How Beacon Creek, a Nairobi software studio, handles personal data under the Kenya Data Protection Act, 2019.
Who decides: controller and processor
- Controller: for this website, enquiries, bookings, newsletter, trials and our own billing, Beacon decides why and how data is used.
- Processor: when a business uses our automations or software for its own customers, that business is the controller. We act only on its written instructions. If you got a message sent for a business, contact that business first; we will help it answer.
What we collect
- Contact details you give us: name, email, phone, business name and message (contact, booking, intake, trial and newsletter forms).
- Account and portal data: sign-in email, project files, messages and settings.
- Payment records: amount, reference, channel and the name and phone the payment provider returns. We never see full card numbers, card codes or M-Pesa PINs.
- Automation data a client loads: their customers' names, phones, emails and the messages sent.
- AI chat text you type into the site assistant.
- Basic usage data: pages viewed, referral code, device and IP address for security and rate limiting.
Why we use it and our legal basis
- To reply, book calls and deliver what you asked for: contract or steps before a contract.
- To bill, keep tax records and prevent fraud: legal obligation and legitimate interest.
- To keep the site secure and working: legitimate interest.
- To send updates and offers: your consent. Every marketing message has a free opt-out.
- Client automation data: the client's instructions, under our agreement with them.
Who we share it with
We do not sell personal data. Service providers process it for us under contract:
- Heroku (Salesforce): hosting and database.
- Resend: email delivery.
- Paystack: card, M-Pesa and bank payments.
- Africa's Talking: SMS.
- Meta (WhatsApp Cloud API): WhatsApp messages.
- Groq and OpenAI: AI chat and drafting. Do not type sensitive data such as ID or health details into the chat.
- Authorities, only when the law requires it.
Transfers outside Kenya
Some providers store data outside Kenya. We transfer it only with appropriate safeguards, such as written data processing terms, as sections 48 to 50 of the Act require.
How long we keep it
- Enquiries that do not become work: 12 months from last contact.
- Accounts and portal data: while active, then up to 12 months after closure.
- Messages and delivery logs: 12 months.
- AI chat logs: 90 days.
- Payment and tax records: 7 years.
- Opt-out lists: kept so we keep honouring them.
- Client automation data: as the client instructs, deleted or returned when the contract ends.
Cookies
We use a few first-party cookies and local storage for sign-in, theme, referral codes and simple analytics. No advertising cookies.
Your rights
Under the Kenya Data Protection Act, 2019 you can:
- Access the data we hold about you.
- Correct false or misleading data.
- Delete data we no longer have a lawful reason to keep.
- Object to processing, including any direct marketing.
- Restrict processing, get a portable copy, and withdraw consent at any time.
How we protect it
HTTPS everywhere, signed sessions, role-based access, rate limits, written terms with providers and a breach response plan. If a breach puts you at real risk, we tell the ODPC within 72 hours and tell you as soon as we can.
Changes
We post updates here with a new date and tell you by email if a change is significant.
Contact us or complain
Email admin@beaconcreek.co.ke or hello@beaconcreek.co.ke. Requests are free. We may ask you to confirm who you are.
You can also complain to the Office of the Data Protection Commissioner (ODPC): odpc.go.ke/file-a-complaint, complaint@odpc.go.ke, 020 780 1800, Britam Tower, 12th Floor, Hospital Road, Upper Hill, Nairobi.
Beacon Creek, Nairobi, Kenya
