(In compliance with the Kenya Data Protection Act, 2019)
1. Introduction
This statement is issued in compliance with the Data Protection Act, 2019 of Kenya (DPA) and the Data Protection (General) Regulations, 2021. It governs your interactions and business dealings with HOSTAFRICA EAC LIMITED, which is duly registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC).
For the purposes of this statement:
- "Data Subject" refers to any natural person whose personal data is collected, stored, or processed by HostAfrica.
- "Personal Data" means any information relating to an identified or identifiable natural person as defined under Section 2 of the Data Protection Act, 2019.
- "Third Parties / Data Processors" include, but are not limited to, affiliated companies, joint ventures, payment gateways, and third-party service providers who process data on behalf of HostAfrica.
2. Lawful Basis for Processing Customer Personal Data
HostAfrica processes customer Personal Data in accordance with the principles set out under Section 25 and Section 30 of the Data Protection Act, 2019. Personal Data is processed only where:
- The customer has given explicit consent;
- It is necessary for the performance or conclusion of a contract to which the customer is a party;
- It is required to satisfy a legal obligation imposed on HostAfrica;
- It protects the vital or legitimate interests of the customer or HostAfrica.
3. Distribution of Personal Data to Third Parties & International Transfers
HostAfrica may transfer or provide access to Personal Data to Third Parties/Data Processors solely to facilitate business operations and service delivery.
In accordance with Section 48 of the Data Protection Act, 2019:
- HostAfrica takes all reasonable, practicable steps to ensure Third Parties handle personal data confidentially and under strict security conditions.
- Personal Data transferred outside Kenya will only be sent to jurisdictions that ensure an adequate level of data protection, or where appropriate legal safeguards (such as Standard Contractual Clauses or explicit consent) are in place.
- HostAfrica maintains Data Processing Agreements (DPAs) with all Third-Party service providers to ensure compliance with confidentiality and privacy mandates.
4. HostAfrica Acting as a Data Processor
When providing web hosting, server, and cloud infrastructure services, HostAfrica acts as a Data Processor storing or handling Third-Party Personal Data on behalf of its customers (who act as the Data Controllers).
HostAfrica adheres to its obligations under Section 35 of the Data Protection Act, 2019 by:
- Maintaining appropriate technical and organizational measures to safeguard hosted data against unauthorized access, loss, or destruction;
- Processing hosted data strictly in accordance with the customer's instructions and terms of service.
5. Rights of the Data Subject
Under Section 26 of the Kenya Data Protection Act, 2019, you have the following statutory rights regarding your Personal Data:
5.1 Right to be Informed: To know how your personal data is collected and processed.
5.2 Right of Access: To request access to the personal data HostAfrica holds about you.
5.3 Right to Object: To object to the processing of all or part of your personal data (including direct marketing).
5.4 Right to Correction & Erasure: To request the correction of false or misleading data, or the deletion of data that is no longer necessary.
5.5 Right to Data Portability: To request that your personal data be transferred to you or another data controller in a structured format.
6. Contact Details of the Data Protection Officer (DPO)
If you have any questions, wish to exercise your data subject rights, or require further details regarding our registration status, please contact our Data Protection Officer (DPO):
Entity Name: HOSTAFRICA EAC LIMITED (Registered Data Controller - ODPC)
Designation: Data Protection Officer (DPO)
Email: dpoke@hostafrica.com
Address: Nairobi, Kenya