Draft for review before launch. This notice is being reviewed by a lawyer and may change before the site goes live.
Who we are
Doxah Systems Ltd., a company registered in Kenya and based in Nairobi, is responsible for the personal information collected through this website (the "data controller"). For any privacy question or request, email info@doxahsystems.com with "Privacy" in the subject.
What we collect
When you contact us, we collect the details you choose to give: your name, email address, phone or WhatsApp number, organisation, the type of help you need and your message, with the date and time you sent it. Please don't send payment card details through this website.
Newsletter
If you subscribe, we keep your email address and a record of your consent (when, and on which page, you agreed). We use it only to send the monthly newsletter. Every email has a one-click unsubscribe link, and you can ask us to delete your details at any time.
Cookies and analytics
With your consent, we use Google Analytics to count visits and see which pages are useful. It uses cookies and shows us information such as pages viewed, approximate location (country or city), device type and how you reached the site, not who you are. Without your consent, Google Analytics does not run. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. Full details are in our cookie policy.
Our form handlers use your IP address briefly, stored only in a one-way scrambled (hashed) form, to stop spam and abuse.
WhatsApp and the site assistant
If you message us on WhatsApp, that conversation is also handled under WhatsApp's own terms and privacy policy (WhatsApp is owned by Meta). The site assistant on our pages runs in your browser and does not store or send what you type.
Why we use it
Only to reply to your enquiry, prepare a proposal you asked for, deliver and invoice work you agree to, send the newsletter you subscribed to, and keep the website secure and useful. Our lawful bases are your consent (newsletter and analytics), steps you ask us to take before a contract (enquiries and proposals), our contract with you, and our legitimate interest in keeping the site secure. We never sell your information or use it for unrelated marketing.
Who we share it with
Trusted service providers who help us run the business, such as our website host (Namecheap), email, analytics (Google) and accounting services, under agreements that protect your data. Some store data outside Kenya, with the safeguards the Act requires. We share information with authorities only when the law requires it.
How long we keep it
Enquiries that don't lead to work are deleted after 12 months. Newsletter details are kept until you unsubscribe. Records of work and invoices are kept for 7 years, as tax law requires. Analytics data is kept for 14 months.
Security
The website uses HTTPS encryption and security headers. Form submissions are stored in a private area of our hosting that cannot be reached from the web, and access is limited to the people who need it.
Your rights
You can ask to see, correct or delete the personal information we hold about you, object to how we use it, withdraw consent at any time, and ask us to move your data. Email info@doxahsystems.com and we'll respond within the time the law allows. If you're not satisfied, you can complain to the Office of the Data Protection Commissioner (ODPC).
Children's information
This website is not aimed at children, and we don't knowingly collect children's information through it. Where we build systems for schools or children's homes, the institution decides how children's information is used and obtains consent from parents or guardians. We handle that information only on the institution's written instructions.