The short version
- We collect what you give us (forms, comments, chat) and a little technical information needed to run and protect the site.
- We use it to answer you, deliver our services, keep the site secure and, only if you allow cookies, to measure visits and ads.
- We never sell your personal data. We share it only with the service providers listed below that help us run the site.
- You can ask to see, correct or delete your data, or object to how we use it, at any time by e-mailing info@kikaosystems.co.ke.
1. Who we are
Kikao Systems Group Limited ("Kikao Systems", "we", "us") is a software and IT services company in Kenya. We decide how and why the personal data described here is used, which makes us the data controller under Kenya's Data Protection Act, 2019 ("the DPA") and, for visitors in the European Union or United Kingdom, under the GDPR. We register with the Office of the Data Protection Commissioner (ODPC) as the DPA requires.
Questions or requests about your data go to info@kikaosystems.co.ke (subject "Privacy request").
2. Who this covers
- Visitors to kikaosystems.co.ke, including anyone who reads the blog, comments, chats with Kao or sends a form.
- Prospective and current clients who contact us or request a project.
- Dashboard users: our staff and invited team members who sign in to the Kikao dashboard.
When we build or host systems for a client, the client usually controls the data in that system and we process it on their instructions under a separate agreement. This policy does not cover that data.
3. What we collect and why
For each purpose the law requires a "lawful basis". Ours are: your consent; steps you ask for before or under a contract; our legitimate interests (running, improving and protecting our business, balanced against your rights); and legal obligations.
3.1 Website visitors and clients
| What | Data | Why | Lawful basis |
|---|---|---|---|
| Contact form | Name, e-mail, subject, message | To reply to you and send a confirmation e-mail | Steps you asked for / legitimate interests |
| Get Started (project request) | Company, contact name, e-mail, phone, project description, services, budget | To understand your project, call you and prepare a quote | Steps before a contract |
| Blog comments and replies | The name you type and your comment | To show your comment under the article | Consent (you choose to post) |
| Likes and view counts | A random device ID in a cookie (no name or e-mail); view counts per article | To remember what you liked and count readers | Legitimate interests |
| Kao chat | Your messages; your name, e-mail and phone only if you choose to share them | To answer questions and, if you ask, pass your request to our team | Consent / steps before a contract |
| Bot protection | IP address, browser and device signals (processed by Cloudflare Turnstile); a hidden form field and timing check | To stop spam and automated abuse | Legitimate interests |
| Rate limits and security | IP address, kept briefly | To block floods of requests and attacks | Legitimate interests |
| Analytics and advertising | Pages viewed, approximate location, device and browser, how you arrived, ad clicks (Google Analytics and Google Ads) | To see which pages and ads work | Consent (cookie choice) |
| Campaign links | Which campaign link brought you (UTM tags), click counts on our short links | To know which posts and campaigns bring enquiries | Legitimate interests |
| E-mails we send you | Your e-mail address and our correspondence | Confirmations and replies you asked for | Steps you asked for / legitimate interests |
3.2 Dashboard users (staff and invited team members)
| What | Data | Why | Lawful basis |
|---|---|---|---|
| Account | Name, work e-mail, phone, job title, optional photo, role and module permissions, who invited you and when | To create and manage your access | Contract (employment or engagement) / legitimate interests |
| Sign-in methods | Password (stored only as a one-way hash), authenticator-app key (encrypted), passkey public keys, backup codes (hashed), Google account ID if you link Google | To sign you in securely | Contract / legitimate interests (security) |
| Sign-in activity | Date and time, IP address, approximate location (city and country), device and browser, method used, success or failure | Login alerts, spotting suspicious sign-ins, locking accounts under attack | Legitimate interests (security) |
| Sessions and trusted devices | Signed-in devices, last activity, trusted-device cookie | To let you see and sign out devices, and skip the second step on trusted devices | Legitimate interests |
| Audit log | Actions taken in the dashboard (for example invites, permission changes, deletions), with time and IP | Accountability and investigating problems | Legitimate interests / legal obligations |
| Marketing workspace | Posts, captions, media, comments, assignments, connected social accounts (access tokens stored encrypted), post statistics | To plan and publish our own marketing | Legitimate interests |
| Help assistant | Questions you ask the dashboard Kao assistant | To answer and to improve our help articles | Legitimate interests |
Dashboard users are told about monitoring in our dashboard terms. We do not use sign-in data to monitor productivity.
4. Cookies and similar storage
Essential storage is always on because the site cannot work securely without it. Analytics and advertising cookies are off until you choose "Accept" in the cookie banner. You can change your choice at any time with Cookie settings (also in the footer).
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| PHPSESSID | Essential | Keeps forms secure (anti-forgery token) and keeps dashboard users signed in | Until you close the browser / sign out |
| kikao_device | Essential | Random ID that remembers which articles and comments you liked | 6 months |
| kikao_td | Essential (dashboard only) | Remembers a device you chose to trust, so it skips the second sign-in step | 30 days |
| kikao-theme, kikao-consent (local storage) | Essential | Remember light/dark mode and your cookie choice | Until you clear them |
| Cloudflare Turnstile | Essential | Tells people from bots on our forms; may set its own short-lived storage | Short-lived |
| _ga, _ga_* | Analytics (consent) | Google Analytics: counts visits and how the site is used | Up to 2 years |
| _gcl_*, Google Ads cookies | Advertising (consent) | Measures whether our ads led to a visit or a project request | Up to 90 days |
Without consent, Google receives only cookieless, anonymous signals (Google Consent Mode) and nothing is stored on your device for analytics or ads.
5. Kao, our chat assistant
Kao answers common questions instantly from our own information. For other questions it sends the text of your message (not your name, e-mail or phone) to an AI provider to draft a reply, currently Google Gemini, with Groq as a backup. Please don't type sensitive personal information into the chat. On free plans these providers may use the text they receive to improve their services.
Kao only answers questions and suggests links; it does not make decisions about you with legal or similarly significant effects. You can ask for a person at any time, for example through WhatsApp. Chat logs are kept for 30 days; if you ask us to contact you, your details become a project request.
6. Who we share it with
We never sell personal data or share it for others' marketing. We use these providers ("processors") to run the site, each only for the purpose shown:
| Provider | What they do for us | Where |
|---|---|---|
| Truehost Cloud | Website hosting, database and our e-mail | Servers in France (EU) |
| ButterCMS | Stores and serves our blog articles (no visitor data) | United States |
| Google (Analytics, Ads, Sign-in, Gemini) | Visit and ad measurement with your consent; "Continue with Google" for dashboard users; AI replies for Kao | Global, including the United States |
| Cloudflare (Turnstile) | Bot protection on forms | Global |
| Groq | Backup AI replies for Kao | United States |
| ipwho.is | Turns a sign-in IP address into an approximate city and country for login alerts (dashboard users only) | Global |
| Have I Been Pwned | Checks whether a new dashboard password has appeared in known breaches. Only the first 5 characters of a one-way hash are sent; the password never leaves our server | Global |
| Meta (Facebook, Instagram, WhatsApp), LinkedIn, TikTok, X | Publishing our own posts and reading their statistics; WhatsApp conversations you start with us. Their own privacy policies apply on their platforms | Global |
We may also disclose data where the law requires it (for example to a court or regulator), to protect our rights or the safety of others, or to a buyer if our business is sold (they must keep this policy's protections).
7. Transfers outside Kenya
Some providers above store or process data outside Kenya. We only use providers that give appropriate safeguards for personal data, such as standard contractual data-protection terms, and we transfer only what each one needs, as sections 48 to 50 of the DPA require. You can ask us for details of the safeguards for any provider.
8. How long we keep it
| Data | How long |
|---|---|
| Contact messages and project requests | Up to 24 months after our last contact, or longer if they become a client contract (then as our records and tax laws require, usually 7 years) |
| Blog comments | While the article is published, or until you ask us to remove them |
| Likes (device ID) | 6 months from your last like |
| Kao chat logs | 30 days |
| Rate-limit and anti-spam records | Up to 24 hours |
| Analytics | 14 months in Google Analytics |
| Dashboard accounts | While the account is active; removed within 90 days after it is deleted |
| Sign-in events and audit log | 12 months |
| Marketing short-link click counts | 24 months (counts only) |
9. How we protect it
- Encrypted connections (HTTPS) everywhere; the dashboard and our configuration live outside the public website.
- Dashboard accounts are invite-only and require a second sign-in step; passwords are hashed, authenticator keys are encrypted, and every sign-in triggers an alert e-mail.
- Access inside the dashboard is limited per person to the modules they need, and actions are recorded in an audit log.
- Forms are protected against forgery, spam and abuse.
No system is perfectly secure, but we work to protect your data and fix weaknesses promptly.
10. Your rights
Under the DPA (and the GDPR where it applies) you have the right to:
- Be informed how your data is used (this policy).
- Access a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Delete data we no longer need or that was processed unlawfully.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Restrict processing while a concern is looked into.
- Data portability: receive data you gave us in a common, machine-readable format.
- Withdraw consent at any time (for example with Cookie settings), without affecting what happened before.
- Not be subject to decisions based solely on automated processing that significantly affect you. We make none.
E-mail info@kikaosystems.co.ke. We may ask you to confirm your identity. We reply within the time limits set by Kenya's Data Protection (General) Regulations, 2021 (for example, within 7 days for a copy of your data), and free of charge unless a request is clearly excessive.
Deleting your data. To have your data deleted, including any data connected to our Facebook, Instagram, WhatsApp, LinkedIn, TikTok or X accounts, e-mail us with the subject "Delete my data" and tell us the e-mail address or phone number you used. We confirm when it is done.
If you are unhappy with our answer, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke), or to your local data-protection authority if you live in the EU or UK.
11. Children
Our site and services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us data, contact us and we will delete it.
12. Data breaches
If a breach puts your personal data at real risk, we notify the Data Protection Commissioner within 72 hours of becoming aware of it and tell affected people as soon as practical, with what happened and what to do, as section 43 of the DPA requires.
13. Changes to this policy
We update this policy when our services or the law change. The version and effective date are at the top. For important changes we show a notice on the site and, for dashboard users, by e-mail.
What changed in version 2.0: rewritten to cover the dashboard's secure sign-in, the Kao chat assistant, the marketing workspace, bot protection, cookie consent, retention periods and your rights in full.