Skip to main content
Home/Legal/Privacy Policy

Privacy Policy

Last updated: 31 March 2026

Tayo Host Ltd ("Tayo Host", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.

Tayo Host Ltd is registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) of Kenya under the Data Protection Act No. 24 of 2019. This policy complies with the Kenya Data Protection Act 2019, the EU General Data Protection Regulation (GDPR) 2016/679, and other applicable international data protection laws.

This policy should be read alongside our Cookie Policy. For privacy enquiries contact privacy@tayohost.com — Tayo Host Ltd, Mash Building, Cpt Mungai Street, Eastleigh, Nairobi, Kenya 00610.

1. Who We Are

Tayo Host Ltd is a web hosting company registered and operating from Nairobi, Kenya. We provide web hosting, domain registration, email hosting, SSL certificates, and related digital infrastructure services for businesses primarily across East Africa.

Registered Data Controller — Office of the Data Protection Commissioner (ODPC), Kenya. Contact for privacy matters: privacy@tayohost.com.

2. Scope of This Policy

This policy applies to all of the following:

  • Visitors browsing tayohost.com and its subdomains
  • Individuals who create an account or purchase any Tayo Host service
  • Individuals who contact us via any channel — email, WhatsApp, phone, live chat, support ticket, or SMS
  • Individuals who subscribe to our newsletter
  • Affiliates registered in our affiliate programme
  • Visitors whose data is collected passively through cookies and analytics tools

3. Personal Data We Collect

3.1 Data You Provide Directly

Identity data
Your full name, collected when you register an account or purchase a domain.
Contact data
Your email address, phone number, WhatsApp number, and physical or billing address, collected when you register an account, submit a contact form, or sign up to our newsletter.
Account credentials
Your username and encrypted password, collected at registration. We never store plain-text passwords.
Payment data
Your M-Pesa number, PayPal email address, or the name associated with your payment. We do not store full card numbers. Card payments are handled entirely by our payment processors.
Domain registrant data
Your name, address, email, and phone number as required by ICANN for WHOIS publication, collected when you register a domain through us.
Support content
The content of messages, questions, and issues you share via WhatsApp, email, live chat, support tickets, phone calls, or SMS.
Affiliate data
Your name, email, and payment details for commission disbursement, collected when you join our affiliate programme.
Newsletter data
Your email address and first name, collected when you subscribe to our newsletter.

3.2 Data Collected Automatically

When you visit tayohost.com, the following data is collected automatically:

Server log data
Your IP address, the date and time of your visit, pages you accessed, HTTP status codes, and the URL that referred you to our site. Collected by our web server for security and fraud prevention.
Device and browser data
Your browser type and version, operating system, screen resolution, device type, and preferred language. Collected by Google Analytics and server logs.
Usage and behaviour data
Pages you viewed, time spent on each page, scroll depth, links clicked, and session duration. Collected by Google Analytics.
Cookie identifiers
Unique identifiers assigned to your browser session. Set by Google Analytics, Facebook Pixel, and Pinterest Tag.
Advertising interaction data
Ad clicks and page visits attributed to advertising campaigns, and retargeting identifiers. Collected by Facebook Pixel and Pinterest Tag, both deployed via Google Tag Manager.
Chat session data
The content of messages sent through our live chat widget, your IP address, device information, and the time of your conversation. Collected and stored by Tawk.to.

4. How We Collect Your Data

We collect personal data through the following channels:

  • Account registration and purchase forms on our WHMCS client portal at my.tayohost.com
  • Contact and enquiry forms on tayohost.com
  • WhatsApp when you message us at +254 796 096 075
  • Email when you write to any @tayohost.com address
  • Tawk.to live chat widget embedded on tayohost.com
  • Support ticket system within WHMCS
  • Phone calls and SMS when you call or text us directly
  • Newsletter signup forms powered by Mailchimp
  • Affiliate registration within the WHMCS affiliate portal
  • Cookies and tracking technologies automatically when you visit our website
  • Payment processors — PesaPal, PayPal, and Polar.sh confirm transaction details to us upon successful payment
  • Domain registrar (Enom) — when you register a domain, your registrant details are submitted to Enom and placed on the public WHOIS record as required by ICANN

5. Legal Basis for Processing

Under the Kenya Data Protection Act 2019 and GDPR Article 6, we must have a lawful basis for every type of processing.

Performance of a contract
We rely on this basis for creating and managing your hosting account, processing payments, provisioning services automatically upon payment, and sending billing invoices and renewal reminders. All of these are necessary to deliver the services you purchased.
Legitimate interests
We rely on this basis for sending service notifications such as downtime alerts and security notices, and for fraud prevention and security monitoring to protect our infrastructure and other customers.
Consent
We rely on your consent for website analytics via Google Analytics, advertising retargeting via Facebook Pixel and Pinterest Tag, and newsletter communications. You may withdraw consent at any time.
Legal obligation
We rely on this basis for maintaining financial records, tax documentation, and complying with requests from regulatory authorities as required by Kenyan law.

6. How We Use Your Personal Data

Account and service delivery

  • Creating and managing your hosting account, cPanel environment, email accounts, and domain registrations
  • Automatically provisioning or suspending services in response to payment status changes
  • Processing your payments through PesaPal, PayPal, or Polar.sh
  • Submitting domain registrant details to Enom and the relevant ICANN-accredited registry for WHOIS publication

Communications and support

  • Responding to your enquiries and support requests via all channels
  • Sending billing communications including invoices, receipts, payment confirmations, and renewal reminders 30 days before expiry
  • Sending service-critical notifications such as downtime alerts, maintenance notices, and security warnings

Marketing and analytics (consent-based only)

  • Sending you our newsletter if you have subscribed — unsubscribe any time
  • Analysing website traffic and behaviour through Google Analytics to improve our website
  • Retargeting website visitors through Facebook and Pinterest advertising platforms

Security and compliance

  • Monitoring server logs and access patterns to detect and prevent fraud, abuse, and security threats
  • Maintaining financial records and tax documentation as required by Kenyan law
  • Complying with requests from lawful authorities where legally required

7. Automated Decision-Making

Tayo Host uses automated systems in the following ways:

Service provisioning
When a payment is confirmed, our WHMCS system automatically creates your hosting account, installs cPanel, and registers your domain without manual intervention. This automation is the service itself.
Service suspension and renewal
If a payment fails or an auto-renewal is configured, WHMCS automatically updates your account status accordingly.

8. Third-Party Processors and Data Sharing

8.1 Our Data Processors

The following companies process personal data on our behalf and are bound by data processing agreements:

PesaPal
PurposeM-Pesa and card payment processing
Data sharedName, phone number, transaction amount
LocationKenya and internationally
PayPal (PayPal Holdings Inc.)
PurposePayPal payment processing
Data sharedName, PayPal email address, transaction amount
LocationUnited States
Polar.sh
PurposeOnline payment processing
Data sharedName, email address, transaction amount
LocationUnited States
Enom (Tucows Inc.)
PurposeDomain registration and DNS management
Data sharedFull registrant details — name, email, address, phone — as required by ICANN
LocationUnited States
Google LLC
PurposeWebsite analytics (GA4), tag management (GTM), search performance (GSC)
Data sharedBrowsing behaviour, device information, anonymised IP address, search query data
LocationUnited States
Meta Platforms Inc. (Facebook Pixel)
PurposeAdvertising retargeting via Google Tag Manager
Data sharedPage visit data and advertising interaction identifiers
LocationUnited States
Pinterest Inc. (Pinterest Tag)
PurposeAdvertising retargeting via Google Tag Manager
Data sharedPage visit data and advertising interaction identifiers
LocationUnited States
Mailchimp (Intuit Inc.)
PurposeEmail newsletter delivery and subscriber management
Data sharedEmail address, first name, subscription status
LocationUnited States
Tawk.to Inc.
PurposeLive chat support and persistent chat history storage
Data sharedChat message content, name if provided, IP address, device information
LocationUnited States
NoteTawk.to stores chats and tickets on their servers until you request deletion.
WHMCS / cPanel LLC
PurposeClient portal, billing, ticketing, and affiliate management
Data sharedAccount data, billing data, and ticket content
LocationSelf-hosted on Tayo Host servers in Germany

8.2 Disclosure to Authorities

We may disclose your personal data to law enforcement, regulatory authorities, or courts when required by Kenyan law, an ODPC directive, or a valid court order. We will notify you before complying where legally permitted to do so.

8.3 Business Transfers

If Tayo Host Ltd is sold, merged, or its assets are transferred, your personal data may transfer to the successor entity. You will be notified and your rights under this policy will be maintained.

9. International Data Transfers

Your personal data is processed in multiple countries. Our hosting servers are located in Germany. The majority of our third-party processors are based in the United States.

Transfers outside Kenya are governed by Section 48 of the Kenya Data Protection Act 2019. We rely on the following safeguards:

Standard Contractual Clauses (SCCs)
Adopted by the European Commission — our US-based processors including Google, Meta, Mailchimp, Tawk.to, PayPal, Polar.sh, and Enom are contractually bound by these.
EU-US Data Privacy Framework
Tawk.to, Google, and Meta are certified under this framework, providing an additional layer of protection for transfers to the United States.
Contractual necessity
For ICANN-required WHOIS publication via Enom, where transfer is necessary for the performance of your domain registration contract.

10. Data Retention

We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law. When data reaches the end of its retention period it is securely deleted or permanently anonymised.

Account and billing data
Required by Kenyan tax and financial record-keeping law.
7 years
Domain registrant data
Required by ICANN regulations.
Registration + 2 years
Support tickets and chat history
Retained for dispute resolution and service quality.
3 years
WhatsApp and email correspondence
Retained for support continuity and dispute resolution.
3 years
Server logs and IP addresses
Used for security monitoring and fraud prevention.
90 days
Google Analytics data
Configured in our GA4 settings.
14 months
Advertising pixel data
Facebook and Pinterest retargeting campaigns.
180 days
Newsletter subscriber data
Consent-based. Deleted within 30 days of unsubscription.
Until unsubscribed
Affiliate data
Commission dispute resolution.
Relationship + 2 years
Payment transaction records
Required by Kenyan statutory financial record-keeping obligations.
7 years

11. Your Rights as a Data Subject

Under the Kenya Data Protection Act 2019 and, where applicable, GDPR, you have the following rights:

Right to be informed
You have the right to know how your data is collected and used. This Privacy Policy fulfils that obligation.
Right of access
You may request a copy of all personal data we hold about you. We will respond within 30 days.
Right to rectification
You may request correction of inaccurate or incomplete personal data. Many details can be corrected directly in your client dashboard at my.tayohost.com.
Right to erasure
You may request deletion of your personal data where it is no longer necessary for its original purpose, where you withdraw consent, or where you object and we have no overriding grounds. Note that some data cannot be deleted where we have a legal obligation to retain it, such as financial records for 7 years.
Right to restriction of processing
You may request that we limit how we use your data while a dispute about accuracy is resolved or an objection is considered.
Right to data portability
You may request your personal data in a structured, machine-readable format such as CSV or JSON, where technically feasible.
Right to object
You may object at any time to processing based on legitimate interests or for direct marketing. Where you object to direct marketing we will stop immediately.
Right to withdraw consent
Where processing is based on your consent — analytics cookies, retargeting pixels, newsletter — you may withdraw at any time by adjusting your cookie preferences via our cookie banner, unsubscribing from our newsletter, or contacting privacy@tayohost.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
How to exercise your rights
Email privacy@tayohost.com with your request. We will respond within 30 days. We may ask you to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.

12. Data Security

We implement the following technical and organisational measures to protect your personal data:

  • SSL/TLS encryption for all data transmitted between your browser and our website and client portal
  • Encrypted password storage — hashed and salted, never stored in plain text
  • Access controls limiting which personnel can access personal data, on a need-to-know basis
  • Regular software updates and security patching of our hosting infrastructure
  • Two-factor authentication available for all WHMCS client accounts
  • Contractual data processing agreements with all third-party processors

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on tayohost.com. Our full Cookie Policy explains what cookies we use, why, and how you can manage them.

Essential cookies are required for the website and client portal to function and do not require consent. Analytics cookies from Google Analytics 4 require your consent. Advertising and retargeting cookies from Facebook Pixel and Pinterest Tag require your explicit consent. You may update your cookie preferences at any time using the cookie tool in our website footer.

14. Children's Data

Our services are intended for use by individuals who are at least 18 years of age, consistent with the Kenya Children Act 2022 and the ODPC's 2025 Guidance Note on Processing Children's Data.

We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a person under 18, contact privacy@tayohost.com immediately and we will delete that data without delay.

15. Third-Party Links

Our website contains links to external websites including payment processors, our domain registrar, and social media platforms. These operate under their own privacy policies for which we bear no responsibility. We encourage you to review the privacy policy of any external website you visit.

16. How to Lodge a Complaint

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with:

Office of the Data Protection Commissioner (ODPC) — Kenya
Website: www.odpc.go.ke
Email: info@odpc.go.ke
Address: Teleposta Towers, 10th Floor, Kenyatta Avenue, Nairobi, Kenya

If you are located in the European Union or EEA, you may also lodge a complaint with your local data protection supervisory authority. We would always appreciate the opportunity to resolve your concern directly before you approach a regulator. Please contact us first at privacy@tayohost.com.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the date at the top of this page and display a notice on our website or notify you by email if the changes significantly affect your rights. Continued use of our services after an updated policy is posted constitutes acceptance of the updated terms.

18. Contact

WhatsApp / Phone
+254 796 096 075
Post
Tayo Host Ltd, Mash Building, Cpt Mungai Street, Eastleigh, Nairobi, Kenya 00610
Response time
We aim to respond to all privacy requests within 30 days.

Questions about this policy?

Contact us at privacy@tayohost.com and we will respond within 30 days.

Email Us
Back to all legal documents
Support Hours

Mon–Sat, 8am–8pm EAT