Privacy Policy

Textline Africa Limited ("Textline Africa", "we", "us", "our")

Effective date: [EFFECTIVE DATE – to be set by Textline Africa on publication]

Last updated: [LAST UPDATED DATE]

This Privacy Policy explains how we handle personal data when you use:

• the Textline Africa Android app (package africa.textline.customer, the "App");
• our website at https://textlineafrica.com (the "Website"), including the subscriber portal; and
• the internet, installation and support services we provide (the "Services").

If you do not agree with this policy, please do not use the App. You can contact us at any time using the details in section 13.

1. Who we are

We are the data controller for the personal data described in this policy. We provide internet services in Kenya and the App is intended for use in connection with those Services.

2. Who the App is for

The App serves three groups of people, and different data is collected for each:

1. Subscribers (customers) – people who hold a Textline Africa internet account.
2. Field technicians – staff or contractors who install and repair connections.
3. Support and administrative staff – staff who handle tickets and subscriber communications.

You can only sign in to the App with an account that Textline Africa has already created for you (for subscribers, when you are connected or registered as a customer). The App does not currently let you create a new account yourself. The Website offers a registration form (see section 3.1).

The App is not directed at children. See section 11.

3. What we collect, why, and on what basis

3.1 Information you give us

3.2 Location

• Subscribers – router location (once). If prompted, the App asks for your device's precise location one time, while you are at your router, to record where your equipment is installed. You choose whether to allow it. This is used to plan and support the fibre network and to dispatch technicians accurately. Once recorded, the App does not keep tracking your location.
• Field technicians – location during working hours. For technician accounts, the App collects precise location, including in the background while the App is closed or not in use, to coordinate dispatch, show progress to customers and the operations centre, and verify service-level response. Collection is scheduled for roughly 07:00–19:00 East Africa Time; outside those hours the App is designed not to transmit locations. While tracking is active an ongoing notification is shown on the device. Technicians are asked for permission and can stop tracking by signing out. Technician location is not collected from subscriber accounts.

Along with technician location, the App sends the device's battery level and charging state, device name and model, mobile network type, speed and heading, and an approximate place name derived from the coordinates. When there is no signal the information is queued on the device and sent later.

3.3 Information collected automatically

We have not found advertising identifiers, third-party analytics SDKs, or crash-reporting SDKs in the App as of the date of the audit behind this document. [Confirm this remains true at release.]

3.4 Notifications and messages

We may contact you by SMS and WhatsApp (and email) about billing, expiry reminders, outages, installation and support. Messages are sent through the providers listed in section 5. You can opt out of marketing-type messages by replying to the message, using the in-app preference toggle where available, or contacting us. We will still send essential service messages (for example about your account or an outage affecting you). [Confirm whether in-app notification toggles are saved on the server before publication.]

The App also shows in-app notifications. The server contains support for delivering push notifications through Expo, but the current App build does not include a push-notification module [to be confirmed at release]. If push is enabled, we will store a push token and basic device details (platform, device model, app version) against your account.

3.5 Staff information

For employees and contractors, our systems also hold staff profile, role, roster, leave, onboarding and payroll records. These are used only to administer employment or engagement and are not shown to subscribers.

4. How we use personal data

• To provide, bill for, support and secure the Services and your account.
• To verify your identity and prevent fraud and unauthorised access.
• To process payments and reconcile them with your account.
• To dispatch, route and track technicians and to meet service-level commitments.
• To communicate with you about your account, outages and support.
• To improve the reliability and performance of our network and the App.
• To comply with legal, regulatory and tax obligations and to establish or defend legal claims.

Where the Kenya Data Protection Act, 2019 applies, we rely on: performance of our contract with you; compliance with legal obligations; our legitimate interests (network operation, security, fraud prevention, service quality); and your consent where we ask for it (for example device location permission and optional marketing messages). You can withdraw consent at any time (section 9), without affecting processing done before withdrawal.

We do not sell your personal data, and we do not use it for third-party advertising. [Confirm with management before publication.]

5. Who we share data with

We share data only as needed to run the Services, with the providers below (identified from our systems' configuration). The list should be reviewed whenever providers change.

We may also disclose data (a) to field technicians and support staff who need it for your job, (b) to professional advisers, (c) to a buyer or successor if our business is reorganised, and (d) to authorities, courts or regulators when the law requires or to protect rights, safety and security.

Service providers act on our instructions under agreements that require them to protect the data. [Confirm that data-processing agreements are in place with each provider.]

6. International transfers

Some providers above (for example Supabase, Meta, Google, Expo, and our hosting provider) may process data outside Kenya. Where we transfer personal data out of Kenya we will do so as the Data Protection Act, 2019 allows, for example where the destination has adequate protection, appropriate safeguards are in place, or you have consented. [Insert hosting regions and transfer safeguards – to be confirmed.]

7. How we protect data

Measures that we have verified in our software include:

• Traffic between the App and our servers uses HTTPS (the App's default server address is https://textlineafrica.com).
• The App stores sign-in tokens and cached profile data in the Android secure storage facility rather than in plain app preferences.
• Our API requires a valid session token for protected routes and enforces role-based separation between subscribers, support staff and administrators.
• Ticket attachment storage is configured as a private bucket with access by signed link.
• Payment endpoints include request-integrity checks, rate limiting and an audit trail.

Some protections depend on how our servers, databases and accounts are configured and operated (for example encryption at rest, backups, network firewalls, access reviews, and staff training). [These are to be confirmed by Textline Africa's infrastructure owner before we describe them publicly.]

No system is completely secure. Please keep your passcode private, choose one that is hard to guess, and tell us immediately if you suspect misuse of your account.

8. How long we keep data

We keep personal data only as long as needed for the purposes in this policy, including to meet accounting, tax and legal requirements. The retention periods below are to be confirmed by Textline Africa; they are not currently enforced by an automated schedule in our software:

When data is no longer needed it will be deleted or anonymised, subject to the exceptions described in section 10.

9. Your rights

Under the Kenya Data Protection Act, 2019 and, where applicable, other laws, you may have the right to:

• be informed about how your data is used;
• access your personal data;
• object to or restrict certain processing, including direct marketing;
• correct inaccurate or incomplete data;
• delete your data, and withdraw consent; and
• receive your data in a portable format where applicable.

To exercise a right, contact us (section 13). We may need to verify your identity first, and we will respond within the time allowed by law. You can correct some profile details and change your passcode in the App. If you are unhappy with our response you may complain to the Office of the Data Protection Commissioner (Kenya) – https://www.odpc.go.ke.

10. Deleting your account and data

You can ask us to delete your account and associated personal data at any time, from inside the App (Profile → Actions & Legal → Delete Account & Data) or without installing the App at:

https://textlineafrica.com/delete-account

Because accounts are linked to a live internet service, an outstanding balance and installed equipment, we handle deletion as a verified request:

1. Verification. We confirm the request comes from the account holder (for example by calling the registered phone number or confirming account details) before acting.
2. Settling the account. We may need to disconnect your service, settle any outstanding balance and arrange return of company equipment.
3. What we delete or anonymise. Profile details, contact details, saved location, support messages and attachments, and notification tokens, unless a legal reason requires us to keep them.
4. What we may have to keep. Payment and billing records, tax invoices, fraud and security records, network records and anything needed to handle a dispute or legal claim, for the periods in section 8. These are kept restricted and not used for other purposes.
5. Timeline. We aim to complete verified requests within [NUMBER – e.g. 30] days and will tell you if we need longer or cannot delete something and why.

Deleting the App from your phone does not delete your account.

11. Children

Our Services are for adults who can enter a contract for internet service, and the App is not designed for or directed at children. We do not knowingly collect personal data from children through the App. If you believe a child has provided data, please contact us and we will take appropriate steps.

12. Cookies and similar technologies on the Website

The Website stores a sign-in token (cookie/local storage named auth_token) when you sign in, plus preferences such as light/dark mode and the contents of your shopping cart. We do not currently use advertising cookies or third-party analytics on the Website [confirm at publication]. You can clear these in your browser settings; doing so will sign you out.

13. Contact us

Privacy questions, access, correction, deletion or complaints:

• Email: [PRIVACY EMAIL – to be confirmed], or info@textlineafrica.com
• Telephone: 0722 746 000
• Post / visit: [REGISTERED ADDRESS]; Mentor Sacco, Murang'a Town, Kenya
• Account deletion page: https://textlineafrica.com/delete-account

14. Changes to this policy

We may update this policy from time to time. We will post the new version at https://textlineafrica.com/privacy-policy with a new "Last updated" date and, for material changes, tell you through the App, SMS or email. Your continued use of the Services after a change means you accept the updated policy.