Privacy Policy

Spirdlytics ("we", "us", "our") is a freelance data analytics and AI automation practice operated by Genson Kithome, based in Kenya. We provide dashboards, data analysis, and workflow automation services to SMEs and individuals, primarily in the agrifood and general SME sector.

This Privacy Policy explains how we collect, use, store, and protect personal data submitted through our website, including our lead enquiry form, in accordance with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021, as enforced by the Office of the Data Protection Commissioner (ODPC), Kenya.

If you have questions about this policy or how your data is handled, contact us at: info@spirdlytics.online or +254 784 310 373.

When you submit an enquiry through our website form, we collect:

• Contact details: name, business name, email address, WhatsApp/phone number.
• Project information: project type, current setup and tools in use, team or business size, budget range, timeline, and any project details you provide in free text.
• Files you choose to attach, such as sample data or documents relevant to your enquiry.
• Technical data: basic website usage data via standard hosting and analytics logs, which may include IP address and browser information.

We do not knowingly collect sensitive personal data (as defined under Section 2 of the Act) through this form. Please do not include health, biometric, financial account, or similarly sensitive information in the Project details field or attached files unless it is strictly necessary and directly relevant to your enquiry.

We process your data on the basis of:

• Consent — you have voluntarily submitted the form to request our services.
• Contract/pre-contract steps — to respond to your enquiry and, if you proceed, to deliver a service to you.
• Legitimate interest — to qualify enquiries, plan project scope, and communicate with you about your request.

We use your data to:

1. Respond to your enquiry and assess project fit.
2. Communicate with you about proposed work, quotes, and scheduling.
3. Deliver contracted services, where an engagement proceeds.
4. Maintain basic business records for invoicing and follow-up.
5. Improve our services in aggregated, non-identifying form only.

We do not use your data for unrelated marketing without your separate, explicit consent, and we do not sell your data to third parties.

We may share limited data with trusted third-party tools we use to operate our business ("processors"), strictly to the extent needed to deliver services to you. These may include:

• Google Workspace (Sheets, Docs, Drive) for storing and organizing enquiry and project data.
• n8n, self-hosted on our own infrastructure, for automating enquiry routing and internal workflows.
• Supabase for structured data storage where applicable to a project.
• AI processing tools such as Claude or Gemini API, where used to help categorize, summarize, or process enquiry or project data as part of service delivery.

These providers only receive the data necessary for the specific function they perform. Some process data on servers located outside Kenya; where this occurs, we rely on the provider's own data protection safeguards and, where applicable, standard contractual protections consistent with Section 48 of the Act governing cross-border data transfers.

We do not share your data with third parties for their own independent marketing purposes.

• Enquiries that do not proceed to a contract are retained for up to 12 months, then deleted, unless you request earlier deletion.
• Client project data is retained for the duration of the engagement plus a reasonable period afterward for record-keeping, invoicing, and legal or tax compliance (typically up to 7 years, consistent with standard Kenyan business record-keeping practice), after which it is securely deleted or anonymized.

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your data is used (this policy).
• Access the personal data we hold about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data, subject to legal or contractual retention requirements.
• Object to or restrict certain processing.
• Request data portability, where technically feasible.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data has been mishandled.

To exercise any of these rights, contact us at info@spirdlytics.online. We will respond within a reasonable time, consistent with our obligations under the Act.

We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse, including restricted access to stored data and use of reputable, security-conscious service providers. However, no system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top will reflect the most recent revision. Continued use of our website after changes take effect constitutes acceptance of the updated policy.

For any questions, requests, or complaints regarding this policy or your personal data:

Spirdlytics
Owner: Genson Kithome
Email: info@spirdlytics.online
WhatsApp/Phone: +254 784 310 373
Location: Kenya

You may also contact the Office of the Data Protection Commissioner (ODPC), Kenya, directly for independent guidance or to lodge a complaint.