Legal
Privacy policy
This policy explains what personal data Kimcard Technologies collects, why, on what legal basis, how long we keep it, who else handles it, and what you can ask us to do about it. It is written for the Data Protection Act 2019, in plain English, so that it can be read in a few minutes.
1. Who we are
Kimcard Technologies (registered business name), owner David Kimani, based in Nairobi, Kenya. For the data this policy covers, the data controller is David Kimani, trading as Kimcard Technologies.
- Address: P.O. Box 01000, 00100 Nairobi, Kenya
- Email: hello@kimcardtechnologies.com, which is monitored and is the address for every request under this policy.
2. The two roles we have
The Act treats the same business differently depending on whose data it is.
Where we are the controller
We decide why and how personal data is used for the people who deal with us directly: visitors to this site, people who send an enquiry, newsletter subscribers, people we book calls with, and the contacts at our clients who use our client portal. This policy governs that data.
Where we are a processor
When we build, host or maintain a system for a client, the personal data inside it belongs to the client, who is the controller. We handle it only on the client's instructions, under the contract we sign with them and its data-processing annex. This policy does not govern that data. If you are a customer of one of our clients, ask that client: they decide what happens to your data, and we act for them.
The terms we work to as a processor are in the data-processing annex of our master service agreement.
rentiQ, our own product, runs on its own domain and processes its customers' data under its own terms. Neither this policy nor the annex covers it.
3. What we collect, why, and for how long
One entry per purpose, each with its own legal basis and its own retention period.
Enquiries
- What
- Your name, email address, company name if you give one, and your message, including anything you choose to tell us about budget or deadlines.
- Why
- Replying to you and preparing for a scoping call.
- Legal basis
- Steps you asked us to take before entering a contract
- How long
- We keep it for two years from your last message, then delete it. If the enquiry becomes an engagement, it becomes part of the engagement record below.
Scoping calls
- What
- Your name and email address on the calendar invitation, the video call itself, and the notes we take during it. We do not record calls.
- Why
- Holding the call you asked for and writing up what was agreed.
- Legal basis
- Steps you asked us to take before entering a contract
- How long
- We keep it on the same schedule as enquiries.
Site analytics
- What
- Aggregate counts of page views, referrers and a short list of named actions on the site, such as starting or finishing a booking. No cookie is set, and nothing is recorded that identifies you or follows you to another site.
- Why
- Seeing which pages are useful, and where people stop on the way to booking a call.
- Legal basis
- Consent, which you can withdraw at any time
- How long
- We keep it only as aggregate counts, which hold no personal record to delete.
Server logs
- What
- Ordinary web server access logs, which include IP addresses.
- Why
- Delivering the site and the portal, and diagnosing abuse or failure.
- Legal basis
- Legitimate interest: Running a site and a portal that work and that we can defend against abuse. The logs are not used for analytics or profiling.
- How long
- We keep it for the period our host keeps access logs.
Client portal accounts
- What
- For each contact a client invites: name, email address, role, a hashed password, sign-in records, and what you write in the portal, such as tickets, comments and approvals.
- Why
- Giving your organisation access to its tickets, documents, invoices and reports.
- Legal basis
- Performance of a contract with you or your organisation
- How long
- We keep it for the life of the engagement and twelve months after it ends, then delete the account.
Engagement records
- What
- Contracts, statements of work, specifications, correspondence, and the documents exchanged during an engagement.
- Why
- Delivering the work and keeping a record of what was agreed.
- Legal basis
- Performance of a contract with you or your organisation
- How long
- We keep it for six years after the engagement ends.
Tax and invoicing records
- What
- Invoices, payments, and the identifiers on them, such as a KRA PIN.
- Why
- Meeting our obligations under Kenyan tax law.
- Legal basis
- Legal obligation
- How long
- We keep it for five years, the period Kenyan tax law requires.
We do not buy contact data, and we do not sell, rent or share yours for anybody else's marketing. There is no advertising network, tracking pixel or third-party embed on this site.
4. Who handles it for us
These companies process personal data on our behalf. Each receives only what its job needs.
| Provider | What it does and receives | Where |
|---|---|---|
| Namecheap Namecheap, Inc. | Hosts this website, our CMS and its database, and the client portal. Your browser connects to its servers, an enquiry you send is stored there, and it processes access logs. | United States |
| Resend Plus Five Five, Inc. | Sends our transactional and newsletter email: the notification that an enquiry has arrived, newsletter confirmations and issues, and client portal invitations. Your name, email, and message pass through it. | United States |
| Google Google Cloud EMEA Limited | Runs our company email, calendar and video calls. Replies to your enquiry, and any call we book with you, go through it. | Ireland |
| Umami Umami Software, Inc. | Counts page views, referrers and a few named actions for us, cookieless and in aggregate, and only after you accept analytics. | Germany |
What is not a third party
Some of what we run is ours, on our own hosting account, so no outside company sees the data in it:
- Our CMS: Stores enquiries, newsletter subscriptions, client records and the portal. It runs on our own hosting account, not on a software-as-a-service platform.
- Monitoring and error reporting: Error reports and heartbeats from the systems we run are sent to our own CMS, not to a monitoring vendor.
5. Data leaving Kenya
Our servers are in the United States, and so are several of the providers above, so personal data you give us is processed outside Kenya. The safeguard we rely on is the data-protection terms each provider contracts to.
If you would rather your data did not leave Kenya, tell us before you send it, and we will tell you honestly whether we can help.
6. Your rights
Every request goes to hello@kimcardtechnologies.com. We confirm who you are before acting on it, we do not charge, and we reply within 7 days for a copy of your data and within 14 days for anything else.
| Right | What it means | How to use it |
|---|---|---|
| Access | A copy of the personal data we hold about you. | Email us. We confirm who you are, then send it. |
| Rectification | Correction of anything inaccurate or incomplete. | Email us with the correction. |
| Erasure | Deletion, where we have no legal obligation to keep it. | Email us. Tax records are the usual exception, and we will tell you if one applies. |
| Objection | Stopping processing we base on legitimate interest. | Email us and say what you object to. |
| Restriction | Pausing processing while a dispute about it is settled. | Email us. We mark the record and stop using it until the question is resolved. |
| Portability | Your data in a structured, machine-readable form. | Email us. We send it in a common machine-readable format. |
| Withdrawing consent | Ending anything we do on the basis of consent. | Unsubscribe from any newsletter issue, or clear the analytics choice in your browser so the banner asks again. Withdrawing does not undo processing that was lawful before you did. |
7. Complaining to the regulator
You can complain to the Office of the Data Protection Commissioner, which accepts complaints through its website at odpc.go.ke. You do not have to come to us first, though we would like the chance to put it right.
8. Security
Access to personal data is limited by role, credentials are kept out of code, and everything travels over HTTPS. The detail, including what we do not yet have, is on our security page.
9. If something goes wrong
If a breach affects personal data we control, we tell the Data Protection Commissioner within 72 hours of becoming aware of it, and we tell the people affected without delay where it puts them at real risk. If it affects data we process for a client, we tell the client within 48 hours so they can meet their own obligations.
10. Children
Our services are for businesses and are not directed at children. We do not knowingly collect data from anyone under 18, and if we learn we have, we delete it.
11. Changes to this policy
The effective date at the top changes whenever this policy does, with a note of what changed. If a change affects data you have already given us, we tell you rather than rely on you noticing a date.
This version: Rewritten for the Data Protection Act 2019. It now separates the data we control from the data we process for clients, gives a lawful basis and a retention period for each purpose, and names every processor and where it works.