1. Overview
Sema Link Limited ("Sema Link", "we", "our", "us") operates the SMS gateway platform available at semalink.africa and associated domains. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website, platform, and API.
We are committed to compliance with the Kenya Data Protection Act, 2019, the Tanzania Personal Data Protection Act, 2022, Uganda's Data Protection and Privacy Act, 2019, and the EU General Data Protection Regulation (GDPR) where applicable.
2. Data We Collect
2.1 Account Data
When you register for a Sema Link account we collect your name, business name, email address, phone number, and billing details. If you verify your identity for sender ID registration we may collect a copy of your national ID or business registration certificate.
2.2 Usage Data
We automatically collect data about how you use our platform including API requests, message logs (sender, recipient MSISDN, message content, timestamps, delivery status), dashboard activity, and IP addresses.
2.3 Message Content
To provide delivery and analytics services we temporarily process the content of SMS messages you send through our platform. Message content is stored only as long as necessary for delivery confirmation and audit purposes (see Section 5).
2.4 Payment Data
Payment transactions via M-Pesa, card, or bank transfer are processed by our payment partners. We store transaction references and amounts but do not store full card numbers or M-Pesa PINs.
2.5 Cookies & Analytics
Our website uses first-party cookies and analytics tools to understand usage patterns. See Section 8 for details.
3. How We Use Your Data
- To provision and operate your Sema Link account and process API requests.
- To route SMS messages to mobile network operators and return delivery reports.
- To send transactional emails (invoices, API key notifications, security alerts).
- To detect and prevent fraud, abuse, and spam.
- To comply with legal obligations including telecommunications regulations and tax requirements.
- To improve platform performance through aggregated, anonymised analytics.
We do not use your message content for advertising or sell it to third parties.
4. Data Sharing
We share personal data only as necessary:
- Mobile Network Operators (MNOs), including Safaricom, Airtel, and MTN, receive the recipient MSISDN and message content to effect delivery.
- Payment processors, such as M-Pesa (Safaricom) and card processors, receive billing data to complete transactions.
- Cloud infrastructure providers: our hosting providers process data to run our platform under data processing agreements.
- Regulators and law enforcement: we may disclose data when required by valid legal process under Kenyan, Tanzanian, or Ugandan law.
We do not sell personal data to data brokers, advertisers, or any third party for commercial purposes.
5. Retention & Deletion
- Message logs (metadata: sender, recipient, status, timestamps): retained for 12 months, then automatically purged.
- Message content: retained for 90 days, then purged.
- Account data: retained while your account is active and for 7 years after closure for tax and regulatory compliance.
- Payment records: retained for 7 years as required by Kenyan tax law.
You may request earlier deletion of message content by contacting us at privacy@semalink.africa. Deletion requests for account data may be subject to legal retention obligations.
6. Security
We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest for sensitive fields, role-based access controls, API key hashing, and regular penetration testing. We maintain an incident response plan and will notify affected users within 72 hours of a confirmed data breach as required by applicable law.
7. Your Rights
Depending on your jurisdiction you have the right to:
- Access a copy of the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your data (subject to retention obligations).
- Object to or restrict certain processing.
- Data portability: receive your data in a machine-readable format.
- Lodge a complaint with your national data protection authority.
To exercise any of these rights, email privacy@semalink.africa with the subject line "Data Subject Request". We will respond within 30 days.
9. Children's Privacy
Our platform is intended for businesses and developers aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe we hold data about a child, please contact us immediately at privacy@semalink.africa.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users at least 14 days before taking effect. The "Last updated" date at the top of this page always reflects the most recent revision. Continued use of Sema Link after the effective date constitutes acceptance of the updated policy.
11. Contact Us
For privacy enquiries, data subject requests, or to report a concern:
Sema Link Limited
Email: privacy@semalink.africa
Nairobi, Kenya