Privacy Policy

1. Who we are

Green Color Networks operates this website. We are the data controller for personal data collected here. You can reach us at support@greencolornetworks.co.ke or 254700000000.

2. What we collect

• Account data: your name and phone number, and your password (stored only as an irreversible hash).
• Order data: items purchased, amounts, the number to top up, delivery addresses and order notes.
• Payment data: M-Pesa transaction references and the paying phone number. We never see or store your M-Pesa PIN or full M-Pesa account details.
• Support messages: the content you send us and our replies.
• Technical data: standard server logs (IP address, timestamps) used for security and rate limiting.

3. Why we collect it

• To create your account and let you track orders (account data).
• To process, fulfil and reconcile your orders and payments (order & payment data).
• To answer your questions and resolve disputes (support messages).
• To prevent fraud and secure the service (technical data).

We do not sell your data. We do not use your data for advertising. We share it only where necessary: with Safaricom (to deliver the M-Pesa prompt and the products you buy) and where the law requires.

4. Legal basis & your rights under the Data Protection Act, 2019

We process your data on the basis of contract performance (your orders) and legitimate interest (security, dispute resolution). Under Kenya's Data Protection Act, 2019 you have the right to: be informed; access your data; correct inaccurate data; object to processing; and request deletion in appropriate circumstances. To exercise any right, contact support@greencolornetworks.co.ke. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

5. How long we keep data

Order and payment records are retained for at least 7 years for tax and audit purposes. Account data is kept while your account is active. Support conversations are kept for 2 years after resolution.

6. Security

• Passwords are hashed — never stored in readable form.
• Payment credentials (Daraja keys) are encrypted at rest.
• Sessions use signed, HTTP-only cookies over HTTPS.
• Administrative actions are audit-logged.

7. Cookies

We use only the cookies required to run the site: a login session cookie and a security (CSRF) token. No third-party tracking or advertising cookies are used.

8. Children

This service is not directed at children under 13, and we do not knowingly collect their data.

9. Changes

If we change this policy we will update this page and the date above. Material changes will be announced on the site.

10. Contact & complaints

Write to support@greencolornetworks.co.ke with any privacy question or complaint. If you are not satisfied, you may complain to the ODPC via www.odpc.go.ke.