1. Who we are
EnziMPya ("we", "us") provides billing and network management software to internet service providers ("ISPs"). This policy covers enzimpya.com, every ISP dashboard at *.enzimpya.com, the captive portals and the EnziMPya mobile app. Questions about this policy can be sent to info@enzimpya.com.
2. Our role
We handle two different kinds of data, in two different roles:
- ISP account data. This is information about you as our customer: your name, business name, phone number, email and billing details. For this data we decide how it is used, and we are responsible for it.
- Subscriber data. This is information about your own customers that you store in or collect through EnziMPya. Your ISP decides why this data is collected and how it is used. We process it on your behalf, only to provide the service.
If you are an ISP's subscriber and have a question about your data, please contact your ISP first. We will help them answer you.
3. What we collect
From ISPs
- Account details you give us when you sign up: name, ISP name, email address and phone number.
- Login and security information, such as hashed passwords and two-factor settings.
- Configuration you set up: routers, packages, payment gateway settings and branding.
- Records of the fees you pay us.
About subscribers, on behalf of ISPs
- Name, phone number, username and the package bought.
- Payment records: M-Pesa transaction codes, amounts, dates and phone numbers.
- Network data needed to deliver and bill the service: device MAC and IP addresses, session start and stop times, and data usage.
- Messages sent through support tickets in the mobile app.
From visitors to enzimpya.com
- We use Cloudflare Web Analytics to count visits. It does not use cookies and does not track you across other websites.
4. How we use it
- To run the service: authenticate subscribers on routers, match payments, activate and suspend accounts, and send the SMS and email notifications your ISP has set up.
- To provide support, investigate faults and keep the platform secure.
- To bill ISPs for using EnziMPya.
- To meet our legal obligations.
We do not sell personal data, and we do not use subscriber data for our own marketing.
5. Who we share it with
We share data only as far as each provider needs it to deliver part of the service:
- Safaricom (M-Pesa) to process payments.
- SMS and email providers to deliver the notifications your ISP sends.
- Hosting, backup and network providers that run our servers and store backups.
- Authorities, when Kenyan law requires it.
Each ISP's data is kept in its own separate database. One ISP never sees another ISP's subscribers.
6. Where data is stored
Our servers and backups may be located outside Kenya. Whenever data is transferred, we protect it with safeguards that meet the requirements of the Data Protection Act, 2019.
7. How long we keep it
We keep ISP account data for as long as the account is active, and afterwards for as long as we need it for accounting and legal purposes. Subscriber data is kept for as long as the ISP keeps its account. Some technical logs are deleted automatically after a short period. When an ISP closes its account, it can ask us to export its data first and then delete it.
8. Security
Data travels over encrypted connections (HTTPS, and VPN tunnels between routers and our servers). Each ISP's data is isolated, server access is limited to authorised staff, and we take regular backups. No system is perfectly secure, but if a breach affects personal data, we will notify the affected ISPs and the Office of the Data Protection Commissioner as the law requires.
9. Your rights
Under Kenya's Data Protection Act, 2019, you have the right to be told how your data is used, to see it, to have it corrected or deleted, and to object to some uses. To exercise these rights, email info@enzimpya.com. If you are a subscriber, contact your ISP first. You can also complain to the Office of the Data Protection Commissioner.
10. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the change is significant, we will also tell ISPs by email or in the dashboard.