Privacy Policy

This Privacy Policy explains how Nisc Cloud Limited collects, uses, stores, and protects your personal data in accordance with the Kenya Data Protection Act, 2019 (No. 24 of 2019) and our registration obligations as a Data Controller with the Office of the Data Protection Commissioner (ODPC).

Effective: 1 September 2025Last updated: 1 July 2026
Subject to Change. We may revise these terms from time to time. Registered users will be notified by email at least 30 days before any material changes take effect. Your continued use of our platform after the effective date of any revision constitutes acceptance of the updated terms.
Nisc Cloud Limited is registered with the Office of the Data Protection Commissioner (ODPC) under the Kenya Data Protection Act, 2019. Registration No. 160-3417-5D07 · Serial No. 14768 · Valid 16 September 2025 – 16 September 2027.

Your privacy matters to us. Nisc Cloud Limited ("Nisc Cloud", "we", "us", or "our") is committed to being transparent about how we collect and use your personal data. Please read this policy carefully. By using our Platform or Services, you acknowledge you have read and understood this Privacy Policy.

1. Data Controller Identity

The Data Controller responsible for your personal data is:

  • Company: Nisc Cloud Limited
  • Country of Incorporation: Kenya
  • Registered Address: Nairobi, Kenya
  • General Email: support@nisccloud.com
  • Privacy / DPO Email: privacy@nisccloud.com
  • ODPC Registration: Nisc Cloud Limited is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Controller under Registration No. 160-3417-5D07, Serial No. 14768, valid from 16 September 2025 to 16 September 2027, pursuant to Section 18 of the Kenya Data Protection Act, 2019.

Where we process personal data on behalf of our business Clients (e.g., hosting Client databases or processing their customers' data), we act as a Data Processor under the instruction of that Client (who is the Data Controller for such data). In such cases, our obligations are governed by a separate Data Processing Agreement (DPA) with the relevant Client.

2. Scope & Application

This Privacy Policy applies to:

  • All visitors to nisccloud.com and its subdomains;
  • All registered users of nPanel (npanel.nisccloud.com);
  • All purchasers of Services through our storefront or cart;
  • All individuals who contact us via email, telephone, or our contact form; and
  • All individuals whose personal data we process in connection with providing our Services.

This policy does not apply to data processed by Third-Party Services you connect to our Platform (e.g., Google Ads, Meta, Safaricom M-Pesa), which are governed by those providers' own privacy policies.

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Identity & Account Data

  • First name, last name, and preferred name;
  • Email address;
  • Phone number (including M-Pesa-linked numbers);
  • Company name and job title (for business accounts);
  • Account username and encrypted password hash;
  • Country and city of residence or operation.

3.2 Billing & Financial Data

  • Billing address;
  • Payment method type (M-Pesa, Visa, Mastercard) and masked payment identifiers (last 4 digits only full card numbers are never stored on our servers);
  • Transaction history, invoice records, and payment receipts;
  • Tax identification numbers (where applicable by law);
  • M-Pesa phone numbers and Checkout Request IDs for M-Pesa transactions.

3.3 Service & Usage Data

  • Domain names, hosting configurations, and server settings you manage through nPanel;
  • Email account names, aliases, and settings (not email content, which is private);
  • SSL certificate details;
  • Marketing campaign data (ad account IDs, campaign names, budgets, performance metrics);
  • Files and content you upload to hosted services;
  • nPanel feature usage, page views, and interaction logs.

3.4 Technical & Device Data

  • IP address and approximate geolocation (country/city level);
  • Browser type, version, and language;
  • Operating system and device type;
  • Referring URLs and pages visited on our website;
  • Session duration, clickstream data, and feature usage patterns;
  • Server access logs and error logs.

3.5 Communication Data

  • Email correspondence, support tickets, and live chat transcripts;
  • Feedback, survey responses, and testimonials;
  • Content of calls where recorded with your consent.

3.6 Marketing Data

  • Marketing and communication preferences;
  • Email open rates and click-through rates (for emails we send you);
  • Responses to promotional campaigns and events.

3.7 Special Categories of Data

We do not intentionally collect or process special categories of personal data (e.g., health data, biometric data, racial or ethnic origin, religious beliefs, sexual orientation, criminal records) through our standard Services. If the nature of a specific service engagement requires such data, we will seek your explicit consent and establish appropriate safeguards.

4. How We Collect Your Data

We collect your data through the following means:

4.1 Directly from You

  • When you create an Account on nPanel;
  • When you purchase or subscribe to a Service;
  • When you fill in contact, support, or enquiry forms;
  • When you communicate with us by email, phone, or chat;
  • When you provide feedback, reviews, or participate in surveys.

4.2 Automatically through Technology

  • Via cookies and similar tracking technologies when you use our website or nPanel (see our Cookie Policy);
  • Through server logs that automatically record technical information about connections to our Platform;
  • Through analytics tools (e.g., Google Analytics) that measure usage patterns.

4.3 From Third Parties

  • From payment processors (M-Pesa, card processors) who confirm transaction status;
  • From domain registries and WHOIS databases in connection with domain services;
  • From advertising platforms (Google, Meta, LinkedIn) when you grant us access to manage campaigns;
  • From identity verification providers where required for compliance.

Under the Kenya Data Protection Act, 2019 (Section 30), we process your personal data only where we have a lawful basis. The bases we rely on are:

  • Contract Performance (s.30(b)): Processing is necessary to provide the Services you have requested or purchased (e.g., account creation, service provisioning, billing, support).
  • Legal Obligation (s.30(c)): Processing is required to comply with applicable law, including Kenyan tax laws, ODPC obligations, anti-money laundering regulations, and court orders.
  • Legitimate Interests (s.30(e)): Processing is necessary for our legitimate business interests, including security monitoring, fraud prevention, product improvement, and internal analytics, where these interests are not overridden by your data protection rights. We conduct a Legitimate Interests Assessment for each such use.
  • Consent (s.30(a)): Where you have freely given, specific, and informed consent particularly for direct marketing emails, non-essential cookies, and analytics tracking. You may withdraw consent at any time (see Section 10 below).
  • Vital Interests (s.30(d)): In exceptional circumstances where processing is necessary to protect your vital interests or those of another natural person (e.g., during a security incident).

6. How We Use Your Data

We use your personal data for the following specific purposes:

6.1 Account Management & Service Delivery

  • Creating and managing your nPanel Account;
  • Provisioning and maintaining your subscribed Services (hosting, domains, email, SSL);
  • Sending service-critical notifications (renewal reminders, downtime alerts, security notices).

6.2 Billing & Payments

  • Processing payments via M-Pesa and card payment gateways;
  • Generating and issuing invoices and receipts;
  • Managing subscription renewals, failed payments, and debt recovery;
  • Maintaining financial records as required by Kenyan law.

6.3 Customer Support

  • Responding to your support requests, bug reports, and complaints;
  • Providing technical assistance and troubleshooting;
  • Escalating issues to third-party providers where necessary (e.g., data centre operators).

6.4 Security & Fraud Prevention

  • Detecting, investigating, and preventing unauthorised access, fraud, spam, and abuse;
  • Enforcing our Terms of Service and Acceptable Use Policy;
  • Maintaining audit logs for security and compliance purposes.

6.5 Product Improvement & Analytics

  • Analysing usage patterns to improve the Platform's features and user experience;
  • Conducting internal research and development;
  • Generating aggregated, anonymised statistics that do not identify individuals.

6.6 Marketing & Communications (Consent-Based)

  • Sending newsletters, product updates, promotional offers, and event invitations where you have opted in;
  • Personalising marketing communications based on your service usage;
  • Retargeting via advertising platforms (Meta, Google) using anonymised identifiers where permitted.

You may opt out of marketing communications at any time by clicking "Unsubscribe" in any email, updating your preferences in nPanel, or contacting privacy@nisccloud.com.

6.7 Legal & Regulatory Compliance

  • Complying with ODPC reporting obligations;
  • Responding to lawful requests from government or regulatory authorities;
  • Establishing, exercising, or defending legal claims.

7. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share your data only in the following limited circumstances:

7.1 Service Providers (Data Processors)

We share data with trusted third-party service providers who process it on our behalf, bound by strict data processing agreements:

  • Payment Processors: Safaricom M-Pesa, card payment gateways (PCI-DSS compliant);
  • Cloud Infrastructure: Data centre and server infrastructure providers hosting our Platform;
  • Analytics: Google Analytics (anonymised usage data);
  • Email Delivery: Transactional email providers for service notifications;
  • Customer Support: Helpdesk software providers;
  • Domain & SSL Registries: ICANN-accredited registries and certificate authorities.

7.2 Business Clients

Where you are a Client who uses our Services to process your own customers' data (e.g., hosting a website or email system), you are solely responsible for that data. We process it only on your instructions as your Data Processor.

7.3 Advertising Platforms (with Your Authorisation)

If you engage our paid advertising management services, we may share necessary campaign data (ad creative, targeting parameters) with Google, Meta, TikTok, or LinkedIn on your behalf. This is done under your direction and with your authorisation.

7.4 Legal & Regulatory Disclosure

We may disclose your data to law enforcement agencies, regulatory bodies (including the ODPC), or courts when required by applicable law, judicial order, or to protect the rights, safety, or property of Nisc Cloud, its users, or the public. We will, where legally permissible, notify you of such requests.

7.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of our assets, your personal data may be transferred to the successor entity. We will notify you via email and a prominent notice on the Platform at least 30 days before your data is transferred and becomes subject to a different privacy policy.

7.6 With Your Consent

We may share your data with any other party if you have given us explicit consent to do so.

8. International Data Transfers

Some of our service providers and infrastructure partners are located outside Kenya. Where we transfer your personal data to countries that may not offer an equivalent level of data protection to Kenya, we implement the following safeguards:

  • Standard Contractual Clauses: Data processing agreements incorporating appropriate contractual protections;
  • Adequacy Decisions: Transfers to countries or entities recognised as providing adequate protection;
  • Necessary for Contract Performance: Where the transfer is necessary to perform our contract with you (e.g., connecting to a global domain registry).

You may request details of the specific safeguards in place for any international transfer by contacting privacy@nisccloud.com.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, subject to legal requirements. Our specific retention periods are:

  • Active Account Data: Retained for the duration of your active Subscription and for 30 days after Account closure to allow data export and dispute resolution.
  • Financial Records & Invoices: Retained for 7 years after the transaction date as required by Kenyan tax and accounting law.
  • Security & Audit Logs: Retained for 12 months for security investigation and compliance purposes.
  • Support Correspondence: Retained for 3 years after ticket closure for quality assurance and dispute resolution.
  • Marketing Opt-Out Records: Retained indefinitely to honour your opt-out preferences.
  • Backup Data: Operational backups are retained for up to 90 days, after which they are securely deleted. Backup data is not restored to serve individual deletion requests but will expire naturally.
  • Legal Hold: Where data is subject to a legal hold, dispute, or regulatory investigation, it will be retained for the duration of that hold regardless of the above schedules.

When data is no longer required, we securely delete or anonymise it using industry-standard methods.

10. Your Rights under the Kenya Data Protection Act, 2019

Under the Kenya Data Protection Act, 2019, you have the following rights with respect to your personal data:

  • Right to be Informed (s.26(a)): The right to know what data we hold about you, how we use it, and with whom we share it which is the purpose of this Privacy Policy.
  • Right of Access (s.26(b)): The right to request a copy of the personal data we hold about you, free of charge in most cases.
  • Right to Rectification (s.26(c)): The right to request correction of inaccurate or incomplete personal data we hold about you.
  • Right to Erasure (s.26(d)): The right to request deletion of your personal data where: (i) it is no longer necessary for the purpose for which it was collected; (ii) you withdraw consent; (iii) you successfully object to processing; or (iv) the data was processed unlawfully. This right is subject to legal retention obligations.
  • Right to Restriction of Processing (s.26(e)): The right to ask us to limit processing of your data in certain circumstances (e.g., while you contest its accuracy).
  • Right to Data Portability (s.26(f)): The right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller, where technically feasible.
  • Right to Object (s.26(g)): The right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
  • Rights regarding Automated Decision-Making (s.26(h)): The right not to be subject to a decision based solely on automated processing that significantly affects you, including the right to request human review.
  • Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.

10.1 How to Exercise Your Rights

To exercise any of your rights, submit a request to privacy@nisccloud.com clearly stating the right you wish to exercise and your Account details. We will:

  • Acknowledge your request within 3 Working Days;
  • Verify your identity before processing the request;
  • Respond fully within 30 days (or inform you of any lawful extension).

We will not charge a fee for responding to rights requests unless your request is manifestly unfounded, repetitive, or excessive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

10.2 Right to Lodge a Complaint

If you are not satisfied with how we handle your personal data or your rights request, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

We encourage you to contact us first, as we prefer the opportunity to address your concerns directly.

11. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include:

11.1 Technical Safeguards

  • Encryption in Transit: All data transmitted between your browser and our Platform is encrypted using TLS 1.2 or higher (HTTPS);
  • Encryption at Rest: Sensitive data fields and backups are encrypted at rest using AES-256;
  • Access Controls: Role-based access control (RBAC) ensures staff access only the data necessary for their role;
  • Two-Factor Authentication: Required for all Nisc Cloud staff accessing production systems;
  • Firewalls & Intrusion Detection: Network-level security measures monitor for and block malicious traffic;
  • Vulnerability Management: Regular security testing, patching, and dependency updates.

11.2 Organisational Safeguards

  • Data protection training for all staff with access to personal data;
  • Confidentiality obligations in all employment and contractor agreements;
  • An internal data protection policy and incident response plan;
  • Regular reviews of data processing activities and third-party processor agreements.

11.3 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

  • Notify the ODPC within 72 hours of becoming aware of the breach, as required by the Kenya Data Protection Act, 2019;
  • Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights.

Please note that no security measure is 100% impenetrable. We cannot guarantee the absolute security of your data, and by using our Services you accept this inherent risk.

12. Children's Privacy

Our Platform and Services are intended for use by adults aged 18 or over. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a person under 18 without appropriate parental or guardian consent, we will take immediate steps to delete such data.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@nisccloud.com.

Our website and nPanel may contain links to third-party websites, platforms, or services that we do not operate or control. This Privacy Policy does not apply to those third-party services, and we are not responsible for their data practices. We encourage you to review the privacy policies of any third-party service you access.

When you connect third-party services to nPanel (e.g., Google Ads, Meta Business Manager, LinkedIn Campaign Manager), the data you share with those platforms is governed by their respective privacy policies. Our access to your data on those platforms is limited to what is necessary to provide the services you have requested.

14. Automated Decision-Making & Profiling

We may use automated systems to make decisions that affect your Account or Service access, including:

  • Fraud Detection: Automated analysis of transaction patterns, IP addresses, and account behaviour to detect and prevent fraudulent activity;
  • Account Risk Scoring: Automated assessment of account risk based on usage patterns and payment history;
  • Spam & Abuse Detection: Automated content and traffic analysis to enforce our Acceptable Use Policy.

Where an automated decision has a significant legal or similarly significant effect on you (such as Account suspension), you have the right to:

  • Request human review of the automated decision;
  • Express your point of view;
  • Contest the decision.

To exercise this right, contact privacy@nisccloud.com with the subject line "Automated Decision Review".

15. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website and in nPanel. The types of cookies we use, their purpose, and how you can control them are described in detail in our Cookie Policy.

In summary, we use:

  • Strictly Necessary Cookies: Essential for authentication, security, and basic Platform functionality;
  • Functional Cookies: To remember your preferences (e.g., language, theme);
  • Analytics Cookies: To measure how users interact with our Platform (requires consent);
  • Marketing Cookies: For advertising retargeting and conversion tracking (requires consent).

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, legal requirements, or business operations. We will notify you of material changes by:

  • Sending an email to your registered Account address at least 30 days before the change takes effect;
  • Displaying a prominent banner or notification on the Platform; and
  • Updating the "Last Updated" date at the top of this policy.

Your continued use of the Platform after the effective date of any revised Privacy Policy constitutes acceptance of the updated policy. If you disagree with the changes, you must stop using our Services and close your Account before the effective date.

Previous versions of this Privacy Policy are archived and available upon written request to privacy@nisccloud.com.

17. Contact Us & Data Protection Officer

For all privacy-related enquiries, rights requests, or concerns, please contact our Data Protection team:

We aim to respond to all privacy enquiries within 5 Working Days and to resolve data rights requests within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.