Overview
This Privacy Policy explains how DataRadius collects, uses, stores, and protects personal data. It applies to ISP operators who use the platform ("Customers") and to the subscribers whose data Customers process through the platform.
Data We Collect
From ISP Customers
Account registration details (name, email, phone number), billing information, workspace configuration, router and network device metadata, API usage logs, and support communications.
From Subscribers (via Customers)
Subscriber names, phone numbers (for M-Pesa billing), IP addresses, MAC addresses, RADIUS session data, payment transaction records, and service plan information. This data is processed on behalf of the ISP Customer, who is the data controller.
Automatically Collected
Server logs (IP address, user agent, request timestamps), performance metrics, and error reports. We do not use tracking cookies on our marketing site. The platform dashboard uses session cookies strictly for authentication.
How We Use Data
We use collected data to: provide and maintain the platform; process payments via integrated gateways (M-Pesa Daraja, card processors); authenticate users and enforce access controls; send transactional emails (account verification, payment receipts, alerts); monitor platform performance and prevent abuse; comply with legal obligations.
Data Sharing
We do not sell personal data. We share data only with: payment processors (to complete transactions); infrastructure providers (for hosting and delivery — see Sub-processors); law enforcement (when required by valid legal process). All sub-processors are bound by data processing agreements.
Data Storage and Security
Data is stored on servers located in the European Union. All data is encrypted at rest (AES-256-GCM) and in transit (TLS 1.2+). Access to production systems is restricted by role and logged. Backups are automated daily with point-in-time recovery.
Data Retention
Active account data is retained for the duration of the account. Payment records and audit logs are retained for 7 years as required by financial regulations. After account termination, Service Data is deleted within 30 days. Anonymized usage statistics may be retained indefinitely.
Your Rights
Under the Kenya Data Protection Act 2019 and applicable laws, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (subject to legal retention requirements); object to processing; receive your data in a portable format. ISP subscribers should contact their ISP (the data controller) to exercise these rights.
Children's Data
The platform is not directed at individuals under 18. We do not knowingly collect personal data from children.
Changes to This Policy
We will notify Customers of material changes via email at least 14 days before they take effect. The current version is always available at this URL.
Contact
For privacy-related enquiries, contact us at privacy@dataradius.net.