Privacy Policy

1. Who we are

Code And Circuit Technologies LTD ("we", "us") is a technology company based in Kisumu, Kenya. We are the data controller for personal data collected through codencircuit.co.ke. This policy explains what we collect, why, who helps us process it, how long we keep it, and your rights under the Kenya Data Protection Act, 2019.

We don't offer user accounts, and we don't take payments on this website.

2. What we collect and why

2.1 Contact form and job applications

When you send a message (including an application through "Apply Now" on our careers page) we receive your name, email address, subject, message and the type of enquiry. We use it to reply to you and, for applications, to consider you for the role. Your message is emailed to our team inbox; it is not stored in a database on our website.

2.2 Workshop and event registration

When you register for a workshop or event we receive your name, email address, phone number, city, the organisation you represent and your role there, how many participants you are registering, any notes you add, and which workshop or event it is for. We use it to plan the session, contact you about it and send you a confirmation email. We store your registration in our database (hosted by Cloudflare) so we can keep track of places and show how many are left; the count shown on the site never includes names or contact details. Our team also receives it by email.

Registrations for school students are made by a teacher, parent or organiser. We ask for the organiser's details and the number of participants, not students' personal details.

2.3 Newsletter

When you subscribe we receive your email address and where on the site you signed up. We send a confirmation email first; if you don't confirm within 48 hours, the request is deleted. Once you confirm, we store your email address, sign-up location and confirmation date in our subscriber list and send you occasional emails about new articles, workshops and events. Every email has an unsubscribe link.

2.4 Security checks

Our forms use Cloudflare Turnstile to tell people from automated spam, and we use your IP address to limit how many messages can be sent in a short time. The rate-limit record is deleted automatically after one hour.

2.5 Analytics

Cloudflare Web Analytics counts visits for everyone without using cookies or identifying you. Google Analytics runs only if you accept analytics cookies; it then records the pages you view and actions such as sending a form or tapping our phone number, without your name, email or phone number. You can change your choice at any time from "Cookie Settings" in the footer. See our Cookie Policy for details.

2.6 Editing desk

Our team edits the site through the desk at /admin. When someone opens that desk we record the time, the page, their IP address, the name of their network, the approximate town and country, the browser and device, the language, and any change they save, such as publishing a post. We use this to see who used the desk and what was changed. We do not record the text of the edit, and we do not use these records on the public pages. They are deleted after 90 days.

2.7 Technical data

Like any website, our hosting provider processes your IP address, browser details and the pages you request in order to deliver the site and protect it from attacks.

3. Lawful basis

• Consent: the newsletter and Google Analytics. You can withdraw it at any time.
• Steps you ask us to take: replying to enquiries, handling job applications and workshop or event registrations.
• Legitimate interests: keeping the website secure, preventing spam, counting visits without cookies, and seeing who used the editing desk.

4. Who processes your data for us

We don't sell your data. We share it only with the providers that run the website for us:

• Cloudflare: hosting, the services behind our forms, our subscriber list and registrations, spam protection (Turnstile), cookieless analytics and email routing.
• Resend: delivers emails from our forms and our newsletter.
• Google: Google Analytics, only if you accept analytics cookies.
• Unsplash: some older articles load images from Unsplash, which receives your IP address when the image loads.

We may also disclose information where the law requires it, for example to comply with a court order.

5. International transfers

These providers may process data outside Kenya, including in the United States and the European Union. We use them under their standard data processing terms, which include safeguards for international transfers, as section 48 of the Data Protection Act requires.

6. How long we keep it

• Contact enquiries: up to 2 years after our last exchange with you.
• Job applications: up to 12 months after the role is filled, unless you ask us to keep them longer.
• Workshop and event registrations: deleted automatically 2 years after the workshop or event date, or sooner if you ask us.
• Newsletter: until you unsubscribe. We then keep only your email address, marked as unsubscribed, so we don't email you again. Ask us if you want it deleted completely.
• Unconfirmed newsletter sign-ups: 48 hours. Rate-limit records: 1 hour.
• Editing desk access records: 90 days.
• Google Analytics data: as set in our Google Analytics account (no longer than 14 months).

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used, which is what this policy does;
• access the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data, or object to how we use it;
• withdraw consent at any time, for example by unsubscribing or changing your cookie settings;
• receive your data in a portable format.

To use any of these rights, email privacy@codencircuit.co.ke. We will respond within the time the law allows. If you are unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).

8. Security

Data is sent to us over encrypted connections (HTTPS). Our subscriber list and registrations sit in our Cloudflare account, which only our team can access, and form submissions are delivered to our team inbox. No system is perfectly secure; if a breach puts your data at risk, we will notify the Data Commissioner and, where required, you.

9. Other websites

Our site links to other websites, such as GitHub, LinkedIn and X. Their own privacy policies apply when you visit them.

10. Changes to this policy

We will update this page when what we collect or how we use it changes, and change the "Last updated" date above.

11. Contact