when you leave the programme.

Where a registration clashes with an existing client or another partner's, we tell each side only that it is under review. We never reveal one partner's identity, clients or figures to another.

4. Legal Basis for Processing

We process personal information under the following lawful bases:

• To perform a contract – Delivering websites, integrations, and digital services
• To comply with legal obligations – Meeting regulatory requirements
• With your consent – Marketing, optional communications
• For our legitimate interests – Improving services, securing systems

5. Use of Information

We use data to:

• Deliver, operate, and improve services
• Process and confirm payments
• Communicate updates, offers, and support
• Secure our websites and prevent fraud
• Meet legal and regulatory obligations

6. Data Sharing

We share information:

• With service providers such as Safaricom (M-Pesa), hosting companies, WooCommerce, analytics tools
• With regulators and authorities where required by law
• With third-party contractors bound by confidentiality and data protection agreements
• With our transactional email and SMS providers, so sign-in codes, invoices and service notices can reach you
• Never with another partner. One partner's clients, earnings and identity are never shown to another.

7. Data Transfers

If data is transferred outside Kenya, we require recipients to provide safeguards consistent with Kenya's Data Protection Act, 2019.

8. Data Security

We implement robust security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Regular audits of systems and partners
• Breach protocol: If a breach occurs, we notify ODPC within 72 hours and users when required

9. Data Retention

• Client records: Retained for up to 5 years after service termination or longer if law requires
• Partner records: Identity documents, commission ledgers and payout records are kept for 7 years after the partnership ends, the period Kenyan tax law requires for records of payments made
• Prospect registrations that never became clients: Kept for 2 years, then deleted
• Transaction data: Retained as per Kenyan tax and financial regulations
• Cookies: Stored according to browser settings and cookie policy

10. Your Rights

You have the right to:

• Access and obtain a copy of your data
• Request correction or deletion
• Object to processing or withdraw consent
• Restrict certain processing
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC)

Requests can be sent to: hello@wpfoss.ke

11. Cookies, Tracking and Activity Monitoring

We monitor how people use all of our websites, so we can see what works, fix what does not, keep accounts safe and measure our advertising. This applies to every website WPfoss runs, including wpfoss.ke, wpfoss.com, partners.wpfoss.ke, rank.ke, every.ke, eadirectory.com, album.ke, album.africa, nipecode.ke, onduu.ke and ujiajiri.ke.

What we record

• Pages and actions: the pages you open, the page that sent you to us, whether you are on a phone or a computer, how long you stay, and when you tap a WhatsApp, call, email or outside link.
• Sign-ins: when you sign in to one of our services, we record the time, your IP address and your device, to protect your account and spot misuse. Sign-ins on our services are also recorded centrally at wpfoss.ke with your name or email, your role, the site and the time. That central record holds no password and no IP address, and it is deleted after 365 days.

Our own measurement (always on)

Our websites send page views to our own servers. This sets no cookie and stores nothing in your browser. We recognise a returning visitor during one day by a scrambled code made from your IP address, and that code changes every day, so we cannot follow you from one day to the next. These records are deleted after 365 days. If your browser sends a "do not track" signal (Global Privacy Control or Do Not Track), we do not record your visit at all.

How you found us (kept in your browser)

When you first arrive on wpfoss.ke, we keep the page you landed on, the website that sent you and any campaign tags in the link (such as a Google Ads click code) in your browser's local storage for 90 days. It stays on your device and is sent to us only if you submit one of our forms, so we know how you found us. We do not use it for adverts. If your browser sends Global Privacy Control or Do Not Track, we do not keep it at all. You can delete it by clearing this site's data in your browser.

Google Tag Manager (always loads)

Every page loads Google Tag Manager, which decides which of the tools below may run. Loading it sends Google a basic request, like loading any web page, but it sets no cookies of its own.

Tools that need your consent

• Google Analytics, which measures visits and how pages are used.
• Meta Pixel (Facebook), which tells us which visits come from Facebook and Instagram, so we can measure our marketing there. If we advertise on those platforms in future, it may also be used to show our ads to people who have visited.
• Microsoft Clarity, which shows how people scroll and click on a page.
• Encharge, our email marketing tool.

We set these tools to wait for your choice. Google Analytics sets no cookies until you press Accept, though Google may still receive a basic, cookieless signal that a page was viewed. Google, Meta and Microsoft handle this data under their own privacy policies and may process it outside Kenya (see Section 7).

Your choice

A banner asks for your choice on your first visit. You can change it at any time with the Cookie settings link at the bottom of every page, or block cookies in your browser settings. If you change Accept to Reject, the tools stop, but cookies already set stay in your browser until you clear them there.

12. AI Assistants and Crawlers

We allow search engines and AI assistants to read this website so they can answer questions about our services. Our robots.txt publishes a content signal that permits search indexing and AI-assisted answers, but declines the use of our content to train AI models (ai-train=no).

So that assistants describe us accurately rather than guessing, we publish a plain summary of our services and pricing at Service Information for AI Assistants and in llms.txt. Neither includes personal data about visitors or enquiries.

13. Children's Privacy

Our services are not intended for users under 18, and we do not knowingly collect data from minors.

The Partner Programme is strictly over 18. We verify age from a national ID or passport before approving anyone, and we will not issue a partner code without it. If we learn that a partner is under 18, the account is closed immediately and their data deleted.

If you believe we hold data about a child, write to hello@wpfoss.ke and we will delete it.

14. Automated Decisions and Profiling

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects. Where our systems flag something, such as a partner registration that clashes with an existing client, a person reviews it and decides.

15. Marketing and Your Choices

• We send marketing email and SMS only where you have opted in, or where you are an existing client and the message is about a similar service
• Every marketing email carries an unsubscribe link. Every marketing SMS carries opt-out instructions.
• Transactional messages are different: sign-in codes, invoices, payment confirmations and service notices are part of providing the service and are not marketing. You cannot opt out of these while you hold an account.
• Partners receive operational messages about their prospects, commission and payouts. These are transactional.
• Opting out of marketing never affects the service you receive

16. Payment Information

• Payments are processed through Safaricom M-Pesa. We receive the transaction reference, amount, date and the paying number, and we keep those as accounting records.
• We never see, ask for or store your M-Pesa PIN, and we will never ask you for it. Anyone who does is not us.
• We do not store card numbers
• Partner M-Pesa numbers are held so commission can be sent, and are changed only by our staff

17. Complaints

If you are unhappy with how we have handled your personal data, write to hello@wpfoss.ke and we will respond within 14 days.

You also have the right to complain directly to the Office of the Data Protection Commissioner, Kenya, at any time, whether or not you have raised it with us first.

18. How to Exercise Your Rights

• Send your request to hello@wpfoss.ke, saying which right you are exercising
• We may ask you to confirm your identity before we act, so that we do not hand someone's data to the wrong person
• We respond within 30 days. If a request is complex we will tell you and explain why more time is needed.
• There is no charge, unless a request is repetitive or excessive

19. Policy Updates

We may update this policy. Updates will be posted here with the effective date.

20. Contact