Terms of Service

Contents

1. About these Terms
2. Definitions
3. Your account
4. Orders and when the contract starts
5. Fees, billing and payment
6. Cancellation, suspension and termination
7. Hosting rules and fair use
8. Acceptable Use Policy
9. Your content
10. Security and backups
11. Availability, maintenance and support
12. Our automated assistant and AI services
13. Domain names
14. Third-party services and resold products
15. Website design and other professional services
16. Security testing services
17. Affiliate programme
18. Intellectual property
19. Data protection
20. Confidentiality
21. Our promises and disclaimers
22. Limitation of liability
23. Your indemnity
24. Events beyond our control
25. Changes to the Services and these Terms
26. Notices and communications
27. Complaints
28. Disputes, governing law and courts
29. Transfer of the agreement
30. General
31. Contact us

1. About these Terms

1. These Terms of Service (the "Terms") are a binding agreement between you and SITEBOMAWEB SOLUTIONS, a business registered in Kenya under the Registration of Business Names Act (business registration number BN-VZSEZ87P), which trades as SiteBoma through siteboma.co.ke and siteboma.com ("SiteBoma", "we", "us", "our"). Our full contact details are in section 31.
2. "You" means the person or organisation that opens an account with us, orders or pays for a Service, or uses one. If you accept these Terms for a company, organisation or someone else, you confirm that you are authorised to do so. The organisation is then bound, and you are bound together with it.
3. Our agreement with you (the "Agreement") is made up of: these Terms, including the Acceptable Use Policy in section 8; our Refund Policy; our Privacy Policy; the description, price and billing cycle of the Service shown on our website, in your order or on your invoice; and, for some Services, a written quote or the third-party terms described in section 14.
4. If documents conflict, this order applies, highest first: a written agreement signed by both of us; a written quote you accepted; the Refund Policy (for refunds only); these Terms; other policies and website pages.
5. You must be at least 18 years old and legally able to enter into contracts.
6. You accept these Terms by ticking the acceptance box when you register or check out, by paying an invoice, or by using a Service. An electronic acceptance is as binding as a signature. We keep a record of when and which version you accepted.
7. Nothing in these Terms takes away any right you have under the law of Kenya that cannot be excluded or limited by a contract, including your rights under the Consumer Protection Act, 2012. Where a term would do so, it does not apply to that extent.

2. Definitions

1. "Service" means anything we provide to you: web hosting, dedicated servers, managed WordPress, domain names, email hosting, SSL certificates, Microsoft 365, Google Workspace, AI coding credits, website design and development, online stores, M-Pesa integrations, SEO, maintenance, monitoring, security services and any other product or service we sell.
2. "Client Area" means your account dashboard at siteboma.com/client.
3. "Your Content" means all websites, files, code, databases, emails, domain content and other material that you or your users store on, send through or publish with a Service.
4. "Fees" means the prices for a Service shown on our website, in a quote or on your invoice.
5. "Business Day" means Monday to Friday, excluding public holidays in Kenya.
6. Words such as "including" and "for example" do not limit the words before them.

3. Your account

1. You must give us accurate, complete and current information, and keep it up to date, especially your email address, because that is where we send invoices and notices.
2. You are responsible for keeping your passwords and access details secret, for your Client Area and for every login we give you (control panel, FTP, email, databases, CMS). You are responsible for everything done through your account or those logins, unless it happened because we failed to meet our obligations under these Terms.
3. Tell us straight away if you think someone has used your account without permission.
4. We may ask you to verify your identity or your authority, for example before changing account details, releasing a domain transfer code or giving access to another person. We may refuse instructions we cannot verify.
5. We treat the person registered as the account holder as our customer. If people disagree about who controls an account or a domain, we may freeze changes until they show us an agreement between them or a court order. We will not decide the disagreement ourselves.
6. We may refuse to open an account or to accept an order, for example where we suspect fraud or misuse.

4. Orders and when the contract starts

1. You can order through our website, your Client Area, our chat, email or a support ticket. Before you order, the product page, checkout page or invoice shows what the Service is, its total price, the currency, any taxes and fees, the billing cycle, how it renews and how to cancel. At checkout you can review and correct your order, and you choose whether to accept these Terms, before you pay.
2. An order is your offer to buy. The contract for that Service starts when we accept it, which happens when we issue the invoice or start the Service, whichever is first.
3. If a price on our website is clearly a mistake, we may cancel the order and refund anything you paid for it before the Service starts.
4. Hosting is normally set up automatically once payment is confirmed. A domain name is not yours until the registry confirms the registration, and someone else may register it first. If we cannot register it, we refund what you paid for it.
5. Our order and invoice emails include a link to the version of these Terms that applies, and every version stays available. You can save or print them at any time, and we will email you a copy on request.

5. Fees, billing and payment

1. Prices and currency. Prices are in Kenya Shillings (KES) unless stated otherwise, and payments are charged in KES. Where we show a price in another currency, for example US dollars on siteboma.com, it is a guide; a card from outside Kenya is converted by your bank. Any conversion charges or fees from your bank or payment provider are yours.
2. Taxes. Each invoice shows the total you pay, including any tax. We charge Value Added Tax or other taxes only where the law requires us to, and we issue electronic tax invoices through the Kenya Revenue Authority's eTIMS system where the law requires. If a tax rate changes, or a new tax applies to a Service, the price for the affected period changes by the same amount. You are responsible for any taxes that apply to you, including withholding tax where it applies.
3. Payment in advance. Services are paid in advance for each billing period (for example monthly or yearly). One-off work is paid as set out in section 15.
4. How to pay. You pay an invoice on the secure checkout page of our payment provider, Paystack, by M-Pesa or by card, or with credit on your SiteBoma account, or by another method we agree with you. A payment counts only when the funds have reached us and been confirmed.
5. Renewal. Recurring Services renew for the same period unless you cancel them before the due date. We send a renewal invoice, normally up to 30 days before the due date, and reminders. You must pay renewals even if a reminder does not reach you. We do not store card details and never charge you automatically.
6. Price changes. We may change the price of a Service for future billing periods. We will tell you at least 30 days before a new price applies to you. If you do not agree, you may cancel before the change takes effect. A promotional or discounted price applies only to the period stated in the offer.
7. Late payment. If an invoice is not paid by its due date, we may suspend the Service 7 days after the due date and terminate it 30 days after suspension, as described in section 6. An order for a new Service that is still unpaid 14 days after its invoice was due is cancelled automatically.
8. Questions about a charge. If you think an invoice is wrong, tell us within 30 days of receiving it, and pay any part you do not dispute.
9. Reversals and chargebacks. Please contact us before reversing a payment or asking your bank for a chargeback; most problems are solved faster directly. If a payment is reversed, we may suspend the Services it paid for until the matter is resolved, and the amount becomes due again.
10. Account credit. Credit on your SiteBoma account (for example from an overpayment, a top-up, a refund we agreed to give as credit, or affiliate earnings) can be used only to pay for our Services. It cannot be transferred to another person. It is not exchanged for cash unless we agree or the law requires it.
11. Discount codes. Only one discount code can be used per order. Each code has its own conditions, has no cash value and may be withdrawn if it is misused.
12. Refunds. Refunds are governed by our Refund Policy. In short: new hosting has a 7-day money-back guarantee; domain registrations, renewals, transfers and other third-party products are not refundable once processed; one-off work that has started is refunded only for the part not yet done.

6. Cancellation, suspension and termination

1. You can cancel any Service at any time from your Client Area or by opening a support ticket. Unless you ask for it to end immediately, a Service ends at the end of the period you have paid for. Unused time is not refunded, except under the Refund Policy or where the law requires it.
2. We may suspend all or part of a Service, without notice where that is reasonably necessary, if:
   1. an invoice is unpaid 7 days after its due date;
   2. you or your users break these Terms, including the Acceptable Use Policy;
   3. the Service is hacked, infected or being used to attack, spam or defraud others;
   4. your use is harming the server, our network or other customers;
   5. a court, a regulator or the law requires it, or we receive a credible report of unlawful content;
   6. we reasonably suspect fraud, or a payment is reversed;
   7. it is needed to protect our systems, other customers or third parties.
   Where it is practical and lawful we tell you why, and we restore the Service once the problem is fixed and any amount due is paid.
3. We may terminate a Service or your account: if a suspended Service is still unpaid 30 days after suspension; if you seriously or repeatedly break these Terms, or do not fix a breach within 7 days of our notice (or straight away for serious or unlawful conduct); or if the law requires it. We may also stop offering a Service altogether by giving you at least 30 days' notice, in which case we refund the unused part of any period you have already paid for.
4. When a hosting Service ends, your access stops and Your Content on it is deleted. We have no duty to keep it after termination and may not be able to recover it. Download everything you need before then. We may keep billing records and anything the law requires us to keep.
5. Domain names stay registered to you until they expire, even if your hosting ends. You can transfer them to another provider as described in section 13.
6. Sections that by their nature should continue after the Agreement ends do so, including sections 5, 9, 18 to 24, 28 and 30.

7. Hosting rules and fair use

1. Shared hosting means your website runs on a server shared with other customers. Each plan has the limits shown on its product page, such as disk space, number of websites, mailboxes and databases.
2. "Unlimited" and fair use. Where a plan is described as unlimited or unmetered, it has no fixed quota, but normal fair-use rules and per-account limits on processor, memory, processes and disk activity still apply to keep the server fast for everyone. At present each account may use about 2 processor cores and 2 GB of memory at a time. A site that reaches these limits may slow down or show errors until the load drops. If your use is consistently above what a plan is meant for, we will ask you to reduce it or move to a larger plan or server.
3. Not allowed on shared hosting: storing backups, archives or files not used by your website; file sharing or media streaming; cryptocurrency mining; proxies or VPNs; game or chat servers; bulk scraping or bots; long-running background processes; and anything else that places a heavy load on a shared server.
4. Email. We limit how many emails an account can send per hour to protect the server's reputation. Newsletters and other bulk email must go only to people who agreed to receive them and must include a working unsubscribe link. We may limit or stop sending from an account that causes complaints or gets the server blocklisted.
5. Your software. You must keep the software you install (for example WordPress, its plugins and themes) up to date and secure. Outdated software is the most common way websites are hacked.
6. Server changes. We may update server software, PHP versions and the control panel. We try to give notice of changes that could affect your site. You are responsible for keeping your code compatible.
7. Migrations. Free migration of an existing website is done on a best-effort basis. Check your site after the move and keep your old copy until you are satisfied.
8. IP addresses and nameservers we provide remain ours or our providers'. You do not own them.
9. Dedicated servers and managed services are also subject to the specification and any extra terms in your quote or order. If you have administrator (root) access, you are responsible for the server's security and for everything done with that access.
10. Where your data is. Our hosting servers are run by data-centre partners outside Kenya, currently in the United Kingdom. Section 19 explains how we protect personal data stored there.

8. Acceptable Use Policy

This Acceptable Use Policy applies to you and to everyone who uses your Services, such as visitors to your website and users of your mailboxes. You are responsible for their use.

1. You must use the Services lawfully, in line with the laws of Kenya and of any country where you or your users are.
2. You must not use any Service to store, publish, send, sell or link to:
   1. child sexual abuse material of any kind. We report it to the authorities and close the account without notice;
   2. material that infringes copyright, trademarks or other rights, including pirated software, films, music or books, and counterfeit goods;
   3. phishing pages, fraudulent or fake shops, scams, pyramid or Ponzi schemes, or offers of investment, lending, forex, cryptocurrency or betting services without the licence Kenyan law requires;
   4. malware, viruses, ransomware, botnets, command-and-control servers, exploit kits or hacking tools used against others;
   5. hate speech, incitement to violence, terrorist content, or material that is otherwise unlawful under the Computer Misuse and Cybercrimes Act, 2018, the National Cohesion and Integration Act, 2008, the Prevention of Terrorism Act, 2012, the Sexual Offences Act, 2006, the Penal Code or any other law;
   6. pornographic or obscene material;
   7. illegal drugs, weapons, wildlife products or other goods or services that are illegal to sell;
   8. other people's personal data collected or used unlawfully, or private information published to harass or endanger someone;
   9. content that impersonates another person, business or brand.
3. You must not:
   1. send spam or unsolicited bulk email or SMS, or buy, harvest or misuse email address lists;
   2. attack, scan, probe or gain unauthorised access to any system or network, including ours, or take part in a denial-of-service attack;
   3. test the security of our systems without our written permission;
   4. interfere with other customers' use of the Services, or try to get around account limits or security controls;
   5. run open mail relays, open proxies or anything that lets others misuse the Services anonymously;
   6. use the Services in a way that gets our servers or IP addresses blocklisted.
4. What we may do. We do not monitor Your Content routinely. When we learn of a possible breach, we may investigate; remove or disable access to content; reset passwords; suspend or terminate Services; preserve information; and report the matter to, and cooperate with, the police, courts, regulators and other authorities where the law requires or allows it. We are not obliged to give you notice first where notice would be unlawful or would make harm more likely.
5. Reporting abuse. To report spam, phishing, malware or other unlawful use of a Service, email [email protected] with the exact web address or other location, what is wrong, and your contact details. We look into every report.
6. Copyright takedown notices. Our designated address for takedown notices under section 35B of the Copyright Act is [email protected], and formal notices may also be delivered to our address in section 31. A notice must be in writing and signed, and must give: the full name and contact details of the person complaining; the work said to be infringed and the rights claimed in it; the exact location of the material (for example its web address); and a sworn statement that the information is true and that the complainant owns the rights or is authorised to act for the owner. The law also requires the complainant to copy the notice to the Kenya Copyright Board and the other bodies named in the Act. When we receive a valid notice, we send a copy to our customer as soon as practicable and remove or disable access to the material within 48 business hours, unless the customer sends us a valid counter-notice explaining why the material is lawful. Disagreements between the complainant and our customer are for them, or a court, to settle; we do not decide them. Sending a false notice is an offence. We terminate the accounts of repeat infringers.
7. Orders from authorities. We comply with court orders and lawful requests under the Computer Misuse and Cybercrimes Act, 2018 and other laws, for example to preserve or produce data. The law may forbid us from telling you about such a request.

9. Your content

1. You keep ownership of Your Content. You give us permission to store, copy, back up, transmit and display it only as needed to provide the Services and to comply with the law.
2. You alone are responsible for Your Content and for your website and its users, including: having the rights and licences to use it; making sure it is lawful and accurate; and having your own terms, privacy notice and cookie notice for your website where the law requires them.
3. The people who use your website or buy from you are your customers, not ours. We have no agreement with them and no responsibility to them for your business.

10. Security and backups

1. We take reasonable technical and organisational measures to protect the Services, appropriate to the type of Service. No system connected to the internet is completely secure, and we cannot promise that the Services will never be attacked or interrupted.
2. Our backups. Where a plan's description includes backups, we make them on the schedule described, keep them for a limited time and restore from them on request on a best-effort basis. Backups are a safety net. A backup can fail, can be incomplete, may not include changes made since it was taken, and may not be possible to restore. We do not guarantee that a particular backup will exist or can be restored.
3. Keep your own backups. You are responsible for keeping your own regular, complete and up-to-date copies of Your Content, stored somewhere other than our servers, so that you can recover even if our backups are not available. This is especially important before you update software, install plugins or make large changes.
4. Hacked or infected accounts. If a Service is compromised, we may isolate or suspend it, reset passwords, disable features such as remote publishing, and remove malicious files, to protect you, other customers and the public. We tell you what we did. Repairing and securing your website remains your responsibility, although we may offer to help as a paid service.

11. Availability, maintenance and support

1. Uptime target. We aim for our shared hosting servers to be available 99.9% of the time in each calendar month. Our monitoring results and incidents are published on our status page. This is a target, not a guarantee.
2. The target does not cover: scheduled maintenance (we try to announce it in advance and to do it at quiet times); urgent security maintenance; problems caused by Your Content, your software or your actions; problems with third-party services, your internet provider or your domain's DNS; suspensions under these Terms; attacks on the network; and events described in section 24.
3. Service credit. If, for reasons within our control, a hosting Service is available less than 99.9% of the time in a calendar month, you may ask for a credit within 30 days after the end of that month. We credit your account with 10% of that month's fee for the affected Service if availability was below 99.9%, 25% if below 99%, and 50% if below 95%. The credit is added to your SiteBoma account and is not paid out in cash. To the extent the law allows, this credit is your only remedy for unavailability of the Service.
4. Support is provided through support tickets, live chat, email and phone. We aim to respond quickly, but response times are targets, not guarantees. Support covers our Services. It does not include building or fixing your website, code or third-party software, unless you buy that as a professional service.

12. Our automated assistant and AI services

1. Our chat assistant is automated. The assistant in our website chat and some automatic replies on support tickets are produced by artificial intelligence. They can be incomplete or wrong. Their answers are general information, not a binding offer, promise, quotation or professional advice. Your invoices, the details in your Client Area, written replies from our staff and these Terms are what count. If an automatic answer conflicts with them, they prevail.
2. Never send passwords, card numbers or other secrets in a chat or ticket. Chat and ticket messages may be processed by our AI technology providers, as explained in our Privacy Policy.
3. AI coding credits and other AI features give you access to AI models run by third parties. Code and text produced by AI may be inaccurate, insecure, or similar to existing works. You must review and test anything AI produces before you use or publish it, and you are responsible for what you use. Usage limits apply as described on the product page; when an allowance is used up, the feature stops until it renews. Do not enter personal data or confidential information into AI tools unless you are entitled to share it.

13. Domain names

1. Who registers your domain. We register and manage domain names as a reseller of domain registrars accredited by the relevant registry. On request we will tell you which accredited registrar sponsors your domain. Every domain is also subject to the rules of its registry and registrar, which form part of your agreement for that domain and which you agree to follow:
   • for .ke names: the policies of the Kenya Network Information Centre (KENIC), published at kenic.or.ke, including the .KE Alternative Dispute Resolution Policy;
   • for .com, .org and other generic names: the policies of ICANN and of the registry, including ICANN's Registrants' Benefits and Responsibilities (see also ICANN's registrant education page), the Uniform Domain-Name Dispute-Resolution Policy, the Transfer Policy and the Expired Registration Recovery Policy;
   • for other country-code names: the policies of that country's registry.
2. You are the registrant. Each domain is registered in your name, or the name of the organisation you tell us, as the registrant. You must give accurate and complete registrant details and update them within 7 days of any change. Giving wilfully false or inaccurate details, or not replying within 15 days to a request to confirm them, is a serious breach and can lead to the domain being suspended or cancelled. You must also answer any email asking you to verify your contact details; for many domain extensions the domain is suspended if this is not done within 15 days.
3. Your registration data. To register and manage a domain we must give your registrant details to the registrar and the registry, which may be outside Kenya. They use them to run the registration, to publish or withhold them in public registration data (WHOIS and RDAP) under their rules and the law, and to deal with disputes and abuse. By ordering a domain you agree to this.
4. Eligibility. Most extensions are open to anyone. Some have rules and need documents: for example .ac.ke for tertiary institutions, .sc.ke for schools and .go.ke for the government. You confirm that you meet the rules for any domain you register and will provide the documents the registry asks for. A restricted domain is not registered until the registry approves the documents.
5. Your promises about the name. You confirm that, to the best of your knowledge, registering and using the domain does not infringe anyone's rights or break the law, and that you will not use it for a purpose the registry's policies prohibit. A domain registration is not ownership of a trademark, and a registry may suspend or cancel a registration under its policies.
6. Disputes about a domain are decided under the registry's dispute policy (for .ke names the .KE Alternative Dispute Resolution Policy, and for generic names the Uniform Domain-Name Dispute-Resolution Policy) or by a court. You agree to take part in those procedures where they apply. For a dispute about the use of a generic domain name, you also accept the jurisdiction of the courts where you live and where the sponsoring registrar is located. A domain cannot be transferred or deleted while such a dispute is open. We follow the decision or court order and do not decide disputes ourselves.
7. You will indemnify the registry and the registrar against claims arising from your registration or use of the domain, as their policies require.
8. Renewal is your responsibility. We send renewal invoices and reminders before the expiry date (normally about one month and one week before) and after it, but you must pay in time. Renewal and restore prices are shown on our domain pages and invoices. After expiry a domain stops working. For generic domains it may be renewed during a grace period and then, for some extensions, restored for about 30 more days for an extra registry fee before it is released. For .ke domains, the website and email stop around 15 days after expiry, restoring the domain later in the cycle may carry an extra registry fee, and the domain is deleted around 90 days after expiry. A released or deleted domain may be registered by someone else. We are not responsible for a domain lost because a renewal was not paid in time.
9. Transfers. You may transfer a domain to another provider. We give the transfer (EPP) code to the registrant within 5 days of a request, after verifying their identity. A transfer may be refused in the cases the registry's rules allow, for example within the periods after registration, after a previous transfer or after a change of registrant set by ICANN's Transfer Policy (currently 60 days), while a dispute is open, or while the fee for the current registration period is unpaid.
10. Privacy protection, where we offer it, is subject to its provider's terms and may be lifted where the law, a dispute policy or a court requires it.
11. Domain registrations, renewals, transfers and restorations cannot be refunded once processed, because the registry fee cannot be recovered.
12. DNS and email for a domain are provided by us only while you have an active Service that includes them.

14. Third-party services and resold products

1. Some Services are supplied by other companies and resold or arranged by us, for example Microsoft 365, Google Workspace, SSL certificates, domain registrations, payment processing and AI models. The provider's own terms also apply to those Services, and by ordering them you accept those terms. We are responsible for our part, which is selling, setting up and supporting the Service, but not for the provider's own acts, outages, policy changes or price changes. If a provider raises its price, we may pass the change on with notice under section 5.
2. Microsoft 365. Microsoft provides the service under the Microsoft Customer Agreement. You must accept that agreement before we can set up your subscription, and we may ask you to confirm your acceptance in the Microsoft 365 admin centre. Licences are subscriptions for a fixed term, usually one year. Microsoft allows a new or renewed subscription to be cancelled for a pro-rata refund only within 7 days of its start, and licences cannot be reduced after that. To give us time to process it, send a cancellation request no later than 6 days after the start. After that, the full term is payable and cannot be refunded, cancelled or reduced until it ends. Your data in Microsoft 365 is held by Microsoft under its terms, and we are not responsible for the Microsoft service itself.
3. Google Workspace is provided by Google under the Google Workspace terms, which you accept when the service is set up. Subscription terms and cancellation follow Google's rules for the plan you choose.
4. SSL certificates are issued by independent certificate authorities after they validate your details. We cannot guarantee that a certificate will be issued or how long validation will take. Paid certificates cannot be refunded once issued. Free certificates we install automatically are provided as they are.
5. Payments are processed by our payment provider, Paystack, by card or by Safaricom M-Pesa. Paystack handles your card or M-Pesa details on its own systems under its own terms. We are not responsible for its delays, failures or decisions, or those of the banks and networks behind it, for example a bank declining a card or a reversal handled under Safaricom's rules.

15. Website design and other professional services

This section applies to website design and development, online stores, M-Pesa integrations, SEO, speed optimisation, website maintenance, website monitoring, migrations and other work we do for you ("Professional Services").

1. Scope. What we will do is set out in the package description and in the quote, order, email or ticket in which we agree the work. Anything outside that scope is extra work, which we quote separately before doing it.
2. Payment. Unless we agree otherwise in writing, the Fee for a project is paid in advance. Where we agree payment in instalments, work starts after the first payment and we hand over the finished work, or make it live, after the final payment.
3. Your part. You give us the content, images, logos, information, access and decisions the work needs, on time, and you confirm you have the right to let us use them. Delays on your side extend the timeline. If a project is on hold for 60 days because we are waiting for you, we may close it; we then deliver the work done so far and the Fee already paid is not refunded.
4. Timelines are agreed with you for each project and are good-faith estimates, not guaranteed delivery dates.
5. Changes and revisions. Each package includes the revisions described in it or, if none are described, a reasonable number of rounds of changes within the agreed scope. New features or a change of direction are extra work.
6. Acceptance. When we deliver work, you have 7 days to tell us in writing of anything that does not match what we agreed. If you do not, or if you start using the work publicly, it is accepted. We fix any defect you report within 30 days after acceptance, where the defect is in work we did within the agreed scope, at no extra cost.
7. Ownership. Once the project is paid in full, you own the design, text and code we created specifically for you. We keep ownership of our own tools, templates and know-how, and you get a permanent licence to use any of them included in your work. Third-party themes, plugins, fonts, images and software stay subject to their own licences, some of which need renewing. Until you pay in full, the work remains ours and we may withhold it. We may show the finished work in our portfolio unless you ask us not to.
8. M-Pesa integrations depend on Safaricom. You must hold the Paybill or Till, your agreement with Safaricom and the credentials needed. Safaricom decides whether and when to approve your integration, and we cannot guarantee its approval or timing. You are responsible for checking that payments are recorded correctly in your system and for reconciling them with your M-Pesa statement.
9. SEO and marketing. Search engines decide rankings. We do the agreed work with reasonable skill, but we do not guarantee any ranking, amount of traffic, number of leads or sales.
10. Maintenance and monitoring cover only the tasks described in your plan. Monitoring alerts are provided for information; they do not prevent problems and we do not guarantee that every problem is detected.
11. Refunds for Professional Services follow the Refund Policy. Once work has started, a refund covers only the part of the work not yet done, as we reasonably assess it.

16. Security testing services

This section applies to security audits, penetration testing, incident response and managed security services.

1. Written authorisation first. We test only systems that you own or that you are authorised in writing to have tested. Before any testing, you must give us a signed authorisation from the owner of each system, describing the systems in scope, the time window and any limits. Testing a system without its owner's permission can be an offence under the Computer Misuse and Cybercrimes Act, 2018. You confirm the authorisation you give us is genuine and complete, and you are responsible for any claim made because it was not.
2. Testing can slow down or interrupt systems or affect data. You must make full backups before testing begins. We take reasonable care, but we are not responsible for disruption that is a normal result of the testing you authorised, unless we were grossly negligent.
3. A security assessment shows what was found at the time of testing. It cannot find every weakness or guarantee that a system is secure. Incident response aims to contain and recover from an incident but cannot guarantee that all data or systems will be recovered.
4. We keep your findings and reports confidential, as described in section 20.

17. Affiliate programme

1. If you join our affiliate programme, this section and the programme rules on our Affiliates page and on your affiliate page in the Client Area apply. Joining is subject to our approval.
2. You promote SiteBoma as an independent person. You are not our employee, agent or partner, and you may not make promises or agreements for us.
3. Commission is earned only on the hosting payments of new customers who sign up through your link or code, at the rate shown on your affiliate page. It becomes payable 7 days after each payment and is cancelled if that payment is refunded or reversed within that time. Payouts are made as described on your affiliate page, and statements are emailed monthly. You are responsible for any tax on your earnings.
4. You must not: send spam; make false or misleading claims about us or our prices; bid on the SiteBoma name or misspellings of it in search advertising; refer yourself, people at your own address or phone number, or fake accounts; or use any trick that credits you for customers you did not refer. If you do, we may withhold or cancel commission and close your affiliate account.
5. We may change or end the programme by giving 30 days' notice. Commission that has become payable before the end date is still paid.

18. Intellectual property

1. Our website, brand, logos, software, documentation and the way we present our Services belong to us or our licensors. You get only the rights needed to use the Services under these Terms.
2. If you send us suggestions or feedback, we may use them freely without paying you.

19. Data protection

1. Your account data. We collect and use personal data about you and your contacts (for example names, email addresses, phone numbers, billing details, support and chat messages) as a data controller under the Data Protection Act, 2019. Our Privacy Policy explains how.
2. Personal data in Your Content. Where Your Content includes personal data, for example the details of your website's users or customers, or the messages in your mailboxes, you are the data controller and we process that data for you as your data processor. This section, together with the rest of the Agreement, is our written contract for that processing under section 42 of the Data Protection Act, 2019 and regulation 24 of the Data Protection (General) Regulations, 2021:
   1. What and why: we store, host, transmit, back up and delete the personal data in Your Content, for the purpose and for as long as needed to provide the Services you ordered. The kinds of personal data and of people concerned are whatever you choose to put in Your Content;
   2. Your instructions: we process it only to provide the Services, on your instructions as set out in the Agreement and given through your use of the Services, or where the law requires. We tell you if we believe an instruction breaks the law;
   3. Confidentiality: everyone who can access it on our behalf is bound to keep it confidential;
   4. Security: we keep appropriate technical and organisational security measures in place, including encrypted connections, access controls and account isolation on our servers;
   5. Other processors: you authorise us to use other processors where needed to provide the Services, namely our data-centre and server providers, our email delivery and filtering providers, domain registrars and registries, and Microsoft or Google for their own services. We bind them to obligations that protect the data at least as well as this section, we remain responsible to you for them, and we will tell you, by email or by updating this section, before we add or replace one, so that you can object or cancel the affected Service;
   6. Breaches: we tell you without delay, and where reasonably practicable within 48 hours, after we become aware of a personal data breach affecting your data, so that you can notify the Data Protection Commissioner within 72 hours and the people affected where the law requires;
   7. Help with rights and duties: where reasonable, we help you respond to requests from people exercising their data protection rights and meet your security, breach and data protection impact assessment obligations. We may charge for help that takes significant time;
   8. End of the Service: you can download Your Content until the Service ends, and you can ask us to delete it sooner. After the Service ends we delete it as described in section 6, and copies left in our backups are erased as those backups are overwritten in their normal cycle, unless the law requires us to keep it;
   9. Audits: we give you the information you reasonably need to check that we meet these obligations and answer reasonable written questions. Any on-site inspection must be agreed in advance, take place on a Business Day, respect the confidentiality of other customers, and be at your cost.
3. Data stored outside Kenya. Our hosting and email servers are outside Kenya, currently in the United Kingdom, the United States and the Netherlands (Business Email mailboxes are kept in the Netherlands, in the European Union), and some of our technology providers are in other countries. When you use the Services, you instruct us to store and process Your Content there. We use providers that are bound by contract to protect the data, and the United Kingdom has data protection law similar to Kenya's. As the data controller for your users' data, you are responsible for making sure you may transfer it outside Kenya, including telling your users and getting their consent where the law requires it, for example for sensitive personal data such as health data.
4. Data that must stay in Kenya. Regulation 26 of the Data Protection (General) Regulations, 2021 requires some processing, for example for basic or early childhood education, primary or secondary health care, civil registration, elections, public finance and protected computer systems, to be done through a server or data centre in Kenya, or at least to keep a serving copy in Kenya. Our servers are outside Kenya. If this applies to you, you must keep the required copy in Kenya yourself, or tell us before ordering so that we can discuss options.
5. As the data controller for your users' data, you are responsible for complying with the Data Protection Act, 2019, including having a lawful basis for processing, giving privacy notices, and registering with the Office of the Data Protection Commissioner if the law requires you to.
6. We may disclose data where the law, a court order or a lawful request from an authority requires it. Where the law allows, we tell you about the request.

20. Confidentiality

1. Each of us will keep confidential any non-public information received from the other that is marked confidential or is obviously confidential, and will use it only for the purposes of the Agreement. This does not apply to information that is already public, that the other already had, that is received lawfully from someone else, or that must be disclosed by law or by a court.

21. Our promises and disclaimers

1. We will provide the Services with reasonable care and skill, and in line with their description.
2. If you are a consumer, you also have the warranties and rights given by the Consumer Protection Act, 2012 and other law, and nothing in these Terms takes them away.
3. Apart from those, and to the extent the law allows, the Services are provided "as is" and "as available". We do not promise that they will be uninterrupted or free of errors, that they will meet every one of your needs, that they will produce particular business results, or that third-party services will always work.

22. Limitation of liability

1. What we never limit. Nothing in these Terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud, fraudulent misrepresentation or wilful misconduct, or for anything else for which the law of Kenya does not allow liability to be limited or excluded, including your rights as a consumer under the Consumer Protection Act, 2012 and Article 46 of the Constitution.
2. Losses we are not responsible for. Subject to section 22.1, we are not liable to you for:
   1. loss of profit, income, revenue, sales, business, contracts, opportunity, goodwill or anticipated savings;
   2. loss or corruption of data or content, given your duty to keep your own backups under section 10;
   3. any indirect or consequential loss, or loss that was not reasonably foreseeable when the Agreement was made;
   4. loss caused by Your Content, your software, your equipment, your breach of these Terms, your users, or third-party services; or
   5. loss caused by a suspension or termination made in line with these Terms.
3. Maximum amount. Subject to section 22.1, our total liability to you for all claims arising out of or in connection with the Agreement or the Services, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the higher of: (a) the total Fees you paid us for the Service concerned in the 12 months before the event that gave rise to the claim (for one-off Professional Services, the Fee paid for that project); and (b) KES 5,000.
4. Our prices reflect this sharing of risk. You can protect yourself further by keeping your own backups and by taking out insurance that suits your business.
5. Time to claim. To the extent the law allows, a claim against us must be brought within 12 months after you became aware, or ought reasonably to have become aware, of the facts giving rise to it. This does not shorten any period the Consumer Protection Act, 2012 gives a consumer.
6. Our employees and contractors have no personal liability to you for the Services, except where the law makes them personally liable. Any claim must be brought against SiteBoma.

23. Your indemnity

1. To the extent the law allows, you will indemnify SiteBoma, its owner, employees and contractors against all losses, damages, fines, penalties, costs and expenses (including reasonable advocates' fees) arising from any claim, complaint, demand or regulatory action by a third party that results from: Your Content; your use of the Services in breach of these Terms or the law; the activities of your website or its users; a domain name registered for you; security testing you authorised; or your failure to meet your own obligations under the Data Protection Act, 2019.
2. If you are a consumer, this indemnity applies only to claims that result from unlawful or infringing content you put on the Services, or from your deliberate misuse of the Services.
3. We will tell you promptly about any such claim and, where practical, let you take part in defending it. We will not settle it in a way that makes you admit fault without your agreement, which you will not unreasonably refuse.

24. Events beyond our control

1. We are not responsible for any failure or delay caused by events beyond our reasonable control, including: power failures; failures of internet backbone or undersea cables; outages at data centres or upstream providers; internet shutdowns or other orders of a government or authority; cyber attacks and denial-of-service attacks; failures of payment networks; fire, flood, storms and other natural events; epidemics; war, terrorism, riots and civil unrest; strikes; and changes in the law. We will take reasonable steps to limit the effect and to restore the Services.

25. Changes to the Services and these Terms

1. We may improve or change the Services. We will not make a change that substantially reduces a Service you have paid for during the paid period without telling you first and, if the change is substantial and harms you, offering you a refund of the unused part of that period.
2. We may update these Terms, for example to reflect changes to our Services or the law. We publish the new version on this page with its effective date. For changes that substantially affect your rights, we also tell you by email or in your Client Area at least 30 days before they take effect, unless a shorter time is required by law or for security. If you do not agree with a change, you may cancel the affected Service before the change takes effect, and we refund the unused part of any period you have paid for. If you keep using the Services after the effective date, the new version applies.

26. Notices and communications

1. We send notices to the email address on your account, in your Client Area or by SMS. A notice sent by email is treated as received on the next Business Day after it is sent. Electronic notices and records meet any legal requirement for writing.
2. You send notices to us at [email protected] or through a support ticket. Formal legal notices must also be delivered to our address in section 31.
3. By using the Services you agree to receive messages about your account and Services, such as invoices, renewal reminders, security alerts and service notices. You can unsubscribe from marketing messages at any time.

27. Complaints

1. If you are unhappy with any part of our service, please open a support ticket or email [email protected] with "Complaint" in the subject. We acknowledge complaints within 2 Business Days and aim to resolve them within 14 days. If you are not satisfied with our answer, ask for the complaint to be reviewed by the owner of the business, who will reply in writing.
2. If we still cannot agree, you may contact the Competition Authority of Kenya about consumer matters, or the Office of the Data Protection Commissioner about the handling of personal data. This does not affect your other rights under section 28.

28. Disputes, governing law and courts

1. The Agreement and any dispute or claim arising out of or in connection with it, including non-contractual disputes, are governed by the laws of Kenya. If you live outside Kenya, this does not take away any protection given to you by the mandatory consumer laws of your country.
2. Talk to us first. Before starting legal proceedings, the party with the complaint must send the other a written notice describing it, and both of us must try in good faith to settle it for 14 days. If that does not work, either of us may propose mediation, by a mediator we agree on or through the Nairobi Centre for International Arbitration, for up to 30 more days. Mediation is voluntary and does not stop a consumer from going to court.
3. If the dispute is not settled, it may be taken to the courts of Kenya, and proceedings will be brought in Nairobi where the court has jurisdiction. Nothing in these Terms stops a consumer from bringing a claim in any court that has jurisdiction under Kenyan law, including the Small Claims Court, or from taking part in a class or representative proceeding where the law allows. We may also bring a claim for unpaid Fees in the Small Claims Court or in the courts of the country where you live.
4. Disputes about the registration or use of a domain name follow section 13. Either of us may ask a court at any time for urgent orders to protect our rights, data or systems.
5. If you live or do business outside Kenya, you are responsible for complying with the laws that apply to you there.

29. Transfer of the agreement

1. We may transfer the Agreement, including all our rights and obligations under it, to any person or company that takes over the SiteBoma business or the part of it that provides your Services, including a company owned or controlled by SiteBoma's owner. We will tell you about the transfer. Your rights under the Agreement will not be reduced as a result.
2. We may use subcontractors and suppliers to provide the Services. We remain responsible for our obligations to you.
3. You may not transfer the Agreement or a Service to someone else without our written consent. We usually agree to move a Service to another person's account on request through a support ticket.

30. General

1. The Agreement is the whole agreement between us about the Services and replaces anything said or written before it about the same subject. Nothing said by our chat assistant or in marketing material changes it.
2. If a court finds part of these Terms invalid or unenforceable, that part is changed to the minimum extent needed to make it valid, or removed, and the rest stays in force.
3. If we do not enforce a right straight away, we have not given it up.
4. Nothing in the Agreement makes either of us the partner, employee or agent of the other.
5. Only you and we have rights under the Agreement, except that the people protected by sections 22.5 and 23 may rely on those sections.
6. These Terms are written in English. If they are translated, the English version prevails. Headings are for convenience only.

31. Contact us

SITEBOMAWEB SOLUTIONS (SiteBoma), business registration number BN-VZSEZ87P

Registered place of business: 2nd Floor, Office B28, Valley View Office Park, Tower B, City Park Drive, Highridge, Westlands, Nairobi, Kenya

Support and notices: [email protected] · Phone: +254 754 550 099

Abuse and takedown notices: [email protected]

Version 2026-10, effective 19 October 2026. It replaces the version of April 2026. Earlier versions are available on request.