Privacy Policy

Last updated: 2026-09-21

This Privacy Policy explains how SteboHost ("we", "us") collects, uses, shares, and protects personal data when you use our website, customer portal, and hosting, domain, email, SSL, and cloud services (together, the "Services"). It is written to comply with the Kenya Data Protection Act, 2019 ("DP Act") and, where applicable, the EU General Data Protection Regulation ("GDPR").

SteboHost is a Kenyan hosting and digital-infrastructure company. For the personal data we hold about our customers, visitors and support contacts, SteboHost is the data controller.

Office of the Data Protection Commissioner (ODPC) registration: our registration is in progress; the certificate number will be published on this page as soon as it is issued.

Data Protection Officer: support@stebohost.com · +254 703 610 464

Registered contact: SteboHost, Nairobi, Kenya.

If you host content or run applications on our infrastructure, you are the data controller for your own end-users' data and we act as your data processor — that relationship is governed by our Data Processing Agreement. This policy covers the data we process as a controller.

Account data — name, email address, phone number, country and billing address, chosen currency and language.

Billing data — invoices, payment references, VAT/tax identifiers (such as KRA PIN where applicable for eTIMS compliance). We do not store card numbers: card and M-Pesa payments are processed by our payment providers (Safaricom Daraja, Flutterwave, Pesapal, Paystack), and we receive only a payment reference and status.

Service data — domains registered or transferred on your behalf, hosting configurations, DNS records, email routing, support tickets.

Technical data — IP addresses, user-agent strings, session cookies, and security events (for example failed login attempts) collected in server and application logs.

Support data — the content of tickets and email correspondence with our support team.

Under the DP Act we process your personal data on these bases:

Performance of a contract — to provision, operate, secure, and support the services you purchase.

Legal obligation — tax and accounting records, domain registry requirements (including WHOIS data), and lawful requests from Kenyan authorities.

Legitimate interests — fraud prevention, abuse detection, network security, and service improvement, balanced against your rights.

Consent — marketing communications and optional cookies. You can withdraw consent at any time.

To provision, operate, and support the services you purchase

To process payments, issue invoices, and apply VAT/eTIMS requirements

To send service notifications: renewals, invoices, security alerts, incident notices

To register and renew domains with the relevant registries on your instructions

To prevent, detect, and investigate fraud and abuse of our infrastructure

To comply with applicable law, including tax and data-protection obligations

We do not sell personal data, and we do not use customer data to train advertising profiles.

We share personal data only with the processors needed to run the service, each under a written data-processing agreement:

Hetzner Online GmbH (Finland) — server infrastructure and hosting

Cloudflare, Inc. — DNS, CDN, and DDoS protection

OpenProvider — domain registration and management

Safaricom (Daraja) — M-Pesa payment processing

Flutterwave, Pesapal, Paystack — card and alternative payment processing

Mailgun — transactional email delivery

Africa's Talking — SMS notifications

Backblaze — encrypted offsite backup storage (B2)

CloudLinux — server isolation and security hardening

We also disclose data where required by Kenyan law, court order, or to protect the security of our infrastructure and other customers. A current subprocessor register with each party's role, location, and legal basis is available on request.

We never sell personal data, and we do not use customer data for unrelated marketing.

Our primary infrastructure is hosted in Helsinki, Finland (European Union). Where personal data is transferred outside Kenya, we rely on the safeguards required by the DP Act — data-processing agreements and, where applicable, EU standard contractual clauses — and we transfer only what is necessary for the service.

Active account data — retained while your account is active

Account data after closure — deleted 90 days after account closure, except where law requires longer

Billing and tax records — 7 years, per Kenyan tax law

Server and security logs — 90 days

Backups — rotated on your plan's published schedule; destroyed after account closure on the same schedule

Support tickets — 24 months after closure

We apply technical and organisational measures including: TLS 1.3 encryption in transit; encryption at rest for stored secrets; an envelope-encrypted secrets vault (secrets are never stored in application code or databases in plaintext); MFA for all staff access to production systems; audit logging of administrative actions; and least-privilege access reviews.

If a personal-data breach is likely to result in a risk to your rights, we notify you and the ODPC within the timelines required by the DP Act — without undue delay, and with a description of what happened, what data was affected, and what we are doing about it.

Under the DP Act (and GDPR where it applies) you can:

Access the personal data we hold about you

Correct inaccurate or incomplete data

Request deletion of your data, subject to legal retention requirements

Export your data in a portable format

Object to or restrict processing, and withdraw consent where processing is consent-based

To exercise any right, email support@stebohost.com from your account address. We verify identity before acting and respond within the timelines set by the Act. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC).

We use a small set of strictly necessary cookies: a session cookie to keep you signed in and a CSRF-protection cookie for form security. We do not run advertising or cross-site tracking cookies. If we introduce analytics cookies in future, they will be opt-in through the cookie banner before any are set.

Our services are not directed at people under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us and we will delete it.

We publish every change on this page with a new "last updated" date. Material changes that affect how we use your data are announced by email at least 14 days before they take effect.

Data Protection Officer: support@stebohost.com · +254 703 610 464

Postal address: SteboHost, Nairobi, Kenya.

You also have the right to complain to the Office of the Data Protection Commissioner (Kenya) if you believe your rights have been infringed.