Your data and your customers’ privacy

Under Kenya’s Data Protection Act you are the data controller for your customers’ conversations, and Sema is the processor: Sema keeps them for you, and nobody outside your workspace can read them. The Act asks you to keep personal data no longer than you need it.

Settings → Data & privacy → How long messages are kept sets that: until deleted, or 30 days, 90 days, 6 months, 1 year, 2 years or 5 years. After that, a message’s words, photos and files are removed from the inbox and from every copy Sema keeps. That the message was sent, when, and what it cost stay, so conversations and the bill still add up.

Export everything → Export data prepares CSV files that open in Excel: your contacts, every message, the consent history, the suppression list, your campaigns and your credit’s transactions. When they are ready they are listed on the same page. The links expire after seven days, because an export is every customer you have. Keep the files somewhere safe.

Photos, documents and voice notes are named in the messages file but not included; save any you need from the conversation itself before closing a workspace.

When a customer asks you to delete what you hold about them, open their contact and, under Their rights, press Erase permanently. Owners, admins and managers can do this.

• Their name, details, tags, messages and files are removed and cannot be restored.
• Their number goes on the suppression list, so they are never messaged or imported again.
• The activity log records that a customer was erased, and by whom.

If they only want a copy, use Download their data instead.

The Suppression list is numbers that will never be messaged or re-imported, whatever a future spreadsheet says: people who replied STOP, and customers you erased on request. It outlives the contacts themselves. Otherwise last year’s import would quietly bring back someone who asked to be left alone.

Only an owner can close a workspace:

1. Settings → Data & privacy → Closing this workspace.
2. Type the workspace’s name to confirm, and close it.

Everything (conversations, contacts, campaigns and attachments) is deleted for good 30 days later. Until then the owner can press Keep this workspace to reopen it. Export first if you want a copy. Billing records are kept, because Kenyan tax law requires seven years, and so is the suppression list, so anyone who asked not to be messaged stays unmessaged.

How Sema itself handles personal data is in the privacy notice.