Draft, under review. This page is being reviewed by Digirecords and its legal adviser and may change. Last updated 21 October 2026.
1. Who we are
This website is run by DigiRekodi EDMS Solutions Limited, trading as Digirecords (“we”, “us”), Kijabe Street, Norfolk Towers, P.O. Box 295-00600, Nairobi, Kenya. We decide why and how the personal data described here is processed, so we are its data controller under the Data Protection Act, 2019. Our application for registration with the Office of the Data Protection Commissioner (ODPC) is under review.
Questions and requests about your personal data: info@digirecords.co.ke or +254 792 153 240.
2. What we collect through the contact form
- Your name and email address (required).
- Your phone or WhatsApp number, organisation, sector and the service you are interested in (optional).
- Your message, and your confirmation that we may contact you about it and store the details for that purpose.
To stop abuse of the form and of staff sign-in, we keep a one-way hash (a scrambled code that cannot practically be turned back) of your IP address and email address for about one day, to count attempts. Our hosting provider also processes technical data such as IP addresses to deliver the site and protect it.
We do not use the form to collect sensitive personal data. Please do not include it in your message.
3. Why we use it, and on what basis
- To answer your enquiry and, if you ask, prepare a proposal. Basis: your consent, given on the form, and steps you ask us to take before entering into a contract.
- To notify our office and confirm receipt to you by email. Same basis.
- To protect the website from spam and abuse (the short-lived hashes above). Basis: our legitimate interest in keeping the service available and secure.
- To measure visits with Google Analytics, only if you allow it. Basis: your consent, which you can withdraw at any time.
We do not sell your personal data, and we do not use it for advertising.
4. How long we keep it
- Enquiries that do not lead to an engagement: 24 months from the date we receive them. We then erase the enquiry and our notes on it, and replace your name, email, phone, organisation and message in our internal change log with the word “[erased]”. We keep a record that an erasure took place, with its date and reason, but not your details.
- Enquiries that lead to an engagement: the contact details become part of our client records and are kept for as long as the engagement and the record-keeping periods set by law (for example for tax records) require.
- Abuse-prevention hashes: about one day.
- Encrypted backups: daily copies for 30 days and one copy per month for 12 months. Data erased from our live systems stays in these encrypted backups until they expire. We use backups only to test that they work and to recover from a failure, and if we ever restore one, we erase again anything that was erased after it was made.
- Google Analytics data: for the retention period set in our Google Analytics account, no longer than 14 months.
5. Who processes it for us, and where
We use the service providers below. Each processes personal data on our instructions under its data processing terms. Our database is in the European Union (Ireland), not in Kenya. Where data is processed outside Kenya, we rely on the safeguards in our contracts with these providers, as the Data Protection Act, 2019 requires.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Database for enquiries and staff accounts (sign-in for our staff only). | European Union: Ireland (AWS eu-west-1). |
| Vercel | Hosting and delivery of this website, including processing the contact form. | May process data outside Kenya, including in the United States, under contractual safeguards. |
| Resend | Sending the email notification of your enquiry to our office and the acknowledgement to you. | May process data outside Kenya, including in the United States, under contractual safeguards. |
| HostPinnacle | Hosting our email, including the mailbox that receives enquiry notifications and your replies. | European Union: Germany. |
| Cloudinary | Storing and delivering the images in our published articles. No personal data from the contact form is sent to it. | May process data outside Kenya under contractual safeguards. |
| Google (Google Analytics) | Measuring visits to the website, only if you choose “Allow analytics”. | May process data outside Kenya, including in the United States, under contractual safeguards. |
| GitHub | Runs our nightly backup job, which copies the database and encrypts the copy before it is stored. | May process data outside Kenya, including in the United States, under contractual safeguards. |
| Backblaze | Storing our encrypted nightly backups. The backups are encrypted before they reach it, so it cannot read them. | European Union: the Netherlands. |
Only our administrators can see enquiries, and they sign in with two-factor authentication. Connections to the site are encrypted, and changes to records are logged.
6. Cookies
Necessary: one cookie, dr_consent, remembers your cookie choice for 12 months. Staff who sign in to our administration area also get sign-in cookies; visitors to the public site do not.
Analytics (only if you choose “Allow analytics”): Google Analytics sets _ga and _ga_* cookies, which last up to two years. Until you agree, the Google Analytics script is not loaded at all. Advertising features are switched off.
You can change your choice at any time with “Cookie settings” at the bottom of every page. If you withdraw consent, we stop Google Analytics and delete its cookies from your browser.
7. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed of how your personal data is used (this policy);
- access the personal data we hold about you;
- object to processing, and withdraw consent at any time (this does not affect processing already done);
- have false or misleading data corrected, and have personal data deleted;
- receive your data in a portable format, where the law provides for it.
To use any of these rights, email info@digirecords.co.ke. We may ask you to confirm your identity before acting on a request, and we will respond within the time the law allows. If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).
8. Recruitment
When you apply for a vacancy, by email or through the apply link on the vacancy page, we use your application and CV only for that recruitment. If you are not successful, we keep your application no longer than 6 months, then delete it. A CV you send us when no vacancy is open, for future associate roles, is kept no longer than 6 months and then deleted. You can ask us to delete it sooner at any time.
Digirecords never charges any fee at any stage of recruitment.
9. Children
This website is meant for organisations. It is not directed at children, and we do not knowingly collect their data.
10. Changes to this policy
We will update this page when our practices change and show the date of the latest version at the top. See also our terms of use.