Skip to content
Pata Esim
HomeDestinationsHow it worksHelpChat to buy

Legal

Privacy policy

Last updated 22 October 2026

This policy explains what personal data we collect when you buy an eSIM from us, how we use it, and your rights.

1. Who we are

Pata Esim sells travel eSIM data plans to people travelling from Kenya. We sell through WhatsApp and this website, with help from an AI agent.

For the personal data described here, Pata Esim is the data controller under the Kenya Data Protection Act, 2019.

2. Data we collect

We only collect what we need to sell you an eSIM and support you:

  • Contact details: your phone number, and your name and email address if you give them.
  • Your conversation: the messages you send to our AI agent or our team on WhatsApp or on this website.
  • Trip and order details: your destination, travel dates, the plan you choose and its price.
  • Payment confirmation: from M-PESA or our card processor we receive the transaction reference, amount, status and the paying phone number. We never see or store your M-PESA PIN or your full card number.
  • eSIM details: the eSIM identifier, activation code and data usage, so we can deliver and support it.
  • Technical data: basic information such as IP address and browser type, kept for security and to fix problems.

3. How we use your data

  • To understand your trip, recommend a plan and answer your questions.
  • To take payment and confirm it with M-PESA or our card processor.
  • To issue your eSIM and send you the QR code and install guide.
  • To support you after purchase: remaining data, top-ups and problems.
  • To prevent fraud and abuse and keep our service secure.
  • To keep records the law requires, such as tax records.
  • To send you offers, but only if you agree. You can stop them at any time.

5. Our AI agent

Our WhatsApp and website chat is answered first by an AI agent. It always tells you it is an AI. Your messages are processed by an AI model provider acting on our behalf, only to answer you.

The agent never asks for your M-PESA PIN, card number or passwords. Prices and plans it shows come from our catalogue, not from the AI. You can ask for a person at any time.

6. Who we share data with

We do not sell your personal data. We share only what each partner needs to provide its part of the service:

  • Payment providers: Safaricom (M-PESA) and our card processor, to take your payment.
  • Meta (WhatsApp): when you chat with us on WhatsApp.
  • Our eSIM supplier: to issue your eSIM. We share order details, not your contact details, unless needed for support.
  • Service providers: companies that host our website and database, send our emails, monitor errors and run our AI model, under contracts that limit how they use your data.
  • Authorities: when the law requires it.

7. Data stored outside Kenya

Some of our service providers store data on servers outside Kenya, for example in the United Kingdom, the European Union or the United States. When data leaves Kenya we use safeguards required by the Kenya Data Protection Act, such as contractual protections.

8. How long we keep data

  • Order and payment records: for as long as Kenyan tax law requires, usually five years.
  • Chat messages: up to 12 months after your last message, unless needed for an open issue.
  • Technical logs: up to 90 days.

9. Your rights

Under the Kenya Data Protection Act you can:

  • ask what personal data we hold about you and get a copy;
  • ask us to correct data that is wrong;
  • ask us to delete your data, where the law allows;
  • object to processing, including marketing;
  • withdraw consent you have given.

Contact us using the details below and we will reply within a reasonable time. You can also complain to the Office of the Data Protection Commissioner at odpc.go.ke.

10. How we protect your data

Our website uses encrypted connections. Access to customer data is limited to people who need it, and payment details stay with the payment providers. No system is perfectly secure, and if a breach affects you we will tell you and the Data Protection Commissioner as the law requires.

11. Cookies

This website only uses cookies that it needs to work. We do not use advertising cookies.

12. Children

Our service is for adults. If you are under 18, please ask a parent or guardian to buy for you.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell you before it applies. See also our terms of service.