Privacy Policy

Danamo Tech Ltd ("Danamo Tech", "we", "us", or "our") is a company duly incorporated under the Companies Act, 2015 (No. 17 of 2015) of the Laws of Kenya, with its registered office in Mombasa, Kenya.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at danamotech.co.ke, submit a contact form, apply for a role, register for a webinar, or subscribe to our newsletter. It is issued in accordance with our obligations as a data controller under the Data Protection Act, 2019 (No. 24 of 2019) ("the Act") and the Data Protection (General) Regulations, 2021.

1. Who We Are

2. Personal Data We Collect

We collect only the minimum personal data necessary for the purposes described below. The categories are:

• Identity Data: full name, job title, company name.
• Contact Data: email address, telephone number, physical address.
• Account Data: hashed password, session identifiers, profile information you choose to provide (bio, avatar, phone).
• Recruitment Data: curriculum vitae, cover letter, professional history submitted through our Careers page.
• Event Data: webinar registration details, name and email associated with a registration.
• Technical Data: IP address, browser type and version, time zone, operating system, and device identifiers, collected via cookies and server logs.
• Usage Data: pages viewed, time spent, referral source, and interactions with our site.

We do not knowingly collect sensitive personal data as defined under Section 2 of the Act (which includes data revealing race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of children, parents, spouse or spouses, sex or the sexual orientation of a data subject) unless a specific lawful basis applies and we have obtained your explicit consent.

3. How We Collect Your Data

• Directly from you: when you fill a contact form, create an account, apply for a job, register for a webinar, or subscribe to our newsletter.
• Automatically: through cookies, server logs, and analytics tools when you browse the site.
• From third parties: where you have authorised a third party (for example, a recruitment platform) to share your data with us.

4. Lawful Basis for Processing

Under Section 30 of the Act, we rely on the following lawful bases:

5. How We Use Your Data

• To provide, operate, and maintain our website and services.
• To respond to your inquiries and communicate with you about projects.
• To process job applications and manage recruitment.
• To administer webinar registrations and send joining instructions.
• To send newsletters where you have opted in (you may unsubscribe at any time).
• To detect, prevent, and address technical issues and security threats.
• To comply with legal and regulatory obligations, including under the Act.

6. Data Sharing and Disclosure

We do not sell your personal data. We share it only with:

• Service providers acting as data processors on our behalf (hosting, email delivery, analytics, payment processing), bound by written data processing agreements as required by Section 42 of the Act.
• Professional advisers (lawyers, auditors) where necessary.
• Regulators and law enforcement where required by law, court order, or a lawful request from the Office of the Data Protection Commissioner.
• Successors in title in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

7. Cross-Border Transfers

Some of our service providers may store or process data outside Kenya. Under Section 48 of the Act, we will only transfer personal data outside Kenya where:

• the recipient country has been designated by the Data Commissioner as providing adequate data protection safeguards; or
• appropriate safeguards are in place (including the ODPC's Standard Contractual Clauses issued in 2023); or
• you have given explicit consent after being informed of the risks; or
• a specific derogation under the Act applies.

8. Data Retention

We retain personal data only as long as is reasonably necessary for the purpose for which it was collected, as required by Section 25(f) of the Act. Our default retention periods are:

• Contact and service inquiries: 24 months from last correspondence.
• Career applications and CVs: 12 months from submission, unless you ask us to keep them longer.
• Webinar registrations: 24 months from the event date.
• Newsletter subscriptions: until you unsubscribe, plus a suppression record to honour your opt-out.
• Account data: until account deletion, then 30 days in backups before permanent erasure.

9. Your Rights as a Data Subject

Under Section 26 of the Act, you have the right to:

• be informed of the use to which your personal data is to be put;
• access your personal data in our custody or control;
• object to the processing of all or part of your personal data;
• request correction of false or misleading data;
• request deletion of false or misleading data;
• data portability, where technically feasible;
• withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, email privacy@danamotech.co.ke. We will respond within seven (7) days of receiving a verified request, as required by the Act, and in any event within the statutory timeline.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include HTTPS encryption, hashed passwords using Argon2id, HttpOnly session cookies, strict access controls on our admin systems, and regular security reviews. In the event of a personal data breach, we will notify the Office of the Data Protection Commissioner without undue delay and within 72 hours of becoming aware, and we will notify affected data subjects where there is a real risk of harm, in accordance with Section 43 of the Act.

11. Children's Data

Our services are not directed at children. Under the Act, a person under 18 is a child for consent purposes, and processing their personal data requires parental or guardian authorisation. If you believe we have collected a child's data without appropriate consent, contact us immediately at privacy@danamotech.co.ke and we will delete it.

12. Complaints to the Regulator

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC):

• Website: odpc.go.ke
• Email: complaints@odpc.go.ke
• Address: Britam Tower, Hospital Road, Upper Hill, Nairobi, Kenya

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, or our practices. The "Last updated" date at the top of this page will always reflect the most recent revision. Material changes will be notified to registered users by email where appropriate.

14. Contact Us

For any questions about this Privacy Policy or our data practices, contact:

• Email: privacy@danamotech.co.ke
• Postal: Danamo Tech Ltd, 93294 - 80102, Mombasa, Kenya

This Privacy Policy is drafted to align with the Kenya Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, and the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021. It should be reviewed by a qualified Kenyan advocate before publication and at least annually thereafter.