1. Who we are
This Privacy Policy explains how Spursud Trading Limited (company number PVT-RXU22JQR), “Spursud”, “we” or “us”, collects, uses, shares and protects personal data when you visit this website, contact us or use our software development services. We are the data controller for the personal data described here. Our registered office is at Epic Business Park, Links Road, Nyali, Mombasa, Kenya. We process personal data in line with the Data Protection Act, 2019 of Kenya and its regulations, and we apply the same standards to clients located outside Kenya.
2. The data we collect
We collect only the information we need, which may include:
- Contact details such as your name, company, job title, email address and phone or WhatsApp number when you submit an enquiry, call or email us;
- Project information you choose to share, such as requirements, budgets, documents and feedback;
- Billing information such as billing address, KRA PIN or tax number, and payment references for M-Pesa, bank or card transactions. We do not store full card numbers;
- Technical data such as IP address, browser type, device, pages visited and referring site, collected through server logs and analytics;
- Preferences such as your chosen display currency (USD or KES), which is stored in your own browser.
3. How and why we use your data
We use personal data on the following lawful bases:
- To respond to enquiries and prepare quotations, which are steps taken at your request before entering a contract;
- To deliver, invoice and support our Services, which is necessary to perform our contract with you;
- To meet legal obligations, such as tax, accounting and record-keeping requirements in Kenya;
- To improve and secure our website, which is in our legitimate interest;
- To send occasional updates or marketing, only with your consent, which you can withdraw at any time.
We do not sell your personal data, and we do not use it for automated decision-making.
4. Client data in the software we build
When we build, host or maintain software for you, we may have access to personal data belonging to your own customers or staff. In that case you are the data controller and we act as your data processor. We process that data only on your documented instructions, keep it confidential, apply appropriate security measures and delete or return it at the end of the engagement, unless the law requires us to keep it.
5. Sharing your data
We share personal data only with trusted parties who help us run our business, such as:
- cloud hosting, email and file-storage providers;
- payment processors, banks and mobile-money operators;
- accountants, auditors and legal advisers;
- government authorities, including the Kenya Revenue Authority, where required by law.
These parties may only use your data to provide services to us and must protect it. Some providers may store data outside Kenya. Where this happens, we make sure that appropriate safeguards are in place, as required by the Data Protection Act, 2019.
6. Cookies and analytics
Our website uses a small amount of browser storage to remember your currency preference. We may use privacy-friendly analytics to understand how the site is used in aggregate. Embedded content, such as maps, may set its own cookies under the provider’s policies. You can block or delete cookies in your browser settings, although some features may then stop working.
7. How long we keep data
Enquiries that do not lead to a project are deleted within twenty-four (24) months. Contract and billing records are kept for at least seven (7) years to meet tax and accounting requirements. Server logs are normally kept for no longer than ninety (90) days.
8. Security
We protect personal data with encryption in transit, access controls, multi-factor authentication, regular updates and backups. No system is completely secure, but if we become aware of a data breach that affects you, we will notify you and the Office of the Data Protection Commissioner as required by law.
9. Your rights
Under the Data Protection Act, 2019, you have the right to be informed about how your data is used, to access it, to have inaccurate data corrected, to have data deleted, to object to or restrict processing, to withdraw consent and to data portability. To make a request, email us using the details below. We will respond within the time required by law. If you are unhappy with our response, you can complain to the Office of the Data Protection Commissioner (ODPC) of Kenya.
10. Children
Our website and Services are intended for businesses and adults. We do not knowingly collect personal data from children.
11. Changes and contact
We may update this policy from time to time, and the latest version will always be published here. For privacy questions or requests, contact us at [email protected] or write to Spursud Trading Limited, P.O. Box 34470 – 80118, Nyali, Kenya.