Privacy policy

This policy explains what personal data Nyoni collects, why, how long it’s kept and what rights you have. It’s written to meet Kenya’s Data Protection Act, 2019 and its regulations. If anything here is unclear, email info@nyoni.co.ke.

Who is responsible for your data

Nyoni is a design and web studio founded and owned by Anthony Mwaura in Kerugoya, Kirinyaga County, Kenya. For the purposes of the Act, Nyoni is the data controller for the information described here. Contact: info@nyoni.co.ke, +254 741 049 125.

When Nyoni works on a client’s website or documents and handles personal data on the client’s behalf (for example, the names of a client’s staff, or enquiries submitted through a client’s website), the client is the data controller and Nyoni is a data processor, acting only on the client’s written instructions. A data processing agreement is available on request.

What is collected, and why

When you send an enquiry

The quote form asks for your name, email address, and optionally your phone number, organisation and details about your project. The same applies when you email, call or message on WhatsApp. This is used only to reply to you, prepare a quote and, if you go ahead, run the project. The legal basis is your consent, which you give by ticking the box on the form, and steps taken at your request before entering a contract.

When you become a client

Contact details, project correspondence, contracts, invoices and payment records. The legal basis is performing our contract, and complying with tax law, which requires business records to be kept.

When you visit the website

• Server logs. Like every website, the hosting server records technical information such as IP addresses, browser type and pages requested. These logs are used only for security and fixing faults, and the hosting provider deletes them automatically, normally within 30 days.
• Spam protection. When a form is submitted, a one-way scrambled (hashed) version of your IP address is stored for up to 24 hours to stop repeated automated submissions. The original address can’t be recovered from it.
• Visitor statistics. If statistics are switched on, they’re collected without cookies and without identifying you, or, if Google Analytics is ever used, only after you agree in the cookie banner. See Cookies.

The legal basis for these is Nyoni’s legitimate interest in running a secure, working website.

Who your data is shared with

Personal data is never sold or shared for marketing. It’s shared only with the services needed to run the studio, and only as much as each needs:

• the website hosting provider, which stores the website and its database;
• email services (Cloudflare Email Routing and Google), which deliver and store email;
• payment providers (Safaricom M-Pesa, banks and card payment processors), when you pay an invoice;
• specialists working on your project (such as a translator or printer), only with your agreement and under a duty of confidentiality;
• authorities, such as the Kenya Revenue Authority, where the law requires it.

Data stored outside Kenya

Some of these services, including email, store data on servers outside Kenya. Nyoni only uses providers that offer appropriate safeguards for personal data, as section 48 of the Act requires, and you can ask for details of where your data is held.

How long it’s kept

• Enquiries that don’t become projects: deleted within 12 months of the last contact.
• Client records, contracts and invoices: kept for five years after the end of the financial year they relate to, as Kenyan tax law requires, then deleted.
• Project files: kept for as long as you’re a client and for two years after, so files can be recovered if you lose them, unless you ask for them to be deleted sooner.

Your rights

Under the Data Protection Act, you have the right to:

• be told how your data is used (this policy);
• see the personal data Nyoni holds about you;
• have inaccurate data corrected;
• have data deleted, unless the law requires it to be kept;
• object to processing, and withdraw consent at any time;
• receive your data in a portable format.

To use any of these rights, email info@nyoni.co.ke. You’ll get a reply as quickly as possible and within the time the law allows. If you’re not satisfied, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.

How your data is protected

The website runs on HTTPS. The database is not reachable from the internet. Admin access requires a strong password, passwords are stored only in hashed form, and sessions time out after inactivity. Backups are encrypted or kept in access-controlled storage. Only the people working on your enquiry or project have access to enquiries and client records.

Cookies

The public website does not set cookies. If Google Analytics is switched on in future, it will only load after you choose “That’s fine” in the cookie banner, and you can change your mind by clearing your browser’s data for this site. The admin area uses one strictly necessary cookie to keep the site owner signed in; it isn’t set for visitors.

Children

Nyoni’s services are for organisations and adults. The website isn’t intended for children and doesn’t knowingly collect their data.

Changes to this policy

If this policy changes, the date at the top of the page will change too. Significant changes affecting clients will be communicated directly.