In short
We collect only what we need to reply to you and deliver our services. We don't sell your personal data. Optional cookies stay off unless you turn them on. You can ask us to access, correct or delete your data at any time by email.
Who we are
Rotech Digital Solutions ("Rotech", "we", "us") is a digital services business based in Kenya. We provide website development, web application development, Android app development, Google Ads and Meta Ads management, and related digital strategy services.
For personal data collected through this website and our direct dealings with you, we are the data controller under the Data Protection Act, 2019 (the "Act"). Contact us about privacy by email or on WhatsApp.
This policy applies to rotechdigitalsolutions.com and to enquiries, communications and services connected with it.
The data we collect
Information you give us
- Enquiry details: your name, email address, the service you're interested in, an optional budget range, and the project details you write in our contact form or messages.
- Communications: messages, phone numbers and attachments you send us by WhatsApp, email or phone.
- Client information: if you become a client, your business details, billing and payment records, project requirements, content and materials you provide, and any account access you grant us so we can deliver the work.
Information collected automatically
- Technical data: like most websites, our hosting provider may automatically record server logs such as IP address, browser type, device information, pages requested and the date and time of each visit. These are used for security and to keep the site running.
- Cookies and similar storage: we store your cookie choices in your browser. Optional analytics or marketing cookies are only used if you consent. See our Cookie Policy.
Information from third parties
When we manage advertising or other services for you, we may receive performance data from platforms such as Google Ads or Meta Ads Manager through the accounts you give us access to.
We do not intentionally collect sensitive personal data as defined in the Act (such as health, biometric or ethnic data). Please don't send it to us unless it's essential to your project and we've agreed how it will be handled.
How and why we use your data
We only process personal data where we have a lawful basis under section 30 of the Act:
| Purpose | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quotation | Your consent, and steps taken at your request before entering into a contract |
| Deliver, support and invoice the services you've engaged us for | Performance of a contract |
| Keep business, tax and accounting records | Compliance with a legal obligation |
| Keep our website and systems secure and working properly | Our legitimate interests |
| Understand site usage and measure advertising (only if enabled) | Your consent, given through our cookie settings |
| Send you updates about our services | Your consent, which you can withdraw at any time |
| Establish, exercise or defend legal claims | Our legitimate interests and legal obligations |
We will not use your data for direct marketing without your consent, and every marketing message will give you a simple way to opt out. We do not make decisions about you based solely on automated processing.
Our contact form, email and WhatsApp
When you submit our contact form, your name, email address, chosen service, optional budget and message are sent to our email inbox through our form provider, Web3Forms, which processes them only to deliver your enquiry to us and to filter spam. We use those details solely to respond to you. Submitting the form is optional — you can always email or WhatsApp us instead.
Messages sent through WhatsApp are also processed by WhatsApp LLC / Meta Platforms under their own terms and privacy policy. If you'd rather not use WhatsApp, you can email us instead.
International transfers
Some of our service providers (for example Cloudflare, Web3Forms, Google and Meta) store or process data outside Kenya. When personal data is transferred outside Kenya, we take the steps required by Part VI of the Act — relying on providers that offer appropriate safeguards for the security and protection of personal data, or on your consent where required.
How long we keep your data
- Enquiries that don't lead to a project: up to 12 months after our last contact, then deleted.
- Client and project records: for the length of our engagement, then as long as needed for support, warranty and legal claims.
- Financial and tax records: for as long as Kenyan tax and accounting laws require (generally at least five years).
- Cookie choices: up to 12 months, after which we ask again.
When data is no longer needed, we delete it securely or anonymise it.
How we protect your data
We use reasonable technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including HTTPS encryption, access controls, strong authentication on our accounts, and limiting access to people who need it.
No system is completely secure. If a data breach is likely to put your rights and freedoms at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell you where required by the Act. To report a security concern, see our security contact.
Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be informed about how your personal data is used.
- Access the personal data we hold about you.
- Object to the processing of all or part of your personal data.
- Correct personal data that is false, inaccurate or misleading.
- Delete personal data that is false, misleading, no longer needed, or unlawfully processed.
- Restrict processing in certain circumstances.
- Data portability: receive your data in a structured, commonly used, machine-readable format.
- Withdraw consent at any time, without affecting processing that happened before you withdrew it.
To exercise any of these rights, email us. We may need to verify your identity, and we will respond within the time required by law.
If you're unhappy with how we've handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
Data we process for clients
When we build or manage a website, app or ad campaign for a client, we may handle personal data about that client's own customers or users (for example, form submissions or app user accounts). In that case the client is the data controller and we act as a data processor. We process that data only on the client's documented instructions and as agreed in our contract.
Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the "last updated" date at the top. If we make significant changes, we'll make this clear on the website.