Privacy Policy
Last updated: August 26, 2026
This policy complies with Kenya's Data Protection Act, 2019
1. Data Controller Information
Data Controller: Paul Mbugua Kinyatti
Business: Software Engineering & Cloud Architecture Services
Email: kinyattipaul@gmail.com
Location: Nairobi, Kenya
Website: paulkinyatti.vercel.app
As a data controller under Kenya's Data Protection Act, 2019, I am responsible for determining how and why your personal data is processed.
2. Personal Data We Collect
2.1 Information You Provide Directly
- Contact Inquiries: Name, email address, message content when you use our contact form
- Newsletter Subscription: Email address for technical updates and articles
- Professional Inquiries: Company information, project details, budget ranges for consulting requests
2.2 Information Collected Automatically
- Website Analytics: Pages visited, time spent, referral sources, general location (city/country level)
- Technical Data: IP address, browser type, device information, operating system
- Cookies: Essential cookies for website functionality, analytics cookies (with consent)
3. Legal Basis for Processing (Kenya DPA, 2019)
- Consent: Newsletter subscriptions, analytics cookies, marketing communications
- Legitimate Interest: Responding to business inquiries, website security, fraud prevention
- Contract Performance: Delivering consulting services, project communications
- Legal Obligation: Tax records, business registration compliance
4. How We Use Your Data
- Business Communication: Responding to inquiries about software engineering and cloud architecture services
- Service Delivery: Project management, technical consultations, deliverable sharing
- Content Sharing: Sending technical articles, case studies, and industry insights (newsletter subscribers only)
- Website Improvement: Understanding user behavior to improve content and user experience
- Legal Compliance: Meeting tax, business registration, and regulatory requirements
5. Data Sharing & Third Parties
5.1 Service Providers (Data Processors)
- Vercel: Website hosting and performance (USA)
- Google Analytics: Website analytics (with consent)
- Email Service Provider: Newsletter delivery (if applicable)
5.2 Legal Disclosures
We may disclose personal data if required by Kenyan law, court orders, or to protect our legal rights and safety.
5.3 No Commercial Sale
We do not sell, rent, or trade your personal data to third parties for commercial purposes.
6. Your Rights Under Kenya's Data Protection Act, 2019
- Right of Access: Request a copy of personal data we hold about you
- Right to Rectification: Correct inaccurate or incomplete personal data
- Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
- Right to Restrict Processing: Limit how we use your personal data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent for newsletter, cookies, or marketing at any time
How to Exercise Your Rights: Email kinyattipaul@gmail.com with your request. We will respond within 30 days as required by Kenyan law.
7. Data Retention
- Contact Inquiries: 2 years from last communication
- Newsletter Subscriptions: Until you unsubscribe
- Client Project Data: 7 years (Kenya tax law requirement)
- Website Analytics: 26 months (Google Analytics default)
- Legal Records: As required by Kenyan business law
8. International Data Transfers
Some of our service providers (like Vercel, Google) are based outside Kenya. We ensure adequate protection through:
- Standard Contractual Clauses approved by data protection authorities
- Adequacy decisions where available
- Certification schemes and codes of conduct
9. Data Security
We implement appropriate technical and organizational measures including:
- HTTPS encryption for all data transmission
- Secure hosting infrastructure with regular security updates
- Access controls and authentication for sensitive data
- Regular security assessments and monitoring
Data Breach Notification: In case of a data breach affecting your rights and freedoms, we will notify you within 72 hours as required by Kenya's Data Protection Act.
10. Cookies Policy
10.1 Types of Cookies
- Essential Cookies: Required for website functionality (always active)
- Analytics Cookies: Google Analytics for website improvement (requires consent)
- Preference Cookies: Remember your settings like theme preferences
10.2 Cookie Control
You can control cookies through our consent banner or your browser settings. Disabling essential cookies may affect website functionality.
11. Children's Privacy
Our services are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
12. Changes to This Policy
We may update this policy to reflect changes in our practices or legal requirements. We will notify you of material changes by:
- Updating the "Last updated" date
- Email notification to newsletter subscribers
- Prominent notice on our website
13. Contact & Complaints
Data Protection Inquiries: kinyattipaul@gmail.com
Response Time: Within 30 days as required by Kenya's Data Protection Act
Complaints: If you believe we have not handled your personal data properly, you can file a complaint with:
Office of the Data Protection Commissioner
Website: odpc.go.ke
Email: info@odpc.go.ke
14. Governing Law
This Privacy Policy is governed by the laws of Kenya, including the Data Protection Act, 2019. Any disputes will be resolved in Kenyan courts.