This page explains how Cloud Hub Limited handles personal data in SQWIRO, under the Data Protection Act, 2019 of Kenya.
Who is responsible
Cloud Hub Limited is the data controller for the personal data of people who visit sqwiro.com or open an account with us.
When you store your own customers’ or staff data in SQWIRO, including the mail in your mailboxes, you are the data controller and we are your data processor. We act on your instructions.
What we collect
Account details: name, work email, phone number, company name.
Service data: the mailboxes, messages and records you create, and technical logs such as sign-in times and IP addresses.
Billing data: invoices, payments and credits.
Why we use it
To provide and secure the service, to bill you, to support you and to meet legal duties. We do not sell personal data.
We scan incoming and outgoing mail for spam and viruses by automated means, and check sending IP addresses and domains (never the message) against public reputation lists. We do not read your mail for advertising.
Roles for SQWIRO Mail
For the content of mail and the information about it, the business that holds the account is the data controller and we are its processor. For account, billing, security and abuse-prevention records, we are a controller. If you write to someone at a business that uses SQWIRO Mail, contact that business first; we will help it respond.
Who we share it with
Service providers that help us run SQWIRO, under written agreements, and authorities where the law requires. Full sub-processor list and each provider’s data processing terms to be confirmed.
Where data is kept
SQWIRO Mail content, mail details, the search index and mailbox account details are stored and processed in the European Union: Germany (netcup GmbH), France (Contabo GmbH, backup mail queue), Cloudflare R2 EU jurisdiction (message files), Backblaze B2 EU region, Amsterdam (backups) and Amazon Simple Email Service, Frankfurt (outgoing mail). Web access passes through Cloudflare’s network. We will tell customers before adding a provider or a location outside the European Union. Transfer basis under the Data Protection Act, 2019, Part VI, and the country of the SQWIRO application servers to be confirmed. Health data for HMIS will be hosted on servers in Kenya.
How long we keep it
For as long as your account is active and for the period the law requires afterwards. For SQWIRO Mail: mail is kept while the mailbox exists and a deleted mailbox is deleted at once; backups are kept 35 days; incoming-mail filtering logs, outgoing-mail decision logs (no content, subject or addresses) and sending events (recipients stored only as one-way hashes) 30 days; the Message-ID map 180 days. Retention of sign-in records and billing records to be confirmed.
Your rights
You may ask to see your personal data, correct it, delete it, object to its use, restrict it or receive a copy in a portable format. Write to us and we will reply within the time the Act sets.
Complaints
If we do not resolve your concern, you may complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.
Data Protection Officer
Write to our Data Protection Officer at info@sqwiro.com with the subject “Data protection”. Dedicated DPO address and ODPC registration number to be added.
