Legal
Privacy Policy
Ikon Kode Limited
1. Who we are
Ikon Hosting is operated by Ikon Kode Limited, a limited liability company incorporated in Kenya, company registration number PVT-GYUP7Q7.
For the purposes of the Data Protection Act, 2019, we are the data controller for the personal data described in this policy.
Contact for all privacy matters: contact@ikon.ke
This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have under Kenyan law. It covers our website, hosting services, domain registration services, and our mobile application.
2. What personal data we collect
2.1 Account details
Your username, first and last name, email address, and password, which is stored only as a cryptographic hash that we cannot read. Optionally your telephone number and country dialling code. We record when your account was created and when you last signed in.
If you sign in with Google, we receive your Google profile information and email address from Google. We never receive your Google password.
2.2 Contact and billing details
Your company name and postal address, where you provide them. When you order a service, we hold a record of the amount, currency, billing cycle, payment reference and payment status. Payment itself is handled by Ikon Pay, and we never see or store your card number, CVV, expiry date or mobile money PIN.
2.3 Domain registrant details
If you register or transfer a domain, we collect the contact details the registry requires: first and last name, company name, email address, street address, city, state or province, postal code, country and telephone number.
These details are sent to our reseller partner and to the domain registry, and may be published in public WHOIS or RDAP records. Publication is a condition set by the registry, not by us. Some registries offer privacy protection that masks these details, and where it is available for your domain you can enable it from your domain settings.
2.4 Hosting content
Your websites, files, databases and configuration are stored on our hosting infrastructure. This may include personal data about your own users, for which you are the data controller and we act as your processor. You are responsible for having a lawful basis for that data and for your own privacy notice to those people.
Our staff access your content only where necessary to operate, support, secure or maintain the platform, to investigate a suspected breach of our terms, or where required by law.
2.5 Information collected automatically
- Your IP address, which we send to a geolocation service to derive the country you are visiting from. We store the resulting country code against your browsing session.
- Your browser type and version, and the page that referred you to us.
- Your device type, manufacturer, model, operating system, screen size, language, timezone and application version.
- A randomly generated visitor identifier stored in your browser, which lets us recognise a returning browser across visits.
- A record of the pages you view and the actions you take, including clicks, form interactions and navigation paths.
We use this to understand how people move through the site, to find and fix points where people get stuck, and to detect abuse. We rely on our legitimate interest in operating a secure and functional service as the lawful basis for this processing. We do not use it for advertising, we do not sell it, and we do not share it with advertising networks.
2.6 Abuse prevention
If an attempted registration is blocked by our anti-automation checks, we record the originating IP address and the details submitted so we can identify repeat attempts.
3. Our lawful basis for processing
Under section 30 of the Data Protection Act, 2019:
| Processing | Lawful basis |
|---|---|
| Creating and running your account, providing hosting and domains | Necessary to perform a contract with you |
| Sending registrant details to registries | Necessary to perform a contract with you, and to comply with registry and ICANN policy |
| Billing, invoicing and payment records | Performance of a contract, and compliance with the Companies Act 2015 and the Tax Procedures Act 2015 |
| Analytics, session tracking and device information | Our legitimate interest in operating, securing and improving the service |
| Abuse prevention, rate limiting and blocking automated registrations | Our legitimate interest in protecting the platform and our customers |
| Service emails about your account, domains or subscription | Necessary to perform a contract |
You may object to any processing carried out on the basis of legitimate interest. See section 7.
4. Who we share your data with
We do not sell your personal data.
| Recipient | What they receive | Purpose |
|---|---|---|
| HostAfrica and Hostraha (domain resellers) | Your full registrant contact details, domain names, nameservers and authorisation codes | To register, transfer, renew and manage your domains |
| Domain registries, including KENIC for .ke | Registrant details as required by registry policy | Registration and public WHOIS or RDAP records |
| Ikon Pay | Your name, email address, telephone number, amount and reference | To take payment and manage subscriptions |
| Pesapal (through Ikon Pay) | Card and recurring payment details you enter directly with them | Card processing |
| Mailjet | Your email address and the content of the message | Sign-in codes, service notifications, renewal reminders |
| Google LLC | An authentication request | Only if you choose to sign in with Google |
| ipapi.co | Your IP address | To determine the country a visit originates from |
| Our infrastructure providers | All data stored by the service | Hosting of our servers, databases and your websites |
| Content delivery networks (Cloudflare, jsDelivr, unpkg) | Your IP address and browser details, when your browser loads assets from them | Delivery of scripts and stylesheets |
We may also disclose personal data where required by law, by a court order, or by a regulator, or where necessary to establish, exercise or defend a legal claim.
5. Transfers outside Kenya
Some of the recipients above process data outside Kenya:
- Our infrastructure and hosting servers: Kenya (Nairobi)
- Domain registries: worldwide, depending on the top-level domain
- Mailjet: European Union
- Google: United States and other jurisdictions
- ipapi.co: United States
- Cloudflare, jsDelivr, unpkg: globally distributed networks
- HostAfrica: South Africa
- Hostraha: Kenya
Under section 48 of the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, we make these transfers on the basis that they are necessary to perform our contract with you, since we cannot host your sites, register your domains, or send you a message without them, and on the basis of the data protection commitments each provider gives us contractually.
For details of the safeguards applying to a specific transfer, write to contact@ikon.ke.
6. How long we keep your data
| Data | Retention |
|---|---|
| Billing records, purchases, subscriptions and payment references | Seven years from the end of the financial year in which the transaction occurred, to meet our obligations under the Companies Act 2015 and the Tax Procedures Act 2015 |
| Account details | For as long as your account remains open, then anonymised after the deletion process in section 8 |
| Domain registration records | For as long as we manage the domain, and thereafter for the statutory period above. Records held by the registry are subject to the registry's own retention rules, which we do not control |
| Website content, files and databases | For as long as your service is active. Deleted after termination as described in our Terms of Service |
| Analytics sessions and interaction events | For as long as necessary for the purposes described in section 2.5, reviewed periodically and deleted when no longer needed |
| System, email and webhook logs | For as long as necessary for security, troubleshooting and record-keeping |
Financial records cannot be deleted on request. Where you ask us to delete your data, we will remove or anonymise your account and contact details, but we must keep the underlying billing records for the statutory period. After that period they are deleted.
7. Your rights
Under Part V of the Data Protection Act, 2019 you have the right to:
- Be informed of how we use your personal data, which is the purpose of this policy.
- Access a copy of the personal data we hold about you.
- Correct data that is inaccurate, out of date, incomplete or misleading.
- Object to processing carried out on the basis of our legitimate interests, including our analytics.
- Request deletion of data we no longer have a lawful reason to keep.
- Receive your data in a structured, commonly used format.
- Not be subject to a decision based solely on automated processing that significantly affects you.
How to exercise these rights. Email contact@ikon.ke from the address on your account. We may ask you to confirm your identity before acting, so that we do not disclose your data to someone else. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.
Note that registrant details already published in WHOIS are held by the registry. We can ask for a correction, but removal is governed by registry policy.
8. Deleting your account
You can request deletion from your profile. When you do:
- Your account is deactivated immediately and you can no longer sign in.
- A grace period of 30 days begins. Signing in during that period cancels the request.
- At the end of the 30 days, your name, username, email address, telephone number and country are permanently overwritten and your password is disabled.
Billing and domain records are retained as described in section 6. Any active domains remain registered until they expire or you transfer them away, since a domain cannot be held without registrant details.
9. Automated decisions
Some decisions are made automatically:
- Subscriptions. Non-payment marks a subscription past due, which disables your hosting controls while your sites stay online. If it remains unpaid when the grace period ends, the subscription is cancelled and your websites are stopped.
- Domains. Renewal reminders are sent automatically at 90, 30, 14 and one day before expiry.
- Registration. Automated checks may block an attempted registration showing signs of being automated, and blocked addresses may be added to a blocklist.
- Rate limiting. Repeated requests from the same address in a short period may be temporarily refused.
If an automated decision affects you and you believe it is wrong, write to contact@ikon.ke. A person will review it and you can put your side of the case.
10. Security
We protect your data with encrypted connections (HTTPS) for all traffic, passwords stored as salted cryptographic hashes, API keys stored only as hashes, cryptographic signature verification on payment callbacks, rate limiting on authentication and on our API, restricted cross-origin access, and sign-in codes that expire after a short period.
No system is completely secure. If a breach occurs that presents a real risk of harm to you, we will notify the Office of the Data Protection Commissioner within 72 hours and notify you as required under section 43 of the Data Protection Act, 2019.
We do not currently provide a backup service. Keeping your own copies of your data is your responsibility, as set out in our Terms of Service.
11. Cookies and local storage
We use the following, all set by us. We do not use third-party advertising or analytics cookies.
| Name | Purpose | Duration |
|---|---|---|
| sessionid | Keeps you signed in | Session |
| csrftoken | Protects forms against cross-site request forgery | Session |
| tracker_visitor_id | Recognises a returning browser for analytics | Persistent |
| tracker_session_id | Groups activity within a single visit | Until the tab closes |
| tracker_user_id | Links analytics to your account when you are signed in | Persistent |
| theme-preference | Remembers light or dark mode | Persistent |
| activePageTab, componentsActiveTab | Remembers which tab you were viewing | Until the tab closes |
| Event deduplication keys | Prevents the same event being recorded twice | Until the tab closes |
| Domain cart | Holds the domains you are about to order | Session |
The session and CSRF entries are strictly necessary, and the service will not work without them. You can clear the others through your browser settings at any time, though doing so may reset your preferences.
12. Children
Ikon Hosting is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to contact@ikon.ke and we will delete it.
13. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at contact@ikon.ke so that we can try to resolve it.
14. Changes to this policy
We may update this policy at any time. The date at the top shows when it was last changed, and the version published on our site is the one in force. Where a change materially affects your rights, we will notify you by email or through a notice on the service.