Privacy Policy

This Privacy Policy explains how Centipid Technologies Limited ("Centipid", "we", "us", "our") handles personal data across two distinct contexts:

• Platform Users - businesses, IT teams, and individuals who create and manage a Centipid account to monitor and automate their operations.
• Customer Contacts - employees, administrators, and other contacts whose details are used in customer accounts for alerts, status updates, billing, or support.

If your data is held in a customer account, you should contact that customer directly. Centipid processes that data on the customer's behalf. This policy explains how we do so and what protections are in place.

Centipid Technologies Limited is a technology company incorporated in Kenya. We build and operate a network monitoring and automation platform that allows customers to track infrastructure health, send alerts, automate backups, and manage operational workflows.

Under applicable data protection laws, there is an important distinction between a data controller (who decides why and how data is processed) and a data processor (who processes data on behalf of a controller). Centipid acts in both capacities, depending on the context.

When Centipid is the Data Controller

For data relating to our platform users - including account registration data, billing information, support correspondence, and usage analytics of the Centipid platform itself - Centipid is the data controller. We decide the purposes and means of processing this data.

When Centipid is a Data Processor

For data collected through monitoring, alerting, and automation features operated by our customer accounts, Centipid acts as a data processor. The customer is the data controller. They determine what data to collect, what alerting rules to use, and what operational workflows to run. Centipid processes this data strictly on their documented instructions.

When a person uses a Centipid-powered service, the platform may collect the following, depending on the customer's configuration:

4a. Customer Data (Collected on Behalf of Customers)

4b. Platform Account Data (Centipid as Controller)

• Registration information - name, email address, business name, country, phone number.
• Billing and payment data - payment method (card last four digits, M-Pesa number, or Paystack/Flutterwave reference). Full card numbers are processed by our payment providers (Paystack, Flutterwave, Stripe) and are never stored by Centipid.
• Business information - company details, industry type, number of locations, and monitoring environment configuration.
• Communication records - emails, support tickets, live chat conversations, and other support messages.
• Verification documents - for Enterprise accounts, we may request business registration documents or identification to verify your business.

4c. Platform Usage Data & Analytics

When you use the Centipid dashboard, we automatically collect:

• Log data - IP address, browser type, pages visited within the dashboard, actions taken, timestamps.
• Device data - operating system, screen resolution, browser version.
• Feature usage analytics - which features you use, how often, and in what sequence. Used to improve the platform.
• Error and crash reports - automatically collected to diagnose and fix platform issues.

For Platform Users (Centipid as Controller)

• Providing the service - operating your account, processing payments, configuring monitoring and automation features.
• Customer support - responding to enquiries, diagnosing technical issues, onboarding assistance.
• Platform improvements - analysing usage patterns to improve features, fix bugs, and build new functionality.
• Security and fraud prevention - monitoring for suspicious account activity, preventing abuse of the platform.
• Legal compliance - maintaining records as required by applicable law, responding to lawful requests from authorities.
• Product communications - sending product updates, new feature announcements, and account notifications. You may opt out of non-essential communications at any time.

For Customer-Managed Data (Centipid as Processor)

Centipid processes customer-managed data solely on the documented instructions of the customer (data controller). This includes:

• Monitoring devices, servers, and websites configured in the customer account.
• Storing configuration, alerting, and automation settings in the customer account.
• Sending operational alerts and notifications on behalf of the customer, subject to their configuration.
• Generating uptime, incident, and performance reports for the customer.

We do not use customer-managed data for Centipid's own promotional purposes, we do not build profiles across multiple customers, and we do not share it with third parties except as necessary to deliver the service (sub-processors listed below).

Under the GDPR and comparable African data protection laws, processing must have a lawful basis. The following table sets out the bases we're reliant on:

We do not sell personal data. We share data only in the following circumstances:

Sub-Processors

We use trusted third-party service providers ("sub-processors") to operate our platform. All sub-processors are bound by data processing agreements and may only process data for the purposes specified:

Business Transfers

If Centipid is acquired, merges with another company, or transfers its assets, personal data may be transferred to the acquiring entity. We will notify affected users by email and provide an opportunity to delete accounts before any such transfer is completed.

Legal Obligations

We may disclose personal data when required to do so by law, court order, or regulatory authority, or when we believe disclosure is necessary to protect the rights, property, or safety of Centipid, our customers, or the public. We will notify affected individuals unless legally prohibited from doing so.

Under Section 48 of Kenya's Data Protection Act, 2019, Centipid may only transfer personal data outside Kenya where one of the following applies:

• we have provided the Office of the Data Protection Commissioner (ODPC) with proof of appropriate safeguards protecting the security and confidentiality of the data;
• the transfer is necessary for the performance of a contract between Centipid and the data subject, or a contract concluded in the data subject's interest;
• the transfer is necessary for a matter of public interest;
• the transfer is necessary for the establishment, exercise, or defence of a legal claim; or
• the data subject has given explicit consent to the transfer, after being informed of the possible risks.

Where sensitive personal data is transferred outside Kenya, we rely on the data subject's explicit consent in addition to the above.

Centipid's infrastructure relies on a small number of sub-processors located outside Kenya (see "Sharing & Disclosure" above). Where personal data is transferred to these sub-processors, we:

• maintain contractual data protection safeguards with each sub-processor consistent with the requirements of Section 48;
• limit the personal data transferred to what is necessary to provide the Service;
• rely, where applicable, on the performance-of-contract basis described above; and
• will provide proof of these safeguards to the ODPC on request, as required under the Act.

We are monitoring the ODPC's ongoing guidance on cross-border data transfers, including any requirements for local data residency, and will update our infrastructure and this policy as needed. Customers who require data residency within Kenya should contact us; we can accommodate this for Enterprise plan customers on request.

When an account is closed, we export a final data snapshot for the account holder upon request, then permanently delete all personal data from production systems within 30 days and from backup systems within 90 days.

We implement technical and organisational measures appropriate to the risk of processing personal data. These include:

• Encryption in transit - all data is transmitted over TLS 1.2 or higher. Web app pages are served over HTTPS.
• Encryption at rest - database storage is encrypted using AES-256. Backups are encrypted.
• Access controls - internal access to personal data is limited to employees who need it for their role, authenticated by multi-factor authentication.
• Network security - all services are protected by Cloudflare WAF, DDoS mitigation, and rate limiting. WireGuard VPN for internal infrastructure access.
• Penetration testing - regular third-party security assessments of our infrastructure and application code.
• Incident response - we maintain a documented data breach response procedure. We will notify affected individuals and supervisory authorities within 72 hours of becoming aware of a qualifying breach.
• Employee training - all staff with access to personal data receive data protection training on joining and annually.

Depending on your location, you have the following rights in relation to your personal data. To exercise any of these rights, contact us at [email protected]. We respond within 30 days (or such shorter period as required by law).

Customer Contacts

If your details are held in a customer account and you want to exercise your rights, you should contact that customer (the data controller) directly. You may also email us at [email protected] and we will direct your request to the appropriate customer within 5 business days.

You can opt out of non-essential product communications at any time using the unsubscribe link in any email. Operational alerts and service notices may still be sent where needed to deliver the service.

Supervisory Authority

If you believe your rights have not been respected, you have the right to lodge a complaint with the relevant supervisory authority in your country - including the Office of the Data Protection Commissioner (Kenya), the Nigeria Data Protection Commission (NDPC), or the Data Protection Commission (Ghana).

We use cookies and similar technologies on centipidaccess.com and the Centipid dashboard. We do not use third-party advertising cookies. Our application uses minimal session cookies necessary to authenticate your session.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Centipid dashboard. The application session cookie is strictly necessary for authentication and cannot be disabled without affecting access.

Centipid's platform is not directed at children under the age of 13 (or 16 where required by applicable law). We do not knowingly collect personal data from children. If you are a customer and believe children may use your services, you are responsible as data controller for implementing age-appropriate safeguards where required.

If we become aware that we have collected personal data from a child without appropriate parental consent, we will delete that data promptly. Contact [email protected] if you have concerns.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send an email notification to all registered platform users at least 14 days before the changes take effect.
• Display a notice on the Centipid dashboard when you next log in.

For significant changes that affect the legal basis or purposes of processing, we will seek fresh consent where required. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

For any questions, concerns, or requests relating to this Privacy Policy or to your personal data, please contact us: