Last updated: 23 October 2026
This policy explains what personal data whois.co.ke ("we", "us") collects, why, who we share it with, and the rights you have under Kenya's Data Protection Act, 2019. We are the data controller for the personal data described here.
1. What we collect
- Registrant and contact details needed to register a domain: name, organisation, postal address, email and phone number.
- Eligibility documents for restricted extensions, such as certificates of registration or authorisation letters.
- Account and billing details: login details, invoices, payment references and M-Pesa transaction details. We do not store full card numbers.
- Messages you send us by email, phone or WhatsApp.
- Technical data: IP address, browser type and the pages you request, kept briefly by our hosting provider for security and to keep the site running.
2. Why we use it
- To register, renew, transfer and manage your domains with KeNIC. This is needed to perform our contract with you, and KeNIC requires registrant data for every .ke domain.
- To take payment, issue invoices and keep tax records, as the law requires.
- To send renewal reminders and important notices about your domains and account.
- To answer your questions and give support.
- To protect the site, our customers and the .ke namespace from fraud and abuse.
We do not use your data for advertising and we do not sell it.
3. Domain searches
When you search for a domain, the name you type is sent to KeNIC's registry to check its status. We do not keep a record of the names you search for or link searches to you.
4. Who we share it with
- KeNIC, as the .ke registry. KeNIC holds registrant data for every domain and may publish some of it in its public WHOIS/RDAP service, in line with its own policies.
- Payment providers, such as Safaricom for M-Pesa and our card processor, to take your payments.
- Our hosting and infrastructure providers, including Cloudflare, which runs this website.
- Authorities and dispute panels, where the law, a court order or a domain dispute requires it.
Our providers may only use your data to provide their service to us.
5. Transfers outside Kenya
Some of our providers, such as Cloudflare, process data on servers outside Kenya. Where that happens, we make sure appropriate safeguards are in place, as required by the Data Protection Act.
6. How long we keep it
We keep registrant and account data for as long as you have domains or an account with us. After that we keep invoices and payment records for at least five years, as Kenyan tax law requires, and delete or anonymise the rest unless we need it for a dispute or legal claim.
7. Cookies
This site does not use advertising or tracking cookies. Our hosting provider may set strictly necessary cookies to protect the site from attacks. If we add any other cookies in future, we will update this policy first.
8. How we protect it
We use encrypted connections (HTTPS) and limit access to personal data to the people who need it to serve you. If a breach affecting your personal data happens, we will notify the Office of the Data Protection Commissioner within 72 hours and tell you without delay where it is likely to put you at risk, as the Act requires.
9. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your personal data is used
- access the personal data we hold about you
- have inaccurate data corrected
- have data deleted when we no longer need it
- object to some uses of your data
- receive your data in a portable format
Some data must be kept while a domain is registered, because KeNIC requires it. To use any of these rights, email hello@whois.co.ke, call or WhatsApp +254 722 779 024, or write to us in Nairobi, Kenya. We will reply within the time the law allows.
10. Complaints
If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
11. Changes to this policy
We will update this policy if the way we use personal data changes. The date at the top shows the latest version, and we will tell you by email about any significant change.
