Legal

Privacy Policy

Effective Date: 1 January 2025 | Last Updated: 1 March 2026

1. Who We Are

BENFEX ("we", "us", "our") is a multi-tenant network billing and hotspot management platform operated from Nairobi, Kenya. We provide software services to network operators (Partners) and their end-users (Customers). For data protection purposes, BENFEX is the data controller for Partner accounts. Partners are data controllers for their own Customers.

2. Data We Collect

Partners: Business name, email address, phone number, account credentials, subscription payment history, router and network configuration data.
Customers: Username, full name, phone number, email address (optional), WiFi session logs (start time, end time, data consumed), payment confirmation data.
Technical data: IP addresses, device identifiers, browser type, and access timestamps collected automatically during use of our platform.

3. How We Use Your Data

To deliver and maintain the BENFEX platform and its features.
To process subscription payments and send billing notifications.
To provision WiFi access and manage hotspot sessions.
To send transactional communications (payment receipts, plan expiry reminders, account alerts).
To investigate abuse, resolve disputes, and comply with legal obligations.

4. M-Pesa Payments

Payment processing is handled by Safaricom's M-Pesa platform (Daraja API). When you initiate a payment, your phone number is passed to Safaricom to trigger an STK push. We receive only a payment confirmation (amount, transaction reference, timestamp) — we do not store your M-Pesa PIN or full account details. Safaricom's own privacy policy governs their handling of your payment data.

5. Third-Party Service Providers

We share data with the following categories of third-party providers solely to deliver our service:

Safaricom (M-Pesa): Payment processing.
SMS gateway providers: Delivery of SMS notifications.
MikroHub: VPN tunnel relay for MikroTik router connectivity.
Hosting providers: Cloud infrastructure for platform uptime.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

We retain your data for as long as your account is active. Upon account closure, personal data is retained for seven (7) years to comply with Kenya's tax and financial record-keeping obligations, after which it is securely deleted.

7. Your Rights

Under the Kenya Data Protection Act, 2019, you have the right to access, correct, or request deletion of your personal data. To exercise these rights, contact us atsupport@benfex.net. We will respond within 30 days.

8. Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and access controls. No system is completely secure; please notify us immediately if you suspect any unauthorised access to your account.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify active Partners by email at least 14 days before material changes take effect. Continued use of BENFEX after that date constitutes acceptance of the updated policy.

10. Contact

BENFEX — Nairobi, Kenya
Email: support@benfex.net
Phone: +254 700 760 386