Privacy Policy

1. Who we are

DeedCode is a web development business based in Nairobi, Kenya. For the personal data described in this policy, DeedCode is the “data controller”. You can reach us at [email protected], on +254 703 545 010, or through our data request page.

2. What we collect

We only collect what you choose to give us:

• Enquiry and audit forms: your name, organisation name, WhatsApp number or email, the type of organisation, and (where the form asks) your website address, congregation size, focus area, chosen package or message.
• Messages you send us on WhatsApp, email or phone.

We do not collect card numbers, M-Pesa PINs or passwords through this website. Please do not send us sensitive personal data (such as health or religious beliefs about individuals) in forms or messages. We do not need it.

3. Why we use it, and our lawful basis

• To reply to your request, prepare your free digital audit and send a fixed-price plan. Basis: your consent when you submit the form, and steps you ask us to take before a contract.
• To run a project once you become a client. Basis: performing our contract with you.
• To keep business and tax records. Basis: legal obligation.

We do not send marketing emails or newsletters. If we ever offer that, we will ask for your separate permission first, and every message will have an unsubscribe link.

4. Who we share it with

We never sell your personal data. We use a small number of service providers (“processors”) who handle data only on our instructions:

• FormSubmit (formsubmit.co): carries what you type into our forms to our email inbox. If it is unavailable, you can send the same details to us by WhatsApp or email instead.
• Our email provider: stores the emails we send and receive.
• WhatsApp (Meta): if you message us or tap a WhatsApp button, that conversation is handled under WhatsApp’s own terms and privacy policy.
• Our website hosting provider: serves this website and may keep standard server logs (such as IP address and time of visit) for security.

We may also disclose data where the law requires it, for example to a court or regulator.

5. Cookies and tracking

This website does not use advertising cookies, analytics or tracking pixels, and it does not load fonts or scripts from third-party tracking services. Our fonts are hosted on our own site. Your browser may keep a saved copy of our pages, images and fonts so the site loads faster, and our hosting provider may set a strictly necessary technical or security cookie. If we ever add analytics or any non-essential cookie, we will ask for your permission first and update this policy.

6. How long we keep your data

• Enquiries that do not become a project: we delete them after 12 months, or sooner if you ask.
• Clients: for the length of our agreement, then only as long as the law requires us to keep business and tax records.

7. Data stored outside Kenya

Some of our providers (for example FormSubmit, WhatsApp and email services) run servers outside Kenya. When your data is transferred, we rely on providers that apply appropriate safeguards, and we only transfer what is necessary.

8. Your rights

Under the Kenya Data Protection Act, 2019 you can ask us to: see the personal data we hold about you; correct it; delete it; stop or restrict how we use it; object to its use; or give you a copy you can take elsewhere. You can also withdraw your consent at any time.

Use our data request page or email [email protected]. We may ask you to confirm who you are before we act. We respond within the timelines in the Data Protection (General) Regulations, 2021: within 7 days for access requests and within 14 days for correction, deletion and objection requests.

If you are unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. We would appreciate the chance to put things right first.

9. Security

This website uses HTTPS. We limit who can see enquiries, and we keep account access protected. No system is perfectly secure, so if we ever suffer a breach that puts your rights at risk, we will tell you and the ODPC as the law requires.

10. Children

Our services are for organisations and the adults who run them. We do not knowingly collect personal data from anyone under 18 through this website. If you believe a child has sent us their details, contact us and we will delete them.

11. Websites we build for clients

When we build a site for your church or NGO that collects visitor or donor details, your organisation decides why that data is collected, so your organisation is the data controller and DeedCode is a processor acting on your instructions. Churches and non-profits in Kenya generally must register with the ODPC themselves. We build forms that collect only what is needed and show a privacy notice, and we can explain what to include. Data handling terms are set out in your written agreement.

12. Changes to this policy

If we change this policy we will update the date at the top of this page. For significant changes that affect clients, we will tell you directly.