Privacy Policy

1. Data Controller

The data controller for personal data collected through datacraft.co.ke is:

Datacraft Limited is incorporated under the laws of the Republic of Kenya. We are subject to the Kenya Data Protection Act, 2019 (DPA) and, where applicable to data subjects in the European Economic Area (EEA) and United Kingdom, the General Data Protection Regulation (GDPR / UK GDPR).

2. What We Collect

We collect only the data described below. We do not operate data brokers, advertising networks, or tracking pixels.

2.1 Contact form submissions

When you submit the contact form on this site, we receive:

• Your name
• Your email address
• Your message content
• Any other information you voluntarily include in the message body

Form submissions are processed by Formspree (see Section 6) and forwarded to our inbox at hello@datacraft.co.ke.

2.2 Analytics data

We use a privacy-respecting analytics tool to understand how visitors use this site. The data collected is aggregated and does not identify individual visitors. It may include:

• Page views and referral source (e.g. search engine, direct)
• Browser type and operating system (user-agent string)
• Country-level geolocation derived from IP address (the IP address itself is not stored)
• Session duration and pages visited

We do not use Google Analytics or any analytics service that shares data with advertising networks.

2.3 Data you send us directly

If you email us, call us, or engage us on LinkedIn or another platform, we process the personal data contained in that communication (name, contact details, message content) in order to respond.

2.4 What we do not collect

• Payment card or banking details (we have no e-commerce checkout on this site)
• Sensitive personal data (health, biometric, political, religious data)
• Data from social media tracking pixels
• Cross-site behavioural profiles

3. How We Use Your Data

We do not sell, rent, or trade your personal data with third parties for their own marketing purposes.

4. Legal Basis for Processing

Under the Kenya DPA 2019 and GDPR (where applicable), we rely on the following lawful bases:

Legitimate interests (Article 6(1)(f) GDPR / s.30 Kenya DPA)

Processing contact form enquiries and aggregated website analytics falls within our legitimate interest in operating and improving our business. We have conducted a balancing test and determined that our interests are not overridden by your interests or fundamental rights. You may object to processing on this basis at any time (see Section 8).

Consent (Article 6(1)(a) GDPR / s.30 Kenya DPA)

Where we send marketing communications (product announcements, newsletters), we do so only with your prior opt-in consent. You may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us directly.

Pre-contractual measures (Article 6(1)(b) GDPR)

When you request a product demonstration or pricing information, processing your contact details is necessary to take steps at your request prior to entering a contract.

Legal obligation (Article 6(1)(c) GDPR / s.30 Kenya DPA)

We retain certain records to comply with Kenyan company law, tax obligations, and applicable data protection regulations.

5. Data Retention

We keep personal data only as long as necessary for the purpose it was collected.

After the applicable retention period expires, data is securely deleted or anonymised.

6. Third Parties & Sub-processors

We disclose personal data to third parties only where necessary to operate this website or comply with the law.

FormSubmit

Contact form submissions are routed through FormSubmit. FormSubmit acts as a data processor on our behalf. Data transmitted includes only the fields you submit in the form (name, email, message). No data is sold or shared with third parties.

Google Fonts

This site loads typefaces from Google Fonts. When your browser fetches a font file, your IP address is briefly visible to Google's servers. Google states it does not use this data to identify individuals or for advertising. We use Google Fonts solely for typography; we do not embed any Google tracking scripts (Analytics, Tag Manager, Ads, etc.).

What we do not use: Google Analytics, Facebook Pixel, LinkedIn Insight Tag, Twitter/X tracking, HubSpot, Intercom, or any advertising network SDK. There are no third-party tracking cookies on this site.

Email service provider

Inbound enquiries land in our business email inbox (self-hosted on our own infrastructure in the EU). We do not use a third-party email marketing platform unless you have separately opted into a mailing list.

Law enforcement & legal requests

We will disclose personal data if required to do so by a court order, warrant, or other legally binding demand from a competent authority in Kenya or another applicable jurisdiction. Where legally permissible, we will notify you before complying.

7. Cookies

This website uses a minimal cookie footprint. We do not deploy advertising cookies, social media cookies, or third-party tracking cookies.

Session cookies

The site may set a short-lived session cookie to maintain state (e.g. navigation preferences). This cookie expires when you close your browser and contains no personal identifier.

Analytics

If we use a self-hosted analytics tool (e.g. Plausible or Umami), it does not set a persistent cookie. Page view tracking relies on a daily-rotating hash derived from your IP address and user-agent — it cannot be used to track you across sessions or sites.

No third-party tracking cookies

We do not embed widgets, share buttons, or scripts that would allow third parties to set tracking cookies on our domain without your knowledge.

You can configure your browser to refuse all cookies or to alert you when cookies are being set. Refusing cookies will not materially affect your ability to use this website.

8. Your Rights

Depending on your location, you have a number of rights regarding your personal data. We honour all rights below regardless of whether you are in the EEA, UK, or Kenya.

Right of access

You may request a copy of the personal data we hold about you, the purposes for which we process it, and the categories of recipients.

Right to rectification

If personal data we hold about you is inaccurate or incomplete, you may ask us to correct it.

Right to erasure ("right to be forgotten")

You may ask us to delete your personal data where it is no longer necessary for the purpose collected, where you have withdrawn consent, or where we have no overriding legitimate interest to continue processing. Note that we may need to retain certain data to comply with legal obligations.

Right to data portability

Where processing is based on your consent or a contract with you, and is carried out by automated means, you may ask us to provide your data in a structured, commonly-used, machine-readable format (e.g. JSON or CSV).

Right to object

You may object at any time to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is for the establishment, exercise, or defence of legal claims.

Right to restrict processing

You may ask us to restrict processing (i.e. store but not use your data) while a request for rectification or objection is being assessed.

Rights under the Kenya Data Protection Act 2019

The Kenya DPA 2019 confers substantially equivalent rights including: right to be informed, right of access, right to rectification, right to erasure, right to object, right to withdraw consent, and the right not to be subject to automated decision-making with legal or similarly significant effects. You may exercise these rights through the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

How to exercise your rights

Email hello@datacraft.co.ke with the subject line "Data Subject Request". We will respond within 30 days. We do not charge a fee for exercising your rights unless a request is manifestly unfounded or excessive.

Right to lodge a complaint

If you are in Kenya, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC). If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or your national DPA within the EU).

9. International Transfers

Datacraft Limited is based in Kenya. If you are accessing this site from the EEA or UK, your data may be transferred to and processed in Kenya, which is not subject to an EU adequacy decision. Where such transfers occur, we rely on:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into our agreements with relevant sub-processors;
• The sub-processor's own adequacy mechanisms (e.g. EU-US Data Privacy Framework for Formspree).

You may request a copy of the relevant transfer safeguards by contacting us at hello@datacraft.co.ke.

10. Children

This website is directed at business professionals and is not intended for, and does not knowingly collect data from, children under the age of 18. If you believe we have inadvertently collected data about a child, please contact us immediately and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised policy on this page with an updated effective date. For material changes, we will provide more prominent notice (e.g. a banner on the homepage or a direct email if you are on our mailing list).

We encourage you to review this page periodically. Continued use of the site after a revised policy is posted constitutes your acceptance of the updated terms to the extent permitted by applicable law.

12. Contact & Data Protection Officer

For all data protection enquiries, requests to exercise your rights, or complaints, contact our Data Protection Officer:

We aim to respond to all data protection requests within 30 calendar days. If your request is complex or you have made multiple requests, we may extend this by a further two months and will notify you accordingly.