Privacy policy
Last updated 11 October 2026
This policy explains how Hauzisha Platforms LTD, trading as Hauzisha Systems (“we”, “us”), collects, uses, shares and protects personal data when you visit hauzishasystems.com, ask us for a quote, or work with us. We handle personal data in line with Kenya's Data Protection Act, 2019 and the regulations made under it.
1. Who we are
Hauzisha Systems is a brand of Hauzisha Platforms LTD, a company in Kenya. For personal data collected through this website and in our own dealings with you, Hauzisha Platforms LTD is the data controller: we decide why and how that data is used.
2. What this policy covers
This policy covers:
- visitors to hauzishasystems.com;
- people and businesses who ask us for a quote, through the website or otherwise;
- our clients, and the people we deal with at our clients.
It does not cover the personal data of your customers inside systems we build and run for you. That is explained in section 6 and in your agreement with us.
3. What we collect
When you ask for a quote
- Your name, business name, phone or WhatsApp number and email address.
- Your town or county, the type and size of your business, and your current website if you give it.
- The systems you're interested in, what you want them to do, what you use today and when you'd like to start.
- How you'd like us to contact you.
About how you found us
- The page you first landed on and the page you asked from.
- The website that linked you here, if any.
- Campaign tags in the web address, such as utm_source, utm_medium and utm_campaign, and advert click identifiers (gclid, fbclid), for your first visit and your latest one.
When you browse the website
- Pages viewed, the page you arrived on and the site or campaign that sent you.
- Approximate location (country and region), device type and browser, read from the connection.
- Your IP address and browser details, used only to tell two visits apart for one day (see section 12). They are not stored in a form that identifies you.
When we work together
- Emails, messages, call notes and the documents we exchange.
- Details needed to deliver the work: logins you give us for your domain, hosting or accounts, and your branding and content.
- Billing details such as invoices and payment records.
We don't ask for sensitive personal data, as the Act defines it, and we ask you not to send it to us.
4. How we collect it
- From you, when you fill in the quote form, message, call or email us.
- From your browser, when you visit the website (see section 12).
- From public sources, such as your business website or Google Business Profile, when we prepare your quote.
5. Why we use it, and on what lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to your quote request, ask follow-up questions and send your quote | Steps you asked us to take before a contract |
| Deliver, support and invoice the systems you buy | Performance of our contract with you |
| Understand which pages and adverts bring enquiries, and improve the website | Our legitimate interests |
| Keep the website secure and stop abuse and spam | Our legitimate interests |
| Keep accounting and tax records | Legal obligation |
| Send you news or offers | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have weighed them against your rights: the data is limited, it isn't sensitive, it isn't sold, and it isn't used to make decisions about you. You can object at any time (see section 13).
6. Data in the systems we build for clients
The systems we build for clients (websites, CRM, call management, bulk SMS, email, reviews and POS) often hold personal data about the client's own customers. For that data:
- The client is the data controller, and is responsible for having a lawful basis to collect and use it, including consent for marketing messages.
- We act as a data processor: we process it only on the client's documented instructions, to deliver and support the system.
- Our people are bound by confidentiality, and we apply appropriate security to that data.
- We help clients answer requests from their customers to see, correct or delete their data.
- When the engagement ends, we return or delete the client's data as the agreement says.
If you are a customer of one of our clients, please contact that business first about your data.
7. Marketing messages
We only send marketing messages if you agreed to receive them. Every marketing email includes a way to unsubscribe, and every marketing SMS a way to opt out. Replying to your quote request, or messages about work you asked us to do, are not marketing.
8. Who we share it with
We don't sell or rent personal data. We share it only with service providers that help us run our business, and only what each needs:
- Website hosting and security: Cloudflare, which serves this website and protects it from abuse.
- Customer records: our database provider, where quote requests and client records are stored.
- Email: our email service, which sends us an alert when a quote request arrives and carries our replies.
- Messaging and calls: phone, SMS and WhatsApp providers, when we contact you the way you asked.
- Professional advisers: accountants, auditors and lawyers, where needed.
- Authorities: where the law requires it. If we are compelled to share your data, we'll tell you unless the law forbids it.
Our service providers may use personal data only to provide their service to us, under agreements that require them to protect it.
9. Transfers outside Kenya
Some of our service providers store or process data outside Kenya, including in the European Union and the United States. When personal data leaves Kenya, we do so only as the Data Protection Act allows, with appropriate safeguards for its security and protection, such as contractual commitments from the provider.
10. How long we keep it
| Data | How long |
|---|---|
| Quote requests that don't become work | Up to 24 months after we last spoke |
| Client records and correspondence | For the engagement, then up to 24 months after it ends |
| Invoices and payment records | As long as Kenyan tax and company law requires |
| Website visit records | Up to 12 months |
| How-you-found-us note in your browser | Until you clear your browser storage |
After these periods we delete the data or make it anonymous. You can ask us to delete it sooner (see section 13).
11. How we protect it
- The website and its forms are served only over HTTPS.
- Access to quote requests and client records needs a login, and is limited to the people who need it.
- Database access is restricted, and data is backed up.
- Logins you share with us for your accounts are kept only as long as the work needs them.
No system is perfectly secure. If a breach puts your personal data at risk, we will notify the Data Protection Commissioner and, where the risk is high, you, as the Act requires.
12. Cookies and your browser
This website sets no advertising or tracking cookies. Two things happen in your browser:
- A note of how you arrived. When you arrive with campaign tags or from another website, your browser keeps a small note of it in its local storage, for your first visit and your latest. It is sent to us only inside a quote request you choose to send. Clearing your browser storage removes it.
- A visit counter. Each page reports the page viewed and how you arrived to our own visit counter. It sets no cookie and stores nothing on your device. To tell two visits apart for one day, our server turns your IP address and browser details into a code that can't be turned back and changes at midnight.
Cloudflare may set strictly necessary security cookies to protect the site from automated abuse.
13. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used, as this policy does;
- access the personal data we hold about you;
- object to the processing of all or part of your personal data;
- have false or misleading data corrected;
- have false, misleading or unlawfully processed data deleted;
- receive your data in a portable format and have it sent to another controller, where this applies;
- withdraw consent you gave, without affecting what was done before.
To use any of these rights, send a request through our contact form, starting your message with “Data request”, and tell us how to reach you. We may need to confirm your identity. We will answer within the time the law sets, and asking costs nothing.
14. Children
Our services are for businesses, and this website is not meant for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has sent us their data, tell us and we will delete it.
15. Automated decisions
We don't make decisions about you based solely on automated processing, and we don't profile you.
16. Complaints
If you're unhappy with how we handle your data, please tell us first and we'll try to put it right. You can also complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.
17. Changes to this policy
We will update this policy when what we do changes, and change the date at the top. If a change materially affects data you have already given us, we will tell you before it takes effect.
18. Contacting us
Hauzisha Platforms LTD, trading as Hauzisha Systems, Kenya. Questions and requests about your data: through our contact form.