Privacy Policy
Last updated: September 2026 · Governing Entity: WIK Technologies Limited
01Regulatory Framework & Scope
WIK Technologies Limited ("WIK Technologies", "we", "us", or "our") operates the HotBill KE automated billing and MikroTik fleet operations platform. This Privacy Policy governs data processing practices in full compliance with the Kenyan Data Protection Act (KDPA 2019), guidelines issued by the Office of the Data Protection Commissioner (ODPC), and Safaricom Daraja M-Pesa merchant privacy regulations.
02Information We Process
- MSISDN (Mobile Phone Number): Solely used for dispatching Safaricom Daraja STK push requests and SMS transaction notifications.
- Network Identifiers: Client MAC address, allocated local IP address, and MikroTik router interface ID used for hotspot session authorization.
- Session Accounting: Duration of connection, bandwidth consumption (RX/TX bytes), and voucher PIN redemptions.
- Administrative Identity: Operator name, verified email address, phone number, and hashed passwords (bcrypt).
- Router Credentials: IP address, API port, and credentials stored under AES-256-GCM encryption.
- Payment & Settlement Ledger: M-Pesa receipt codes, transaction values in KES, and tenant commission statements.
03Purpose & Lawful Basis of Processing
Under Section 30 of the KDPA 2019, processing is executed under the lawful basis of contractual fulfillment, legal obligation, and legitimate interest:
- Facilitating real-time mobile money settlement via Safaricom Daraja.
- Automating network access provisioning and queue rate-limiting on MikroTik routers.
- Preventing financial fraud, replay attacks, and duplicate transaction claims.
- Auditing tenant billing integrity and telecommunications QoS performance.
04Data Retention & Disposal
Payment transaction receipts are preserved for 7 years to comply with statutory Kenyan tax and telecom record-keeping mandates. Ephemeral hotspot connection logs (active DHCP leases and stale MAC tables) are automatically reaped and purged by scheduled cron routines upon session expiration.
05Data Subject Rights & Privacy Contact
Pursuant to Part IV of the KDPA 2019, users have the right to request access to, correction of, or deletion of personal information. For inquiries, compliance audits, or data requests, contact our Data Protection Officer directly: