Effective date: 2 September 2026 · Version: 1.0
This Notice describes HUSHNET's public approach to personal data in a customer project. It does not replace the project-specific data-processing terms required for an actual deployment. For privacy matters, email info@hushnet.co.ke.
1. Project roles are determined per engagement
A customer deployment must identify whether HUSHNET and the customer act as controller, processor, independent controller or another role for each processing activity. Where HUSHNET processes personal data for a customer, the parties should document the customer's instructions, purpose, duration, categories of data and people, security controls, confidentiality, subprocessors, transfers, individual-rights assistance, incidents, audit support, return and deletion.
2. High-risk processing requires an additional gate
Products involving students, children, health notes, biometrics, CCTV, payroll, precise location, systematic monitoring, security logs or consequential automated decisions require additional assessment before launch. The project must identify the lawful basis, notices, access permissions, retention, security, incident process, escalation routes and any data-protection impact assessment required by applicable law.
3. Customer responsibilities
Unless the accepted agreement says otherwise, the customer is responsible for ensuring it has authority to provide data and system access; selecting a lawful purpose and legal basis; giving required notices; managing end-user permissions; deciding how long records are retained; validating source data and consequential decisions; and providing authorized contacts for incidents and rights requests.
4. HUSHNET responsibilities
HUSHNET is responsible for the obligations it accepts in the applicable agreement and for its own legal duties. This can include following documented instructions, limiting access, using proportionate technical and organizational safeguards, maintaining confidentiality, assessing and controlling approved subprocessors, assisting with qualifying rights requests and security incidents, and returning or deleting personal data as agreed and legally permitted.
5. Security and incident handling
Security controls are selected according to the service, data, systems and risk. No system is entirely free from risk. Each project should identify authorized contacts, security reporting channels, severity, containment expectations, evidence handling, communications, remediation and any notification duties. Report a suspected HUSHNET-related issue to info@hushnet.co.ke with subject SECURITY REPORT; do not include live credentials in ordinary email.
6. Subprocessors and international transfers
HUSHNET may use service providers for hosting, communications, security, support, form delivery or other necessary functions. A customer project should identify material approved subprocessors and locations. Where data is transferred outside Kenya, the applicable project terms should identify the required assessment, safeguard or permission.
7. Retention, return and deletion
Project records must have a defined retention and deletion approach, including backup behavior, legal holds, export needs, data return format and responsibilities. A backup copy is not a disaster-recovery commitment unless the agreement says so. HUSHNET will not keep customer data longer than the applicable purpose, agreement, legal duty, security need or claim requires.
8. Individual rights and audit support
Where HUSHNET acts as processor, it will reasonably assist the customer with qualifying rights requests, regulator enquiries and security obligations to the extent stated in the agreement and allowed by law. A customer remains responsible for responding to its own data subjects and for any controller decision unless the parties agree otherwise.
9. Product-specific limits
Telematics, GPS, CCTV, biometrics, monitoring, cybersecurity and automated workflows can be affected by device condition, connectivity, configuration, human review, third-party systems and operational context. They do not guarantee continuous or exact location, detection of every event, prevention of harm, theft recovery, evidential admissibility, legal compliance or a particular business outcome unless a signed agreement expressly states a defined obligation.
10. Contact and updates
For privacy, security or data-processing enquiries, email info@hushnet.co.ke. HUSHNET may update this Notice as services, suppliers, operations or legal requirements change. The version above applies to this public Notice; a signed customer agreement governs the applicable project.