Privacy Policy

Effective date: 26 October 2026 · Last updated: 26 October 2026

This Privacy Policy explains how Mobitech Technologies Limited ("Mobitech", "we", "us") collects, uses, shares and protects personal data when you visit mobitechtechnologies.com, use our Bulk SMS, Short Code, USSD, Airtime, M-Pesa integration and WhatsApp Business messaging services, our client portals and our APIs (together, the "Services"). It has a dedicated section on our WhatsApp Business Platform integration, which uses Meta's WhatsApp Cloud API.

We process personal data in accordance with the Kenya Data Protection Act, 2019 and its regulations, and, where they apply to you, other data protection laws such as the EU/UK GDPR.

1. Who we are and our role

Mobitech Technologies Limited is a Kenyan company with offices at Commercial Centre, Ring Road, Westlands, Nairobi, Kenya, and at 1338 Wellington Street West, Ottawa ON K1Y 3B7, Canada.

• As a data controller, we decide how to use the personal data of our clients' account users, website visitors and people who contact us (for example names, work emails and phone numbers, billing details).
• As a data processor, we process personal data on behalf of the businesses that use our Services ("Clients"). This covers the phone numbers, names, message content and other details of the people our Clients message (their "Contacts"). The Client is the data controller for that data and decides why it is collected and what is sent. If you received an SMS or WhatsApp message from a business that uses Mobitech, please contact that business first; we will help them respond to you.

2. Data we collect

2.1 Data you give us

• Account and company details: company name, industry, website, contact person's name, email address, phone number and password (stored only as a one-way hash).
• Team members: names, emails and roles of colleagues you invite.
• Billing data: wallet top-ups, invoices and M-Pesa transaction details (phone number, amount, M-Pesa receipt number). We do not receive or store your M-Pesa PIN or full card numbers.
• Contact lists and content you upload: phone numbers, names, emails, tags, groups and any custom fields in the CSV files or API requests you send us, plus the message templates and messages you create.
• Support communications: messages you send us through email, phone, our website chat or WhatsApp.

2.2 Data we collect automatically

• Usage and technical data: IP address, browser and device type, pages visited, log-in times, API request logs and error logs.
• Message delivery data: sent, delivered, read and failed statuses, timestamps and error codes returned by mobile networks or by Meta.

2.3 Data we receive from third parties

• Meta Platforms (WhatsApp and Facebook Login for Business). See section 3.
• Mobile network operators and aggregators for SMS, short code and USSD delivery reports.
• Safaricom (M-Pesa) for payment confirmations.

3. WhatsApp Business Platform integration

Mobitech is a technology provider on Meta's WhatsApp Business Platform. Our WhatsApp portal and API let Clients connect their own WhatsApp Business Account ("WABA") and send and receive WhatsApp messages through Meta's WhatsApp Cloud API. Messages are delivered by WhatsApp; Mobitech never has access to anyone's personal WhatsApp account.

3.1 Connecting a WhatsApp Business Account

Clients connect a number either through Meta's Embedded Signup ("Continue with Facebook"), which uses Facebook Login for Business, or by giving us a system-user access token created in their Meta Business Manager. During Embedded Signup you sign in to Facebook on Meta's own pages. Mobitech never receives your Facebook password. When you finish, Meta gives us:

• your Meta Business Portfolio ID, WhatsApp Business Account ID and phone number ID(s);
• an access token limited to the permissions you approved: whatsapp_business_management (manage your WABA, phone numbers and message templates) and whatsapp_business_messaging (send and receive messages on your behalf);
• WABA and number details such as display name, verified name, currency, time zone, quality rating, messaging limit, verification and review status.

We use these only to provide the WhatsApp features you asked for. We do not use them to access any other part of your Facebook account, pages or ad accounts.

3.2 WhatsApp data we process

3.3 How the data flows

• Outgoing messages are sent from our platform to Meta's Cloud API over encrypted HTTPS connections. Meta then delivers them to the recipient's WhatsApp app.
• Incoming messages and status updates are sent by Meta to our webhook. We verify Meta's cryptographic signature on every webhook before accepting it.
• Meta's Cloud API processes message content on Meta's servers in order to deliver it. Meta's handling of that data is governed by the WhatsApp Business Terms of Service, the WhatsApp Business Data Processing Terms and the WhatsApp Privacy Policy.
• Where a Client chooses to receive events on its own systems, we forward the relevant message and status data to the Client's webhook URL, signed with a secret only that Client knows.

3.4 What we do not do with WhatsApp data

• We do not sell WhatsApp data or share it with advertisers or data brokers.
• We do not use one Client's WhatsApp data for another Client, and Clients' data is kept logically separate.
• We do not use message content to build advertising profiles or to train general-purpose AI models.
• We do not message anyone on our own initiative using a Client's WhatsApp number.

3.5 Responsibilities of Clients using WhatsApp

Clients are responsible for obtaining their Contacts' opt-in before sending WhatsApp messages, honouring opt-outs, having a lawful basis for the data they upload, and complying with WhatsApp's Business and Commerce Policies. See our Terms of Service.

4. How we use data and our lawful bases

5. Who we share data with

We share personal data only as needed to provide the Services, with:

• Meta Platforms (WhatsApp LLC and Meta Platforms Ireland Limited / Meta Platforms, Inc.) to deliver WhatsApp messages and manage WhatsApp Business Accounts.
• Mobile network operators and SMS aggregators to deliver SMS, short code and USSD traffic.
• Safaricom PLC to process M-Pesa payments.
• Infrastructure providers that host our servers and databases, and email providers that deliver log-in links and notifications.
• Website tools described in section 11.
• The Client that a Contact's data belongs to, including through that Client's own webhooks and API keys.
• Authorities such as the Office of the Data Protection Commissioner, the Communications Authority of Kenya or law enforcement, when the law requires it.
• A buyer or successor if our business is reorganised or sold, under equivalent protections.

Our service providers may only use the data to provide services to us and must protect it.

6. International transfers

Some providers, including Meta's Cloud API, process data on servers outside Kenya. When we transfer personal data outside Kenya, we do so in line with sections 48 to 50 of the Data Protection Act, 2019. We rely on appropriate safeguards, such as contractual data protection terms with the provider, or on another basis the Act permits.

7. How long we keep data

• Account data: while your account is active, then up to 90 days after closure unless you ask us to delete it sooner.
• Messages, conversations and contact lists: while the Client's account is active, or until the Client deletes them (deleting a contact deletes that contact's conversations and messages), and up to 90 days after account closure.
• WhatsApp media: not stored by us. Meta keeps media for about 30 days.
• Raw webhook event logs from Meta: 30 days, for troubleshooting.
• Billing and payment records: at least 5 years, as required by Kenyan tax law.
• Access tokens for WhatsApp: deleted when the Client disconnects the WhatsApp Business Account from our platform or closes the account.

8. Security

We use technical and organisational measures appropriate to the risk, including:

• HTTPS (TLS) encryption for our websites, portals, APIs and webhooks;
• encryption at rest (AES-256-GCM) for Meta access tokens and phone number PINs;
• passwords stored only as bcrypt hashes, and API keys stored only as SHA-256 hashes;
• verification of Meta's webhook signatures, and signed webhooks to Clients;
• role-based access for Client team members, and restricted staff access on a need-to-know basis;
• rate limiting, logging and monitoring.

If a personal data breach is likely to put people at risk, we will notify the Data Protection Commissioner within 72 hours, and affected Clients or individuals as the law requires.

9. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed about how your personal data is used;
• access your personal data;
• object to all or part of the processing;
• have inaccurate data corrected and false or misleading data deleted;
• data portability;
• withdraw consent where we rely on it.

To exercise these rights, email info@mobitechtechnologies.com. We will respond within the time limits set by law. If you are a Contact of one of our Clients, we will pass your request to that Client, who is responsible for it, and help them respond.

10. Data deletion requests

You can ask us to delete your data at any time. Our data deletion instructions explain how to disconnect your WhatsApp Business Account, remove Mobitech's access from your Meta Business settings and request deletion of all data we hold about you.

11. Cookies and website tools

• Essential cookies keep you signed in and protect forms against forgery.
• Google Analytics helps us understand how our website is used.
• Google reCAPTCHA protects our forms from spam.
• Live chat and WhatsApp chat widgets (Tawk.to and GetButton) let you talk to our team. Their providers process the messages you send through them.

You can block or delete cookies in your browser settings. Some features may not work without essential cookies.

12. Children

Our Services are for businesses and are not directed at children under 18. We do not knowingly collect children's data for our own purposes. Clients must not use the Services to message children without the consent required by law.

13. Changes to this policy

We may update this policy as our Services or the law change. We will post the new version here with a new "Last updated" date and, for significant changes, notify account owners by email or in the portal.

14. Contact us and complaints

Mobitech Technologies Limited (Attn: Data Protection Officer)
Commercial Centre, Ring Road, Westlands, Nairobi, Kenya
Email: info@mobitechtechnologies.com · Phone: +254 710 986 455

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner in Kenya.