Best Seller 
Privacy Policy
1. Who we are and what this policy covers
1.1 Invictorix Limited, trading as Solar Bridge ("we", "us"), operates solarbridge.africa. We are the data controller for personal data processed through the website, our online store, our partner and vendor programmes, and our sales, delivery, installation and support services.
1.2 We process personal data in line with the Constitution of Kenya (Article 31, right to privacy), the Data Protection Act, 2019 ("the Act") and the Data Protection (General) Regulations, 2021 and related regulations.
1.3 This policy covers customers, account holders, partner and vendor applicants, contacts at business customers, job applicants, website visitors, and anyone who contacts us.
| Detail | Information |
|---|---|
| Data controller | Invictorix Limited (trading as Solar Bridge) |
| Registered office | Azure Towers, Lantana Road, Nairobi, Kenya |
| General contact | info@solarbridge.africa, +254 183167333 |
1.4 We follow the principles in section 25 of the Act: we process data lawfully, fairly and transparently; only for specified purposes; only as much as we need; accurately; for no longer than necessary; and securely.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone/WhatsApp, delivery and billing address, job title | You, at sign-up, checkout, quote or contact forms |
| Account | Username, encrypted password, order history, wishlist, saved preferences | Your account |
| Transaction and tax | Products bought, amounts, invoices, KRA PIN (business buyers), eTIMS invoice details | Checkout and our finance systems |
| Payment | M-Pesa number, name and transaction code; card type and last 4 digits | Payment service providers (we never store full card numbers or PINs) |
| Installation and site | Site address and GPS location, roof and site photos, energy bills and load data, system serial numbers and monitoring data | You, our survey team, installation partners, connected inverter or battery apps |
| Partner and vendor applicants | Business name and type, registration no., KRA PIN, EPRA or KEBS licences, regions served, volumes, uploaded company profile | "Partner with Us" and "Become a Vendor" forms |
| Communications | Emails, chats, call notes, WhatsApp messages, complaints, reviews | You |
| Technical and usage | IP address, device and browser type, pages viewed, referral source, approximate location | Cookies and analytics tools |
| Job applicants | CV, qualifications, references | You and your referees |
2.1 We do not intentionally collect sensitive personal data as defined in section 2 of the Act (such as health, ethnic origin, religion, biometric data or property details beyond what a site installation needs). Please do not include it in messages or uploads.
2.2 If you give us data about another person (for example, a site contact or delivery recipient), you confirm that you are entitled to do so and that you have told them about this policy.
3. Why we use your data and our lawful basis
Section 30 of the Act lets us process personal data only on a lawful basis. Ours are:
| Purpose | Lawful basis |
|---|---|
| Create and manage your account and show you trade or retail prices | Contract |
| Process orders, payments, deliveries, installations, commissioning and warranty claims | Contract |
| Prepare quotations, site surveys and system designs | Steps at your request before a contract |
| Review, vet and manage partner, installer and vendor applications, including licence checks | Steps before a contract; legitimate interests |
| Customer support, complaints and after-sales service | Contract; legitimate interests |
| Tax, accounting, eTIMS and regulatory records | Legal obligation |
| Fraud prevention, payment verification and website security | Legitimate interests; legal obligation |
| Improve the website, products and services using analytics | Consent (non-essential cookies); legitimate interests |
| Product updates, offers and newsletters | Consent |
| Recruitment | Steps before a contract; legitimate interests |
| Defending legal claims | Legitimate interests; legal obligation |
3.1 Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can ask us for details.
Direct marketing
3.2 We send marketing messages by email, SMS or WhatsApp only with your consent, in line with section 37 of the Act and the Data Protection (General) Regulations, 2021. Every message includes a simple way to opt out, such as an unsubscribe link or replying STOP. Opting out does not affect order or service messages.
Automated decisions
3.3 We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (section 35 of the Act). Fraud checks by payment providers may be automated; you can ask for a human review of any decision that affects you.
3.4 We do not sell or rent your personal data.
4. Sharing, international transfers and retention
Who we share data with
4.1 We share personal data only where needed for the purposes above. We do so under written agreements that require recipients to keep it confidential and secure, as section 42 of the Act requires for data processors.
| Recipient | Why |
|---|---|
| Payment service providers (e.g. Safaricom M-Pesa, card and bank gateways) | To take and verify payments |
| Couriers and logistics companies | To deliver your order |
| EPRA-licensed installation partners | To survey, install and service your system, when you ask for installation |
| Vendors on our marketplace | To fulfil orders for their products or services |
| Manufacturers and authorised service centres | To process warranty claims |
| IT, hosting, email, CRM and analytics providers | To run the website and our systems |
| Professional advisers (auditors, lawyers, insurers) | For audit, legal and insurance purposes |
| Government and regulators (e.g. KRA, EPRA, ODPC, courts, police) | Where the law requires it or to protect legal rights |
| A buyer or successor of our business | In a merger, sale or restructuring, under equal protection |
Transfers outside Kenya
4.2 Some service providers (for example, cloud hosting, email and analytics) store data outside Kenya. Under sections 48 to 50 of the Act, we transfer data abroad only where: the destination has appropriate safeguards, such as contractual protections; the transfer is necessary for your contract with us; or you have consented. Where the Data Commissioner requires data to be processed in Kenya, we comply.
How long we keep data
4.3 We keep data only as long as needed for its purpose (section 39 of the Act), then delete or anonymise it:
| Data | Retention period |
|---|---|
| Orders, invoices, payment and tax records | 7 years after the transaction |
| Installation and warranty records | Warranty period + 1 year |
| Customer accounts | While active; deleted 3 years after last activity |
| Partner and vendor applications not approved | 12 months after the decision |
| Active partner and vendor records | Relationship period + 7 years |
| Marketing consents | Until you withdraw consent |
| Support messages and call notes | 2 years after the issue closes |
| Job applications (unsuccessful) | 12 months |
| Analytics data | Up to 26 months |
| CCTV at our premises, if any | 30 days unless needed for an incident |
4.4 We may keep data longer where needed for a legal claim, investigation or legal requirement.
5. Security, breaches and cookies
Security
5.1 In line with section 41 of the Act, we protect personal data with appropriate technical and organisational measures. These include HTTPS/TLS encryption, hashed passwords, role-based access controls, multi-factor authentication for admin accounts, regular backups and updates, vetted processors, and staff confidentiality and training. Installation partners and vendors receive only the data they need for a job.
5.2 No online system is completely secure. Keep your password private and log out on shared devices.
Data breaches
5.3 If a personal data breach creates a real risk of harm, we will notify the Data Commissioner within 72 hours of becoming aware of it. We will also tell affected people without undue delay, with steps they can take to protect themselves (section 43 of the Act).
Cookies
5.4 Cookies are small files stored on your device. We use:
| Type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary | Login, cart, checkout, security, currency and language choices | No |
| Preferences | Remember your settings and wishlist | Yes |
| Analytics | Understand how visitors use the site, to improve it | Yes |
| Marketing | Measure ads and show relevant offers | Yes |
5.5 When you first visit, a cookie banner lets you accept, reject or choose cookie types. You can change your choice at any time via the "Cookie settings" link in the footer or in your browser settings. Blocking necessary cookies may stop the store from working.
6. Your rights, complaints and contact
Your rights
6.1 Under sections 26 and 31–40 of the Act, you have the right to:
- Be informed of how your data is used (this policy)
- Access your personal data and get a copy
- Correct data that is inaccurate, out of date or misleading
- Have false, misleading or unlawfully processed data deleted
- Object to processing, including all direct marketing
- Withdraw consent at any time, without affecting earlier lawful processing
- Restrict processing in certain cases
- Receive data you gave us in a structured, machine-readable format (data portability)
- Not be subject to solely automated decisions with significant effects
6.2 To exercise a right, email dpo@solarbridge.africa or write to our office. We may ask you to verify your identity. We respond within the timelines in the Data Protection (General) Regulations, 2021, and in any case within 7 days for access requests and 14 days for correction or erasure, unless we tell you of a lawful extension. Requests are free, unless they are manifestly unfounded or excessive.
Children
6.3 Our website and services are for adults aged 18 and over. We do not knowingly collect data from children. If we learn we hold a child's data without parental consent (section 33 of the Act), we will delete it.
Complaints
6.4 Please contact our Data Protection Officer first so we can try to fix the problem. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, at www.odpc.go.ke.
Changes to this policy
6.5 We review this policy at least once a year and when our processing changes. The date at the top shows the latest version. We will tell you about material changes by email or a website notice.
Contact
Data Protection Officer, Invictorix Limited (trading as Solar Bridge)
- Email: dpo@solarbridge.africa
- General enquiries: info@solarbridge.africa
- Phone: +254 183167333
