On this page
1.Who we are#
Avitech Solutions Ltd ("Avitech", "we") provides CoreSync, a platform for internet service providers (ISPs), through its Avitech Cloud Services business. Our address is Avitech House, 5 Mirema Drive, 1st Avenue, Nairobi, Kenya.
This policy explains how we handle personal data when you visit our websites (coresync.africa and coresyncisp.com), ask about or sign up for CoreSync, or use CoreSync as a member of an ISP's team. It follows the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
2.If you're an ISP's subscriber#
If you buy internet from an ISP that uses CoreSync, that ISP decides what data about you is collected and how it's used. The ISP is the data controller. We process your data only on its instructions, under a contract that meets section 42 of the Act (our Data Processing Agreement). Your ISP's privacy notice applies to you. To see, correct or delete your data, contact your ISP. If you contact us instead, we'll pass your request on to them.
3.What we collect#
| Where it comes from | What we collect |
|---|---|
| Sign-up and demo requests | Your ISP's name and chosen web address, your name, phone number and work email, and roughly how many subscribers you have |
| Emails, calls and the support chat on our website | What you tell us, and our replies |
| Using CoreSync as a member of an ISP's team | Your name, phone number, email, role and permissions; your password, stored only as a one-way hash; what you do in CoreSync and when, with your IP address and browser; and questions you ask the AI assistant |
| Billing your ISP | Billing contacts, invoices, payments and payment references |
| Our websites and servers | IP address, browser type, the pages requested and when, in server and security logs |
4.Why we use it#
We use personal data only for these purposes, each with a lawful basis under section 30 of the Act:
| Purpose | Lawful basis |
|---|---|
| Setting up and running your ISP's CoreSync account, and supporting you | Performing our contract with your ISP |
| Billing your ISP and keeping accounting records | Our contract, and our legal obligations under tax law |
| Keeping CoreSync secure: detecting misuse, fraud and attacks, and investigating incidents | Our legitimate interest in a secure service |
| Following up a sign-up or demo request, and telling ISPs about CoreSync | Our legitimate interest, or your consent where the law requires it |
| Improving CoreSync, and producing statistics that identify no one | Our legitimate interest |
| Responding to lawful requests from courts and authorities | Legal obligation |
5.Marketing#
If you ask about CoreSync, we may follow up by phone, SMS or email. You can tell us to stop at any time by replying or writing to hello@coresyncisp.com, and we will. We never send marketing to an ISP's subscribers.
7.Where your data is stored#
CoreSync's databases and application servers run on infrastructure we operate in Nairobi, Kenya. Some providers we use process data outside Kenya, such as our network-protection and email providers and the AI model behind the AI assistant. They're listed, with their locations, on the Sub-processors page.
We transfer personal data out of Kenya only as Part VI of the Act allows, with appropriate safeguards, and we send each provider only what it needs for its job.
8.How long we keep it#
- Account data: while your ISP's account is open. When an account ends, its data is deleted as the Terms describe, apart from one copy kept for a year so the ISP can still retrieve it.
- Invoices and payment records: as long as tax and company law require, currently up to seven years.
- Sign-up requests that don't become customers: up to two years after our last contact, unless you ask us to delete them sooner.
- Server and security logs: only as long as needed for security and troubleshooting.
9.How we protect it#
We use technical and organisational measures suited to the risk, described on our Security page. No system is perfectly secure. If a breach affects your personal data and is likely to harm you, we'll tell you and the Data Protection Commissioner as the Act requires.
10.Your rights#
Under section 26 of the Act, you have the right to:
- be told how your personal data is used, which this policy does;
- see the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have data deleted when we no longer need it or have no lawful basis to keep it;
- object to our use of your data, including for marketing;
- get a copy of the data you gave us in a common, machine-readable format;
- withdraw your consent, where we rely on it.
To use any of these rights, email hello@coresyncisp.com. We may need to confirm who you are first. We aim to reply within 7 days, and always within the time the Regulations allow.
If you're unhappy with our answer, you can complain to the Office of the Data Protection Commissioner at odpc.go.ke.
11.Children#
Our websites and CoreSync accounts are for businesses. They're not meant for anyone under 18.
13.Changes to this policy#
We'll post updates here and change the date at the top. If a change is significant, we'll also email ISP account owners.
14.Contact us#
Avitech Solutions Ltd (Avitech Cloud Services), Avitech House, 5 Mirema Drive, 1st Avenue, Nairobi, Kenya. Email hello@coresyncisp.com.
Questions about this document? Write to us and we'll explain anything that isn't clear.
Email hello@coresyncisp.com