Legal
Privacy Policy
How Amkatek Limited collects, uses and protects personal data, in line with Kenya’s Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
Last updated: 12 November 2026
On this page
- Who we are
- What this policy covers
- Personal data we collect
- How we collect it
- Why we use it and our legal basis
- Cookies and third-party services
- Who we share it with
- Transfers outside Kenya
- How long we keep it
- How we protect it
- Your rights
- How to exercise your rights
- Children
- Data breaches
- Direct marketing
- Complaints to the Data Commissioner
- Changes to this policy
- Contact us
In short: we collect only what we need to answer your enquiries and serve our clients, we never sell your data, we keep it secure, and you can ask to see, correct or delete it at any time by emailing info@amkatek.com.
1. Who we are
Amkatek Limited (“Amkatek”, “we”, “us”) is a software development and IT consulting company registered in Kenya. We build ERP systems, mobile apps and payment integrations for businesses and organisations in Kenya and Rwanda.
For the personal data described in this policy, Amkatek is the data controller under the Data Protection Act, 2019 (the “Act”). We are registered with the Office of the Data Protection Commissioner (ODPC) under registration number [ODPC registration number].
Contact details
Amkatek Limited, Equity Plaza Building, 5th Floor, Thika, Kenya
Email: info@amkatek.com
Phone: +254 762 820 447
Data Protection Officer: [name of DPO or responsible person], reachable at info@amkatek.com (subject: “Data protection”).
2. What this policy covers
This policy explains how we handle personal data when you:
- visit amkatek.com;
- contact us through the website form, email, phone, WhatsApp or social media;
- request a demo, quotation or proposal; or
- become a client, or work for a client, supplier or partner of ours.
Systems we build for clients. When we build, host or support a system for a client (for example an ERP, a tenant management or payment system), the client decides how the personal data in that system is used and is the data controller. We act as a data processor on the client’s behalf, only on their documented instructions and under a written agreement. If your data is held in one of our clients’ systems, please contact that organisation first; we will support them in responding to you.
3. Personal data we collect
- Identity and contact data: your name, email address, phone number, organisation and job title.
- Enquiry data: the subject and content of your message, and any details you share about your business needs.
- Client and contract data: billing details, contracts, invoices, payment records and correspondence needed to deliver our services.
- Technical data: your IP address, browser type, device information and the pages you visit, recorded in our server logs for security.
- Consent records: the fact that you agreed to our Privacy Policy when submitting the contact form, and when.
We do not ask for sensitive personal data (such as health, ethnic origin, religious beliefs or biometric data) through this website. Please do not include it in messages to us.
4. How we collect it
- Directly from you, when you fill in our contact form, email, call or message us, or sign a contract with us.
- Automatically, through our web server and the services described in section 6 when you browse the website.
- From your organisation, when your employer or a colleague shares your contact details with us so we can work together. Where we collect your data indirectly, we will let you know within 14 days, as the Data Protection (General) Regulations, 2021 require.
5. Why we use it and our legal basis
We only process personal data for specific purposes, and for each purpose we rely on one lawful basis under section 30 of the Act.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry or demo request | Your consent, given when you submit the contact form, and our legitimate interest in answering people who contact us |
| Preparing quotations, proposals and contracts | Taking steps at your request before entering into a contract |
| Delivering, supporting and invoicing our services | Performance of a contract |
| Keeping accounting and tax records | Compliance with a legal obligation |
| Keeping the website secure and preventing misuse | Our legitimate interest in protecting our systems |
| Sending you news about our products | Your consent, which you can withdraw at any time |
We will not use your data for a new purpose that is incompatible with the original one without telling you and, where required, asking for your consent.
6. Cookies and third-party services
We do not use advertising cookies. We use Google Analytics, through Google Site Kit, to understand how visitors use the website, for example which pages are visited and how many people contact us. Analytics data is aggregated, IP addresses are not stored in full by Google Analytics, and we keep analytics data for up to 14 months. The website also relies on a few services that may receive technical data such as your IP address:
- Google Analytics sets cookies to measure visits and enquiries, such as contact form submissions and clicks on our phone, email and WhatsApp links.
- Google Fonts delivers the typefaces used on the site.
- Google Maps displays our office location on the Contact page and may set its own cookies when the map loads.
- WhatsApp links open WhatsApp, which is operated by Meta under its own privacy policy.
- WordPress may set functional cookies needed for the site to work correctly.
You can block or delete cookies in your browser settings, or opt out of Google Analytics with Google’s browser add-on at tools.google.com/dlpage/gaoptout. The site will continue to work, although the map may not display.
7. Who we share it with
We do not sell personal data. We share it only where necessary, with:
- Service providers who help us run our business, including our web hosting provider, our email provider (Truehost Cloud), Google (Workspace or Gmail, Analytics, Maps and Fonts) and SMS or messaging providers. They process data on our instructions and under contractual confidentiality and security obligations.
- Professional advisers such as auditors, accountants and lawyers, under a duty of confidentiality.
- Authorities such as the Kenya Revenue Authority, the ODPC, courts or law enforcement, where the law requires it.
- A buyer or successor if our business is reorganised, merged or sold, subject to the same protections.
8. Transfers outside Kenya
Some of our service providers store or process data on servers outside Kenya, including [hosting provider and country, e.g. DigitalOcean, Germany] and Google’s global infrastructure. We only transfer personal data outside Kenya in line with sections 48 to 50 of the Act, where:
- the recipient provides appropriate safeguards for the security and protection of the data, such as contractual data protection terms;
- the country or provider offers adequate protection; or
- the transfer is necessary for a contract with you or you have consented to it.
9. How long we keep it
We keep personal data only for as long as we need it for the purposes above, then delete or anonymise it.
| Type of data | How long we keep it |
|---|---|
| Enquiries that do not lead to work | 24 months from our last contact with you |
| Client contracts, invoices and payment records | As long as the contract runs, then the period required by Kenyan tax and company law (generally at least 5 years) |
| Project correspondence | Up to 5 years after the project ends |
| Website analytics (Google Analytics) | Up to 14 months |
| Server and security logs | Up to 90 days, unless needed to investigate an incident |
| Marketing consent records | Until you withdraw consent, plus 12 months as proof of your choice |
10. How we protect it
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including:
- encrypted connections (HTTPS) across the website;
- access to personal data limited to staff who need it, protected by strong passwords;
- regular software updates, backups and security monitoring; and
- confidentiality obligations for our staff and service providers.
No system is completely secure. If you believe your data has been compromised, please contact us immediately.
11. Your rights
Under section 26 of the Act and the Data Protection (General) Regulations, 2021, you have the right to:
- be informed of how your personal data is used, which is what this policy does;
- access the personal data we hold about you;
- object to the processing of all or part of your personal data;
- correct false or misleading data;
- delete false, misleading or unlawfully held data;
- restrict processing in certain circumstances;
- data portability, to receive your data in a structured, commonly used format; and
- withdraw consent at any time, without affecting processing that happened before.
We respond to requests free of charge within the timelines set by the Regulations:
| Request | We respond within |
|---|---|
| Access to your data | 7 days |
| Correction | 14 days |
| Deletion | 14 days |
| Objection or restriction | 14 days |
| Data portability | 30 days |
12. How to exercise your rights
Email info@amkatek.com with the subject “Data protection request”, or write to us at the address in section 1. Tell us which right you want to exercise and include enough detail for us to find your data. We may ask you to confirm your identity before acting on a request, to protect your data from anyone else. If we cannot meet a request, we will explain why in writing.
13. Children
Our website and services are intended for businesses and organisations and are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.
14. Data breaches
If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Data Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires, and we will inform you without undue delay with the steps you can take to protect yourself.
15. Direct marketing
We will only send you marketing messages if you have agreed to receive them, or if you are an existing client and the messages relate to similar services. Every message will include a simple way to opt out, and you can also opt out at any time by emailing info@amkatek.com.
16. Complaints to the Data Commissioner
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner:
Office of the Data Protection Commissioner
P.O. Box 30920 – 00100, Nairobi, Kenya
Website: www.odpc.go.ke
Email: info@odpc.go.ke
Phone: 020 780 1800
17. Changes to this policy
We review this policy regularly and will update it when our practices or the law change. The date at the top of the page shows when it was last updated. Where changes are significant, we will highlight them on this page.
18. Contact us
Questions about this policy or your personal data? Email info@amkatek.com, call +254 762 820 447, or visit us at Equity Plaza Building, 5th Floor, Thika.
Amkatek builds ERP systems, mobile apps and payment integrations that help businesses in Kenya and Rwanda run with less paperwork and more control.
Systems
Integrations
Contact
+254 762 820 447
info@amkatek.com
Thika: Equity Plaza Building, 5th Floor
Nairobi: Suite 37B, Kahyawe Road, off Galana Road, Kilimani
© 2026 Amkatek Limited. All rights reserved.