Privacy policy

Who is responsible

CmatrixTech Solutions is the practice responsible for personal data described in this policy. In this policy, “we” and “us” mean CmatrixTech Solutions. “You” means a visitor to this website, a person who contacts us, or a person whose information we receive for an engagement.

Privacy questions and requests under the Data Protection Act go to privacy@cmatrixtech.com. General contact remains daniel@cmatrixtech.com. This policy sits beside our terms of service. Those terms explain how a contract is taken. This policy explains what we do with personal data.

What this website collects

This website is a set of pages about the practice. It does not ask you to create an account, and it does not run advertising trackers. We do not sell personal data.

If you only read the pages, the information involved is limited to what a normal web visit produces. The host that serves the site may keep connection logs, such as an IP address, the time of the request, and the page requested, so the site can be operated and abuse can be investigated. We do not use those logs to build a marketing profile.

Links to email, phone, WhatsApp, Instagram, X, TikTok, Facebook, and YouTube leave this site or open another app. From that point the other service handles the interaction under its own terms and privacy policy.

When you contact us

If you email daniel@cmatrixtech.com, privacy@cmatrixtech.com, legal@cmatrixtech.com, support@cmatrixtech.com, or security@cmatrixtech.com, we receive the address you wrote from and whatever you write, including any files you attach. If you call 0714 432 050, we receive the number you call from and the conversation. We do not record calls as a matter of course. Notes we write down for a possible engagement are kept with that enquiry.

If you message us on WhatsApp at 0769 910 242, WhatsApp (Meta) carries the message. We receive your phone number, your display name as WhatsApp shows it, and the content you send. Meta processes that traffic under its own terms.

You do not have to contact us. If you do, please send only what we need to understand the work.

Information for an engagement

Once a contract is taken in writing, we use the personal data needed to do that work. Depending on the scope, that can include names and contact details of the people involved, account access you choose to give us, source code, content, network details, and security findings.

We use that information to perform the engagement, to invoice, to provide customer service for the accepted period, and to keep a record of what was agreed. We do not use engagement material to advertise to your users.

Customer service lasts at least one week and at most twelve months after handover, depending on the architecture, as the written scope states. During that period we keep the correspondence needed to answer defects and questions about the deliverables.

Who we share it with

We do not sell personal data and we do not pass enquiry or engagement files to advertisers.

We share information only where it is needed: with a service that hosts email or this website, strictly so the message or the page can be delivered; with a professional adviser where the law allows and the adviser is bound to keep it confidential; or where a law, a regulator, or a court in Kenya requires it. Where the law allows, we tell you before a compelled disclosure.

If you use WhatsApp, your phone network, or a social network to reach us, that company is a separate controller of what you do on its service.

How long we keep it

An enquiry that does not become an engagement is kept for up to twelve months, so we can pick up the conversation if you write again, and then deleted or reduced to the minimum still required.

Records of an accepted engagement, including the written scope, invoices, and handover, are kept for up to six years after the engagement ends, because tax and legal claims in Kenya can run that long.

Customer-service correspondence is kept for the customer-service period and for up to twelve months after that period ends. Connection logs on the website host, where the host keeps them, follow the host’s ordinary rotation and are not kept by us as a separate archive.

How we protect it

We limit engagement files to what the work needs, and we do not leave access in place after the engagement ends unless the scope says access must remain. You should withdraw credentials you shared once the work no longer needs them.

No method of storage or transmission is perfectly secure. If we become aware of a personal-data breach that the Data Protection Act, 2019 requires us to notify, we notify the Office of the Data Protection Commissioner and, where the Act requires it, the people affected.

Your rights

Under the Data Protection Act, 2019 you may ask us what personal data we hold about you, ask for a correction, ask for deletion, object to a use, and ask for a copy in a usable form where the Act gives you that right. Some records, such as invoices, may have to be kept even after a deletion request, for as long as the law requires.

To use these rights, email privacy@cmatrixtech.com. We may need to confirm you are the person the data is about before we act. You may also complain to the Office of the Data Protection Commissioner in Kenya.

Changes to this policy

If we change this policy, we will update the date at the top of the page. The version on the website is the current one for new visits and new enquiries. An engagement already accepted keeps the privacy terms that applied when you accepted, unless a written change says otherwise.