Privacy Policy
Who is responsible for your data
This website is operated by Anthony Karanja, based in Kenya. Anthony Karanja is the data controller for personal data collected through this site. You can contact him at [email protected].
What is collected and why
| Purpose | Data | Basis |
|---|---|---|
| Contact enquiries | Name, email address, optional phone number, enquiry topic, optional budget range, your message, a keyed hash of your IP address, and the time of submission | Your consent, given by ticking the box on the form |
| Newsletter | Email address and the time you subscribed and confirmed | Your consent |
| Spam and abuse protection | IP address and request details recorded when a request is blocked or rate limited | Legitimate interest in keeping the site secure |
| Cookie choice | An anonymous record of whether analytics were accepted, with no identifier | Legal obligation to record consent |
| Announcements and campaigns | Aggregate daily counts of how often a banner was shown, clicked or dismissed, with no identifier, IP address or cookie attached. Your own dismissal choice is stored in a cookie on your device | Legitimate interest in understanding which messages are useful (can be switched to consent-only or off by the site owner) |
| Analytics (optional) | Pages viewed and approximate device information, only if you accept analytics | Your consent |
How your data is used
Enquiry details are used to reply to you, to keep a record of the conversation, and to send you an acknowledgement email with a reference number. Newsletter addresses are used only to send the updates you asked for. Your data is not sold and is not used for automated decision making.
Who receives it
Email is sent and received through Google (Gmail and Google Workspace). Form protection is provided by Cloudflare Turnstile, which receives technical information from your browser to tell people and bots apart. If you accept analytics, Google Analytics or a similar service receives usage data. These providers may process data outside Kenya. The site is hosted on a server controlled by the site owner.
How long it is kept
Enquiries are kept while the conversation is active and for the period needed to keep a business record. Enquiries marked as archived are deleted automatically after two years. Security event records are deleted after 90 days. Copies of email message bodies held for delivery retries are cleared after 30 days. Newsletter addresses are kept until you unsubscribe.
Your rights
Under the Kenya Data Protection Act, 2019 you have the right to be informed about the use of your data, to access it, to object to its processing, to have inaccurate data corrected, to have your data deleted, and to withdraw consent at any time. To use any of these rights, write to [email protected] and quote your enquiry reference number if you have one. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya.
Security
Data is transmitted over HTTPS. Enquiries are stored in a database that only authenticated administrators with two-step verification can open. See the Data Protection page for more detail.
Changes
This policy is reviewed when the site changes. The date of the last review is shown at the top of this page.