Version 2026-10 · effective 19 October 2026
This policy explains how SITEBOMAWEB SOLUTIONS, a business registered in Kenya (business registration number BN-VZSEZ87P) that trades as SiteBoma ("SiteBoma", "we", "us"), collects and uses personal data. For the personal data described here we are the data controller under the Data Protection Act, 2019. Our contact details are in section 16.
This policy covers personal data about our customers and their contacts, people who visit siteboma.co.ke or siteboma.com or chat with us, people who apply to our affiliate programme, and anyone who contacts us.
It does not cover the personal data our customers put on their own websites, mailboxes and other services we host for them. For that data the customer is the data controller and we act as their data processor, as set out in section 19 of our Terms of Service. If you are a visitor to a website we host, please contact the owner of that website.
Most of this comes from you. Some comes from others: payment providers confirm payments, domain registries send status updates, and affiliates refer customers to us. You do not have to give us your data, but without it we cannot open an account, provide a service or take a payment.
Under the Data Protection Act, 2019 we may use personal data only for a lawful reason. These are our reasons:
| What we do | Lawful basis |
|---|---|
| Open and run your account, provide and set up your services, register and renew domains, take payments, send invoices and service notices | Performance of our contract with you |
| Answer chats, tickets and calls, and solve problems | Performance of our contract, and our legitimate interest in helping people who contact us |
| Keep tax and accounting records, respond to court orders and lawful requests from authorities, and give registries the data their rules require | Compliance with legal obligations |
| Keep our systems secure, prevent fraud, abuse and spam, and keep evidence of orders and of your acceptance of our terms | Our legitimate interests in protecting our business, our customers and the public |
| Understand how our website is used and improve it | Our legitimate interest in running a useful website; you can opt out (section 12) |
| Send newsletters and offers | Your consent, or our legitimate interest for similar services you already use; you can opt out at any time |
| Run the affiliate programme and pay commission | Performance of our affiliate agreement with you |
We do not make decisions that have legal or similarly significant effects on you based only on automated processing.
The assistant in our website chat, and some automatic replies on support tickets, are produced by artificial intelligence. Some replies from our support team are also prepared with the help of AI tools. To do this, the text of your chat or ticket, any files you attach, and the account details needed to answer you (such as your services and invoices) are sent to our AI technology providers, currently Anthropic and, as a backup route, OpenRouter, which process them to produce a reply. Please never share passwords, card numbers or other secrets in a chat or ticket.
If you buy AI coding credits, the prompts and code you send through that feature are processed by the AI model providers available through OpenRouter, under their terms.
We do not sell your personal data, and we do not share it for other companies' advertising. We share it only as needed with:
Providers that process data for us may use it only to provide their service to us and must protect it.
Our hosting and email servers are outside Kenya, currently in the United Kingdom, the United States and the Netherlands (Business Email mailboxes are kept in the Netherlands, in the European Union). Several of the providers in section 6 (for example Cloudflare, Google, Microsoft, Anthropic, OpenRouter and Trustpilot) process data in the United States, the European Union or elsewhere. We transfer personal data outside Kenya under sections 48 to 50 of the Data Protection Act, 2019: because it is necessary to perform our contract with you (for example to host your service or register your domain), and with safeguards such as contractual commitments from our providers. The United Kingdom and the European Union have data protection laws similar to Kenya's. We do not transfer sensitive personal data abroad without your consent. You can ask us for more information about these transfers and the safeguards that apply.
We keep personal data only as long as we need it for the purposes in section 4, or as long as the law requires:
When the period ends we delete the data or make it anonymous. Copies in backups are deleted as the backups are replaced in their normal cycle.
We protect personal data with measures suited to the risk, including encrypted connections (HTTPS) for all our pages, passwords stored only in a scrambled form (bcrypt), sensitive service credentials stored encrypted, sign-in codes for staff access, access limited to the people who need it, monitoring of our systems and regular backups. No system connected to the internet is completely secure. If a personal data breach puts your rights at risk, we notify the Office of the Data Protection Commissioner within 72 hours and tell you as soon as we reasonably can, as section 43 of the Data Protection Act, 2019 requires.
Under the Data Protection Act, 2019 you have the right to:
Much of your data can be viewed and updated in your Client Area. For anything else, email [email protected] with "Privacy request" in the subject. We may ask you to confirm your identity before acting, to protect your data.
We send you emails about your account and services (for example invoices, renewal reminders, security alerts and service notices). These are part of the service and cannot be switched off while you have an active service. We send newsletters and offers only if you signed up for them or, for similar services, if you are already our customer. Every marketing email has an unsubscribe link, and you can also ask us to stop at any time.
Cookies are small files your browser stores. We use:
These are analytics tools, not advertising: we do not run ad networks or build advertising profiles. We also keep our own basic record of visits to our public pages: for each page view we store the page, the site you came from, your browser and device type and your country. Your IP address is shortened before it is saved. To tell a repeat visit from a first one, a random identifier is kept in your browser's local storage; it contains no personal details unless you are signed in, in which case your account ID is recorded with the visit. Automated crawlers are recorded separately. These visit records are deleted after 12 months.
You can opt out: block or delete cookies in your browser, use an analytics or script blocker, install the Google Analytics opt-out add-on, or email us and we will exclude your account from session recording.
When you pay an invoice we email you a receipt. We also share your name, email address and invoice number with Trustpilot A/S, an independent review website, so that it can send you one email inviting you to review SiteBoma, about a week after you pay. Every paying customer is invited in the same way, whatever their experience with us, and nobody is invited more than once a year. Leaving a review is entirely up to you. Trustpilot handles these details under its own privacy policy, every invitation includes a link to stop receiving them, and if you would rather we never share your details with Trustpilot, email us and we will exclude your account.
Our services are for people aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy. We publish every new version on this page with its effective date, and we tell customers by email or in the Client Area before changes that substantially affect them take effect.
SITEBOMAWEB SOLUTIONS (SiteBoma), business registration number BN-VZSEZ87P
2nd Floor, Office B28, Valley View Office Park, Tower B, City Park Drive, Highridge, Westlands, Nairobi, Kenya
Privacy questions and requests: [email protected] (subject "Privacy request") · Phone: +254 754 550 099
If you are not satisfied with how we handle your data or a request, you have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). We would appreciate the chance to put things right first, so please contact us before you complain.
Version 2026-10, effective 19 October 2026. It replaces the version of September 2026. See also our Terms of Service and Refund Policy.