BBS Mall Privacy Policy

BBS Mall Privacy Policy This Privacy Policy explains how BBS Mall collects, uses, shares, protects, and retains personal data when you use the BBS Mall mobile application, BBS Mall Free Wi-Fi, and related services. 1. Who Is Responsible for Your Data * BBS Mall is the data controller for the service and decides why and how personal data is processed. * Purple Pay Ltd provides the supporting technology platform and processes data on behalf of BBS Mall as its technology partner. * Questions or privacy requests may be sent to info@bbsmall.co.ke. 2. Personal Data We Collect We may collect and process: * Registration and profile data, including your mobile phone number, first name, last name, age group, and gender. * Verification and consent data, including OTP verification status, Terms and Conditions versions and acceptance records, and profile-change records. * Device and session data, including an opaque customer reference, device name, platform, IP address, user agent, access-token and refresh-session records, activity times, revocation times, and security reasons for revocation. * Service and usage data needed to provide Wi-Fi access, display the mall directory and sponsored content, measure service and advertising performance, diagnose errors, and prevent misuse. * Communications and request records when you contact BBS Mall or exercise a privacy right. Authentication credentials are protected using security controls appropriate to their purpose. For example, access and refresh credentials are stored as hashes rather than as reusable plain-text tokens. 3. How We Use Personal Data We use personal data to: * Verify your mobile phone number and authenticate you using an OTP. * Create and secure your customer profile and device sessions. * Provide BBS Mall Free Wi-Fi, the mall directory, store information, banners, Featured Shops, and related mobile features. * Record acceptance of the current Terms and Conditions and manage onboarding requirements. * Prevent, detect, and investigate fraud, token misuse, abuse, security incidents, and unlawful activity. * Operate, troubleshoot, improve, and measure the reliability and performance of the service. * Produce anonymized, aggregated, or masked audience and advertising reports. * Send service communications and, where you have consented, promotional communications from BBS Mall or selected promotional partners. * Meet legal, regulatory, audit, and dispute-resolution obligations. 4. Our Reasons for Processing Depending on the activity, we process personal data because it is necessary to provide the service you request, because you have given consent, because BBS Mall has a legitimate interest in operating and securing the service, or because processing is required by law. You may withdraw consent for optional processing, including direct marketing, without affecting processing already carried out lawfully. 5. How We Share Data We may share only the data reasonably necessary with: * Purple Pay Ltd, which provides platform infrastructure, management, analytics, and technical support for BBS Mall. * SMS and communications providers used to deliver OTPs and approved messages. * Hosting, network, security, support, and other service providers acting under BBS Mall's instructions. * Regulators, courts, law-enforcement bodies, or other parties where disclosure is required or permitted by law or is necessary to protect users, the service, or legal rights. Advertisers and sponsors do not receive customers' personal information in plain text for audience reporting. Reports shared with them are anonymized, aggregated, or masked where possible. We require service providers handling personal data to protect it and use it only for authorized purposes. 6. Data Storage and Retention The MikroTik Control Plane is the authoritative system for your phone number, profile, OTP verification, and Terms acceptance. The BBS Mall API stores an opaque customer reference and the device and credential records needed to provide mobile access; it does not keep a second editable copy of your profile. We retain personal data only for as long as reasonably necessary for the purposes described in this Policy or as required or permitted by law. Access tokens are short-lived. Active device sessions remain until logout, revocation, detected token replay, or customer unavailability. Revoked BBS Mall device-session audit records are ordinarily retained for 90 days and then scheduled for deletion. Some consent, security, audit, dispute, or legal-compliance records may be retained longer where reasonably necessary. Data that no longer needs to identify you may be deleted, anonymized, or pseudonymized. 7. Security We use technical and organizational safeguards designed to protect personal data, including restricted service-to-service access, access controls, credential hashing, rate limits, and monitoring. No electronic service can guarantee absolute security, so you should protect your device and never share an OTP, access token, or refresh token with another person. 8. Your Choices and Rights Subject to applicable law, you may ask BBS Mall to: * Explain how your personal data is used. * Provide access to personal data held about you. * Correct inaccurate, incomplete, outdated, or misleading data. * Object to or restrict certain processing. * Provide portable data where applicable. * Delete eligible personal data. * Stop direct-marketing communications. Requests may be sent to info@bbsmall.co.ke. BBS Mall may need to verify your identity before acting on a request. If you are dissatisfied with how a request is handled, you may lodge a complaint with Kenya's Office of the Data Protection Commissioner. 9. Children's and Authorized Requests Where a request concerns a minor or is made by another person on a customer's behalf, BBS Mall may require evidence of parental authority, guardianship, or authorization before disclosing, correcting, or deleting personal data. 10. Changes to This Policy BBS Mall may update this Privacy Policy when the service, its data practices, or legal requirements change. The public page shows the published version and publication date. Material changes will be communicated where required. 11. Contact For privacy questions, requests, or complaints, contact: BBS Mall Email: info@bbsmall.co.ke