Legal
Privacy policy
This policy covers kimcardtechnologies.com and the enquiries you send through it. It explains what we collect, why, how long we keep it, and what you can ask us to do about it.
1. Who we are
This website is operated by Kimcard Technologies (registered business name), owner David Kimani, based in Nairobi, Kenya. For the purposes of the Data Protection Act 2019, the data controller is David Kimani, trading as Kimcard Technologies.
For anything to do with your data, write to hello@kimcardtechnologies.com.
rentiQ, our own product, runs on a separate domain and processes data belonging to its customers under its own terms. This policy does not cover it. Nor does it cover davidkimani.dev, the founder's personal site, which publishes its own policy.
2. What we collect
Contact form
When you send an enquiry we collect your name, email address, your company name if you give one, and your message. The company field is optional. Everything else is needed to reply to you.
The form also carries a hidden field that real people leave empty and automated submitters tend to fill in. If it arrives filled, the message is rejected. Nothing about you is stored in that case.
Analytics
We use Umami, a cookieless analytics tool we host ourselves. It counts page views and referrers in aggregate. It sets no cookie, follows you to no other site, and records nothing that identifies you. It does not load at all until you accept it in the banner, and if you decline, no analytics script is ever requested.
What your browser stores
Your theme choice and your answer to the analytics banner are saved on your own device and never sent to us. Your language preference is kept in a cookie. The cookie and storage policy lists all three by name.
Server logs
Our hosting provider records ordinary web server access logs, which include IP addresses, as part of delivering and protecting the site. We do not use those logs for analytics or profiling.
What we do not collect
There is no newsletter on this site, no account to create, no advertising network, no tracking pixel, and no third-party embed. We do not buy contact data, and we do not sell or rent yours.
3. Why we process it, and on what basis
| Data | Purpose | Lawful basis (DPA 2019) |
|---|---|---|
| Contact form: name, email, company, message | Replying to your enquiry and preparing for a scoping call | Steps taken at your request before entering a contract |
| Aggregate analytics | Seeing which pages are useful so we can write better ones | Consent, given in the banner and withdrawable |
| Theme, consent, and language preferences | Making the site behave the way you left it | Necessary for a service you asked for |
| Server access logs | Delivering the site, and diagnosing abuse or failure | Legitimate interest in running a working, secure site |
If an enquiry turns into a project, the personal data in that engagement is governed by the contract we sign, not by this page.
4. Who processes it for us
We use a small number of providers to run the site. Where they process data outside Kenya, we rely on the contractual terms in their data processing agreements.
- Namecheap (United States): hosts this website. Your browser connects to its servers, and it processes access logs.
- Render (United States): hosts our CMS and its PostgreSQL database. Your enquiry is stored there.
- Resend (United States): sends the notification email that tells us an enquiry has arrived. Your name, email, and message pass through it.
- Umami: analytics, hosted by us rather than by a vendor. Aggregate counts only, and only with your consent.
That is the full list. We do not share your data with anyone else, and there is no advertising or data broking relationship anywhere in it.
5. How long we keep it
- Enquiries are kept for up to two years from your last message, so we can pick up a conversation that goes quiet and restarts. After that they are deleted. If your enquiry becomes a project, the record is kept for as long as the business relationship and any tax or contractual obligation requires.
- Analytics hold no personal records, so there is nothing to delete.
- Server logs are retained on our providers' standard schedules, which are short and measured in weeks.
6. How we protect it
The site is served over HTTPS only. Enquiries are stored in a managed PostgreSQL database that is reachable only by the application. Reading one means signing in to our CMS, which is password-protected and supports two-factor authentication. We keep the number of people who can read your enquiry as small as it can be, which today means the founder.
No system is perfectly secure and we will not claim otherwise. If a breach ever affects your data, we will notify you and the Office of the Data Protection Commissioner as the Act requires.
7. Your rights
Under the Data Protection Act 2019 you have the right to:
- Be informed of how your data is used, which is what this page is for.
- Access the personal data we hold about you.
- Correct anything inaccurate or incomplete.
- Delete your data, where we have no overriding obligation to keep it.
- Object to processing we base on legitimate interest.
- Restrict processing while a dispute about it is resolved.
- Receive a copy of your data in a portable, machine-readable form.
- Withdraw consent at any time. Withdrawing it does not undo processing that was lawful before you did. For analytics, clear the stored consent as described in the cookie and storage policy, and the banner will ask again.
To exercise any of these, email hello@kimcardtechnologies.com. We will respond within 21 days, which is the period the Act allows. We do not charge for this.
You can also complain to the Office of the Data Protection Commissioner in Kenya, at odpc.go.ke. You do not have to raise it with us first, though we would rather you did.
8. Children
This is a business-to-business site and it is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us something, tell us and we will delete it.
9. Changes
When this policy changes, the effective date at the top changes with it. If a change materially affects how we handle data you have already given us, we will say so rather than rely on you noticing a date.
10. Contact
Kimcard Technologies (registered business name), owner David Kimani
Nairobi, Kenya
hello@kimcardtechnologies.com