Introduction & Scope
This Privacy Policy (“Policy”) outlines how Bulkit Business Solutions (“Bulkit”, “We”, “Our”, or “Us”) collects, processes, protects, and stores personal data and information when you visit bulkitsms.com, bulkitsms.com, use our web portals, integrate our REST APIs, or access our telecommunication services.
We provide Bulk SMS, Bulk Email, Sender ID registration, two-way shortcodes, and automated messaging infrastructure for businesses, schools, financial institutions, religious organizations, and software developers across Kenya, Africa, and internationally. In providing these services, we strictly adhere to the Kenya Data Protection Act, 2019 and adhere to international standards of data integrity and protection.
By creating an account, accessing our portal, uploading contact records, or initiating API dispatches, you acknowledge the terms of this Privacy Policy.
Information We Collect
We collect information in several distinct categories:
A. Customer & Account Information
When registering an account with Bulkit, you provide personal and business identification including your full name, email address, mobile phone number, organization name, physical address, and official business registration documents required for telco-regulated Sender ID approval.
B. Recipient & End-User Data
To deliver messages, you upload recipient telephone numbers, contact group categorizations, and message payload text (which may contain personalized placeholders such as names or account numbers).
C. Payment & Billing Data
We record payment confirmation references, M-Pesa transaction IDs, bank transfer verifications, credit top-up history, and billing invoices. We do not store credit card CVV numbers on our servers.
D. Technical & Diagnostic Logs
When accessing our portal or sending requests through our REST API, our servers automatically log internet protocol (IP) addresses, API token access timestamps, user-agent details, HTTP status codes, delivery receipts (DLR callbacks), and network routing information.
Data Controller vs. Data Processor Role
You maintain complete ownership of the contact phone numbers and recipient data you import into Bulkit. We process and transmit those records exclusively upon your instruction to execute messaging dispatches.
Bulkit NEVER sells, rents, leases, discloses, mines, or monetizes your contact lists, customer databases, or recipient phone numbers to any third party for marketing or advertising purposes.
Legal Basis for Processing
Under the Kenya Data Protection Act, 2019, our processing of your personal information is grounded in lawful bases:
- Performance of a Contract: Processing necessary to provide service, deliver messages via telecommunication operators, allocate credits, and maintain your account.
- Compliance with Legal Obligations: Verifying business entity credentials for Sender ID vetting as mandated by telecommunications regulators (Communications Authority of Kenya).
- Legitimate Interests: Securing our infrastructure against unauthorized intrusion, mitigating spam and phishing, and diagnosing transmission failures.
- Consent: Where you have provided specific, informed consent for optional notifications or platform updates.
How We Use Information
- To transmit SMS and transactional email traffic across mobile networks reliably.
- To verify and configure approved Sender IDs and two-way shortcodes with network operators.
- To provide real-time and historical delivery status reports (DLRs) and campaign analytics.
- To authenticate API requests using private API keys and secrets.
- To process credit top-ups, issue automated invoices, and manage credit balances.
- To enforce our Zero-Tolerance Anti-Spam Policy and detect malicious or fraudulent messaging.
- To provide technical and operational support when requested by you.
Data Sharing & Telco Partners
We share data strictly to the extent required to execute our messaging solutions:
- Licensed Telecommunications Operators: Messages and destination phone numbers are transmitted directly to mobile network operators (including Safaricom, Airtel Kenya, and Telkom Kenya) for final termination on recipient handsets.
- Payment Partners: Transaction IDs and phone numbers are shared with mobile money processors (such as Safaricom M-Pesa) and banking providers to verify credit purchases.
- Legal & Regulatory Authorities: We may disclose information if required by a court order, summons, or regulatory directive from the Communications Authority of Kenya or law enforcement agencies investigating unlawful activity.
Security & Encryption Standards
We maintain comprehensive technical, physical, and administrative safeguards to protect your personal data and message payloads:
- Encryption in Transit: All communication between your browser, application, and our REST API endpoints is enforced with Transport Layer Security (TLS 1.2 and TLS 1.3).
- Secure Credentials: Passwords are cryptographically hashed using salted, industry-standard algorithms. API credentials are stored securely and never transmitted in unencrypted query parameters unless explicitly requested.
- Network Hardening: Firewalls, automated rate-limiting, and anomaly intrusion detection prevent brute-force attacks and unauthorized database access.
- Access Control: Only authorized engineering personnel with signed non-disclosure agreements have supervised access to production servers for maintenance purposes.
Data Retention & Erasure
We retain data only as long as necessary to fulfill the purposes outlined in this Policy:
- Message Logs & Delivery Receipts: Maintained for operational reporting and audit verification for up to 90 days, after which detailed message text is purged or anonymized.
- Financial & Invoicing Records: Retained for statutory periods mandated by commercial and tax legislation in Kenya.
- Account Termination: If you deactivate or terminate your account, we securely delete your address books and contact groups upon written request, subject to statutory retention obligations.
Your Privacy & Statutory Rights
Under applicable data protection laws, you possess the right to:
- Access: Request confirmation and an electronic copy of personal data we hold concerning you.
- Rectification: Request correction of inaccurate, misleading, or outdated personal information.
- Erasure: Request the deletion or destruction of your personal data where retention is no longer justified.
- Restriction & Objection: Object to processing of your personal data or request restriction of processing.
- Portability: Receive your contact records and account data in a structured, machine-readable format.
To exercise any of these rights, contact our Data Protection Team at privacy@bulkitsms.com.
Age Restrictions (18+)
BULKIT solutions are strictly intended for business entities and adults aged 18 and older. We do not knowingly collect, process, or solicit personal data from children under 18 years of age. If we learn that personal data of a minor has been registered without verified parental supervision, we will delete the account immediately.
Policy Revisions & Notice
We reserve the right to revise this Privacy Policy periodically to reflect shifts in technology, telecommunication regulations, or data protection law. Updated revisions take effect upon publication on bulkitsms.com. Your continued use of our platform following notice signifies agreement to the revised Policy.
Contact Our Privacy Office
If you have questions, feedback, or statutory requests concerning this Privacy Policy or our data handling practices, please contact us:
Bulkit Business Solutions
Attn: Data Protection Officer
Website: bulkitsms.combulkitsms.com
Email: privacy@bulkitsms.com / support@bulkitsms.com
Nairobi, Kenya
Have data protection inquiries?
Our compliance team is ready to provide audit reports and data processing addendums.