Privacy Policy

Exceptional is a cloud-based WiFi hotspot management platform developed and operated by ElitesGroup LTD ('we', 'us', or 'our'). This Privacy Policy explains what information we collect, how we use it, and your rights in relation to that information.

This policy applies to information collected from operators who register and use the Exceptional platform ('you' or 'operator'). If you are an end user connecting to a hotspot network powered by Exceptional, your data is also subject to the privacy policy of the operator running that network.

By using the Service, you agree to the collection and use of information as described in this Privacy Policy.

Account information: When you register, we collect your full name, email address, phone number, business name, and information about your network (e.g., number of access points, operating region).

Billing information: We collect subscription plan details. Payment processing for platform subscription fees is handled through secure payment channels. We do not store full payment card details on our servers.

Network and device data: We collect data about the access points and routers you register on the platform, including device identifiers, IP addresses, online/offline status, connected user counts, and bandwidth usage statistics.

Transaction data: We collect records of M-Pesa transactions that flow through your captive portal, including transaction reference numbers, amounts, bundle types purchased, timestamps, and phone numbers of paying users. This is necessary to grant or revoke network access.

Session data: We log active user sessions on your network, including session start and end times, data consumed, and the bundle used. Individual end-user phone numbers may be collected as part of transaction processing.

Usage data: We collect data about how you use the Exceptional dashboard, including pages visited, features used, and actions taken, to help us improve the platform.

Communications: If you contact us by email or through the contact form, we retain those communications to respond to you and improve our support.

Providing the Service: We use your information to create and manage your account, authenticate your access points via RADIUS, process M-Pesa transactions, generate vouchers, manage your agent network, and provide analytics.

Billing: We use your information to manage your subscription, process payments, send invoices, and handle billing-related communications.

Communications: We may contact you with service announcements, security alerts, and product updates. You may opt out of marketing communications at any time.

Improving the platform: We use aggregated, anonymized usage data to understand how the platform is used and to improve its features and performance. We do not use individual operator data for this purpose without your consent.

Legal and compliance: We may use or disclose your information where required by law, regulation, or court order, or where we believe disclosure is necessary to protect the rights, property, or safety of ElitesGroup LTD, our users, or the public.

Exceptional integrates with Safaricom's Daraja API to facilitate M-Pesa payments on your captive portal. When an end user makes a payment, we receive and store the transaction reference, amount, phone number, and timestamp in order to grant or revoke network access.

All revenue from end-user transactions flows directly into your M-Pesa paybill or till number. Exceptional does not receive, hold, or process end-user funds.

Phone numbers collected during M-Pesa transactions are used only for the purpose of matching payment confirmations to session grants. They are not used for marketing purposes and are not shared with third parties outside of what is required for M-Pesa integration.

Your use of M-Pesa through the platform is also subject to Safaricom's privacy policy and terms of service.

We do not sell, rent, or trade your personal information or your customers' data.

We share data with third-party service providers only as necessary to provide the Service. These include Safaricom (M-Pesa/Daraja integration), cloud infrastructure providers (for hosting and data storage), and email service providers (for transactional emails). All third-party providers are bound by confidentiality agreements and are prohibited from using your data for any purpose other than providing services to us.

If ElitesGroup LTD is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you by email and/or a prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

We may disclose your information to government or regulatory authorities if required to do so by law or in response to valid legal process.

Your data is stored on cloud infrastructure within data centers that maintain industry-standard physical and technical security controls. We use encryption in transit (TLS) and encryption at rest for sensitive data.

We implement access controls to limit who within ElitesGroup LTD can access your data. Access is restricted to personnel who need it to provide and maintain the Service.

Despite our security measures, no system is completely secure. We cannot guarantee the absolute security of your data and are not liable for unauthorized access that results from circumstances beyond our reasonable control.

We retain your account data for as long as your account is active. Upon account deletion or termination, your data is retained for 90 days to allow for data export and dispute resolution, after which it is permanently deleted.

Under the Kenya Data Protection Act 2019, you have the following rights regarding your personal data: the right to access the personal data we hold about you, the right to correct inaccurate or incomplete data, the right to request deletion of your data (subject to legal retention requirements), the right to object to or restrict certain processing of your data, and the right to data portability.

To exercise any of these rights, contact us at info@elitesgroup.co.ke. We will respond to your request within 30 days. In some cases, we may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya if you believe your data rights have been violated.

The Exceptional dashboard uses essential cookies necessary for authentication and session management. These cookies are required for the platform to function and cannot be disabled.

We may use analytics tools to collect aggregated information about how the dashboard is used. This data is anonymized and used only for product improvement purposes.

We do not use advertising or tracking cookies. We do not share cookie data with advertising networks.

If you operate a hotspot network using Exceptional, you are the data controller for the personal data of your end users (people who connect to your network). Exceptional acts as a data processor on your behalf for this data.

You are responsible for providing your end users with a privacy notice that describes how their data is collected and used through your captive portal, and for obtaining any required consents under the Kenya Data Protection Act 2019.

You must not collect or use end-user data in ways that violate applicable law or the rights of your users. You are responsible for ensuring that your captive portal's terms and privacy notices are accurate and kept up to date.

The Exceptional platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at info@elitesgroup.co.ke.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by posting a prominent notice within the platform at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your data, please contact us:

ElitesGroup LTD — Nairobi, Kenya — info@elitesgroup.co.ke

We aim to respond to all privacy-related inquiries within 5 business days.