Website security

1. Transport security

callbeba.co.ke is served over HTTPS so data in transit between your browser and our servers is encrypted.

2. Administrator and account security

• Admin and vendor panels require login; passwords are stored using modern one-way hashing.
• Access to customer and vendor data is limited to authorised staff and systems that need it to operate the service.
• Users should choose strong passwords and not share account credentials.

3. Data access and retention

We restrict access to personal data on a need-to-know basis. Retention and deletion follow our Privacy policy including keeping order records for support and legal needs, then deleting or anonymising when no longer required.

4. Backups

We maintain backups of critical systems and data to support recovery from failure. Backups are protected with appropriate access controls for our hosting environment.

5. Data-breach response

If we become aware of a personal data breach that risks people’s rights, we will investigate, contain the issue, and notify affected users and the Office of the Data Protection Commissioner when required under the Data Protection Act, 2019 and related guidance.

6. Your part

Use official Callbeba links, be careful with unexpected payment requests, and report suspected phishing or fake shops via Complaints & fraud.