Last updated: January 2025 · Orena Cloud, Inc. · Nairobi, Kenya
Orena Cloud, Inc. ("Orena", "we", "us", "our") is a cloud infrastructure company incorporated and operating in Nairobi, Kenya. We operate the orenacloud.com website and the Orena Cloud console (console.orenacloud.com).
Orena is the data controller for personal data collected through our website and console. For all privacy-related enquiries:
We collect personal data in three ways: data you provide directly, data generated automatically when you use our services, and data we receive from third parties involved in delivering our services.
| Data type | When collected | Examples |
|---|---|---|
| Account information | Registration | Full name, email address, phone number |
| Billing information | Adding a payment method | M-Pesa number, Paystack token, billing address |
| Identity verification | KYC for high-spend accounts | National ID number, business registration number |
| Support communications | Contacting support | Messages, attachments, ticket content |
| Survey responses | Product research | Feedback, feature requests, NPS scores |
| Data type | Purpose | Retention |
|---|---|---|
| IP address and device type | Security, fraud prevention | 90 days |
| Console activity logs | Audit trail, security | 12 months |
| API request logs | Debugging, rate limiting | 30 days |
| Payment transaction records | Billing, tax compliance | 7 years (legal requirement) |
| Cookie data | Session management, analytics | See Cookie Policy |
We receive limited data from payment processors (M-Pesa / Safaricom, Paystack) to confirm payment status. We do not receive your full financial account details from these processors — only a transaction reference and status.
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing and operating our services | Account info, activity logs | Performance of contract |
| Processing payments and issuing invoices | Billing info, transaction records | Performance of contract |
| Communicating about your account | Email, phone number | Performance of contract |
| Providing customer support | Support communications, activity logs | Performance of contract |
| Security and fraud prevention | IP address, activity logs | Legitimate interest |
| Improving our products | Aggregated usage analytics | Legitimate interest |
| Sending product updates and news | Email address | Consent (you can unsubscribe at any time) |
| Complying with legal obligations | Transaction records, identity data | Legal obligation |
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients, and only to the extent necessary:
All personal data collected by Orena Cloud is stored in our ke-nairobi-1 availability zone — our Tier III certified data centre in Nairobi, Kenya. We do not transfer your personal data outside Kenya unless strictly necessary for payment processing (e.g. international card transactions via Paystack) or to comply with a legal obligation.
Where cross-border transfer is unavoidable, we ensure appropriate safeguards are in place in accordance with Section 25 of the Kenya Data Protection Act 2019, including adequacy decisions or standard contractual clauses.
Our commitment: Customer workload data — the data you store in Orena VMs, databases, and object storage — never leaves Nairobi under any circumstances. This is a technical guarantee enforced by our infrastructure, not merely a policy statement.
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data category | Retention period | Reason |
|---|---|---|
| Account data | Duration of account + 30 days | Service delivery; deletion grace period |
| Billing and transaction records | 7 years from transaction date | Kenya Revenue Authority requirement |
| Console activity logs | 12 months | Security audit trail |
| API request logs | 30 days | Debugging and rate limiting |
| Support tickets | 3 years from ticket close | Quality assurance and legal reference |
| Marketing preferences | Until you unsubscribe or request deletion | Consent-based |
| Deleted account data | Purged within 30 days of account deletion | Except where legal retention applies |
The Kenya Data Protection Act 2019 grants you the following rights over your personal data. You can exercise any of these rights by contacting privacy@orenacloud.com. We will respond within 30 days.
We implement technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration:
In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Commissioner within 72 hours of becoming aware of the breach, as required by DPA 2019.
Orena Cloud services are not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact privacy@orenacloud.com and we will delete that data promptly.
We may update this Privacy Policy from time to time. When we make material changes — such as collecting a new category of data or changing how we share data — we will notify you by email and display a prominent notice in the console at least 14 days before the change takes effect.
Minor changes (such as clarifying existing practices or updating contact details) will be reflected in the "Last updated" date at the top of this page without active notification. We encourage you to review this page periodically.
For any questions about this Privacy Policy, to exercise your rights, or to report a concern about how we handle your data:
If you are not satisfied with our response, you have the right to escalate your complaint to the Kenya Office of the Data Protection Commissioner: