Privacy Policy

Last updated: 31 October 2026

This policy explains how Elvinsoft Technologies Limited (“Elvinsoft”, “we”, “us”) handles personal data when you visit elvinsoft.co.ke, contact us, or use our services. We process personal data in line with Kenya’s Data Protection Act, 2019 and its regulations.

1. Who we are

Elvinsoft Technologies Limited, Migori, Kenya, is the data controller for the personal data described here. You can reach us at info@elvinsoft.co.ke.

2. What we collect

• Enquiries: your name, phone number, email address, the service you are interested in and your message, when you use our contact form, WhatsApp, phone or email.
• Client accounts and orders: if you order through our website, we keep your account details (name, email, phone), project details, files you upload, messages with our team and payment records.
• Payments: M-Pesa transaction details such as the phone number, amount and transaction code. We do not store card or M-Pesa PINs.
• Technical data: basic server logs (IP address, browser type, pages requested and time) kept by our hosting provider for security and troubleshooting.

3. Why we use it

• To reply to your enquiry and prepare quotes (with your consent and to take steps before a contract).
• To deliver the services you order, manage your account and process payments (to perform our contract with you).
• To keep accounting and tax records (to meet legal obligations).
• To keep our website and systems secure (our legitimate interest).

We do not sell your personal data, and we do not send you marketing messages unless you have agreed to receive them. You can opt out at any time.

4. Who we share it with

We share personal data only where needed to provide our services, with:

• our website hosting and email providers;
• payment providers, including Safaricom M-Pesa, to process your payments;
• licensed network partners, when we deliver Bulk SMS or USSD services you have ordered;
• government authorities, where the law requires it.

Some providers may store data outside Kenya. Where that happens, we take the safeguards required by the Data Protection Act, 2019.

5. Data you give us about others

If you use our Bulk SMS or other services to process your own customers’ or members’ data, you are the data controller for that data and we act as your data processor. You are responsible for having a lawful basis, such as consent, for messaging your contacts.

6. How long we keep it

We keep enquiry details for up to 24 months if no project follows. We keep client, project and payment records for as long as you are a client and then for up to seven years, as needed for accounting and legal purposes. After that we delete or anonymise the data.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your data is used;
• access the personal data we hold about you;
• object to the processing of all or part of your data;
• have false or misleading data corrected;
• have false, misleading or unlawfully processed data deleted;
• withdraw consent at any time, where processing is based on consent;
• receive your data in a portable format, where applicable.

To use any of these rights, email info@elvinsoft.co.ke. We will respond within the time required by law. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC).

8. Cookies

Our marketing pages do not use cookies for tracking. Our client area (order form and dashboard) uses essential cookies to keep you signed in; these are needed for the service to work.

9. Security

We use HTTPS encryption, access controls and regular backups to protect your data. No system is completely secure, but we take reasonable steps to protect it and will notify you and the ODPC of a data breach where the law requires.

10. Children

Our services are meant for businesses and adults. We do not knowingly collect personal data from children.

11. Changes

We may update this policy from time to time. The date at the top shows when it last changed.