BBS Mall Data Deletion Policy

BBS Mall Data Deletion Policy This Data Deletion Policy explains how a customer may request deletion of personal data associated with the BBS Mall mobile application and BBS Mall Free Wi-Fi service. 1. How to Submit a Deletion Request Send an email to info@bbsmall.co.ke with the subject "BBS Mall Data Deletion Request". Include: * The mobile phone number registered with the service. * A clear statement that you want your BBS Mall account and eligible personal data deleted. * Any information reasonably needed to identify the account and understand the scope of your request. Do not send an OTP, password, access token, refresh token, or other security credential by email. Deletion requests are free of charge. You may also use this contact to request correction, restriction, access, portability, or withdrawal from direct marketing without deleting your account. 2. Identity Verification To protect customers from unauthorized deletion, BBS Mall will verify that the requester is the customer or is legally authorized to act for the customer. Verification may include confirming control of the registered phone number through an OTP or requesting other proportionate evidence. BBS Mall will not act on a request if identity or authority cannot be reasonably verified. 3. What Happens After a Verified Request Subject to applicable legal and operational requirements, BBS Mall and its technology provider will: * Revoke active BBS Mall access tokens and device sessions. * Delete or anonymize eligible customer profile and account data held in the MikroTik Control Plane and BBS Mall API. * Delete or anonymize eligible device, session, IP-address, user-agent, and activity data when it is no longer required. * Remove or allow expiry of customer-specific cache entries. * Notify relevant processors handling the customer's data where reasonably required. The BBS Mall API and MikroTik Control Plane are separate systems linked by an opaque customer reference. A verified deletion request will be assessed across both systems; logging out or revoking a device session by itself does not delete the customer's account or all associated records. 4. Information That May Be Retained The right to deletion is not absolute. BBS Mall may retain or restrict access to limited information where it is reasonably necessary to: * Comply with a legal or regulatory obligation. * Establish, exercise, or defend a legal claim. * Preserve evidence of consent, Terms acceptance, security incidents, fraud, abuse, or unlawful activity. * Protect the rights and safety of customers, BBS Mall, service providers, or others. * Complete an active dispute or enforce applicable agreements. Where information must be retained, it will be limited to the relevant purpose, access will be restricted where appropriate, and it will be deleted or anonymized when the retention reason ends. Revoked BBS Mall device-session audit records are ordinarily retained for 90 days before scheduled deletion. Residual copies in protected backups may remain until those backups expire or are securely overwritten under the applicable backup schedule. 5. Response and Completion BBS Mall will respond to an erasure request within the period required by applicable law, generally within 14 days after receiving the request. The response will confirm the action taken, request any information needed for verification, or explain any lawful reason why some information cannot yet be deleted. Deletion from active systems will be completed without undue delay after verification and assessment. Where technical dependencies, protected backups, or lawful retention requirements affect completion, BBS Mall will explain the applicable limitation or next step. 6. Effect of Deletion Deletion revokes access to the affected BBS Mall account and device sessions. The customer may lose saved profile information, service eligibility, and related account history. If the customer later registers again, BBS Mall may treat the registration as a new account, except where limited retained records must still be recognized for security or legal reasons. 7. Marketing Opt-Out Without Account Deletion You do not need to delete your account to stop optional promotional messages. Use any opt-out method stated in the message or contact info@bbsmall.co.ke and ask to be removed from direct marketing. 8. Complaints and Contact If you have questions about deletion or believe your request was not handled appropriately, contact: BBS Mall Email: info@bbsmall.co.ke You may also lodge a complaint with Kenya's Office of the Data Protection Commissioner.