UNCHORUNCHOR OS Data Processing Terms
Version 2026-10-23. Effective 23 October 2026.
These terms apply where SyncPesa Technologies Limited ("we") processes personal data on behalf of an UNCHOR OS customer ("you"). They form part of the Terms of Service. They are written to meet section 42 of the Kenya Data Protection Act, 2019 and Article 28 of the EU and UK General Data Protection Regulation, and they apply whichever of those laws, or any similar law, governs the processing.
1. Roles
You are the data controller for the personal data of your customers, visitors and staff that UNCHOR OS processes for you. We are your data processor. We are the controller of the data about your own account, as the Privacy Notice explains.
2. What is processed and why
| Data | Purpose | Retention |
|---|---|---|
| Device identifier (a keyed hash of the device's hardware address, never the address itself) | Linking a pass to a device; blocking abuse | While the device record exists |
| Session times and data used | Running passes and data allowances | With the session record |
| Payment records: phone number, amount, provider reference, time; email if given | Receipts, refunds, disputes, accounting | Kept as financial records. Phone numbers and network addresses are masked after the retention period you set (7 to 1,095 days) |
| Customer network address on your network | Session control | Masked after the retention period |
| Staff accounts you invite: name, email, role | Access to your workspace | While they are a member |
| Visitor counts from devices that joined your network (when you turn visitor analytics on) | Your visitor statistics | As you set per site |
UNCHOR OS does not record the websites customers visit, their DNS queries or the content of their traffic.
3. Our commitments
We will:
- process the data only on your documented instructions, which are these terms and your configuration of the service, unless a law requires otherwise (in which case we tell you first, unless that law forbids it)
- keep it confidential, and allow access only to staff who need it and who are bound by confidentiality
- protect it with appropriate measures: encryption in transit, encrypted payment credentials, database row-level isolation between customers, a tamper-evident audit log, least-privilege access, time-limited staff elevation and tested backups
- notify you without undue delay, and where practicable within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own duty to notify the authority within 72 hours
- help you respond to requests from the people the data is about, within the deadlines the law sets. UNCHOR OS has tools for this under Settings → Privacy & data → Requests from your customers
- help you with data-protection impact assessments and consultations with the authority, where they concern our processing
- not use your customers' personal data for our own purposes. De-identified operational records (with no phone numbers, emails, names or device addresses) are used to improve UNCHOR OS only while you leave "Help UNCHOR get smarter" on, and anonymous totals are shared with partners only while you leave "Share anonymous network quality with internet providers" on
- delete or return the data when you close your account or ask us to, except where the law requires it to be kept
- make available the information needed to show we meet these terms, and allow reasonable audits, including inspections by an auditor you appoint, with 30 days' notice, at your cost, no more than once a year unless a breach or an authority requires it
4. Sub-processors
You authorise us to use sub-processors for hosting, email delivery, SMS delivery and, only when an optional AI feature is turned on, AI model providers. The current list, with each provider's role and region, is in the app under Settings → Privacy & data → Who processes data. We impose the same data-protection obligations on each sub-processor, remain responsible for them, and tell you at least 14 days before adding or replacing one that processes your customers' personal data. You may object on reasonable data-protection grounds; if we cannot address the objection, you may cancel the affected service and receive a pro-rata refund of fees paid in advance. The payment providers you connect act under your own agreements with them, not as our sub-processors.
5. International transfers
We transfer personal data out of the country where it was collected only with the safeguards the applicable law requires: to a country with adequate protection, or under contractual clauses that bind the recipient to equivalent protection. On request we give you a copy of the safeguards that apply.
6. Registration
SyncPesa Technologies Limited registers with the data-protection authority as a data controller and a data processor where the law requires it.
7. Contact
Questions about these terms: the contact form at http://127.0.0.1:8080/contact (topic: Privacy and data protection).