Introduction and scope
This Privacy Policy is the notice we give you under section 29 of the Data Protection Act, 2019 (the “Act”). It explains what personal data Andora Innovations Limited collects, why, on what lawful basis, who we share it with, how long we keep it, and the rights you have.
It applies to personal data we process when you visit andorainnovationslimited.com (the “Website”), submit a form, use the live chat, contact us by email, telephone or WhatsApp, or engage us as a client or supplier. We process personal data in accordance with the Act, the Data Protection (General) Regulations, 2021 and the other laws of Kenya.
This policy should be read together with our Cookie Policy, Terms & Conditions and Acceptable Use Policy.
Who we are
Andora Innovations Limited (“Andora”, “we”, “us”, “our”) is a private limited company incorporated in Kenya, with its principal place of business in Nairobi. We design and build software, websites and mobile applications, and provide networking, cybersecurity, cloud and data services.
For the personal data described in this policy, Andora is the data controller: we decide the purpose and means of processing. Where we process personal data inside a client’s systems on that client’s instructions, we act as a data processor, and section “Where we act as a data processor” applies instead.
Questions about this policy or your personal data can be sent to our data protection contact at info@andorainnovationslimited.com.
Key terms
Terms used in this policy have the meanings given in section 2 of the Act. In particular:
- Personal data means any information relating to an identified or identifiable natural person.
- Sensitive personal data includes data revealing race, health status, ethnic social origin, conscience, belief, genetic or biometric data, property details, marital status, family details, sex or sexual orientation.
- Processing means any operation performed on personal data, including collection, recording, storage, use, disclosure and erasure.
- Data subject means the person the personal data relates to. In this policy, that is “you”.
Personal data we collect
Data you provide to us
- Contact and enquiry forms: your name, email address, telephone number (optional), the service you are interested in and the content of your message.
- Live chat: the content of your chat messages and any name, email address or telephone number you choose to share.
- Email, telephone and WhatsApp: your contact details and the content of your communications with us.
- Clients and prospective clients: names, job titles and business contact details of your personnel; billing details, including your KRA PIN where required for tax invoicing; and project information, documents and system access credentials you give us to deliver the services.
- Suppliers and job applicants: contact, payment and professional details needed to manage the relationship.
Data collected automatically
- Server logs: our hosting provider automatically records the IP address, browser and device type, pages requested, referring page, and date and time of each request.
- Live chat technology: only if you accept chat cookies or start a chat, our chat provider collects device and browser details, an approximate location derived from your IP address, and the pages you view while the chat is active. See our Cookie Policy.
We do not use analytics, advertising or social-media tracking technologies on the Website, and we do not buy personal data from third parties. We do not intentionally collect sensitive personal data through the Website. Please do not send it through our forms or chat.
Purposes and lawful bases
We process personal data only for specified, explicit and legitimate purposes (section 25 of the Act), and only where one of the lawful bases in section 30 of the Act applies:
| Purpose | Lawful basis (section 30) |
|---|---|
| Responding to enquiries, and preparing quotations and proposals | Necessary to take steps at your request before entering into a contract; our legitimate interest in responding to you |
| Delivering projects, managed services and support, and managing the client relationship | Performance of a contract to which you, or the organisation you represent, are party |
| Invoicing, accounting, tax and statutory record-keeping | Compliance with a legal obligation, including under the Tax Procedures Act, 2015 and the Value Added Tax Act, 2013 |
| Operating the live chat, including its AI assistant | Your consent, given through our cookie banner or by starting a chat |
| Securing the Website and our systems, and detecting and preventing fraud, abuse and cybercrime | Our legitimate interests; compliance with legal obligations |
| Sending news, offers and updates about our services | Your express consent (section 37 of the Act) |
| Complying with lawful requests from public authorities, and establishing, exercising or defending legal claims | Compliance with a legal obligation; our legitimate interests |
Where we rely on legitimate interests, we have considered your interests and rights and concluded that they are not overridden. We will not process personal data for a purpose incompatible with those above without first informing you and, where required, obtaining your consent. We do not sell personal data.
Consent
Where we rely on consent, we ask for it in a clear and specific way, as required by section 32 of the Act. You may withdraw consent at any time, and withdrawing is as easy as giving it:
- for chat cookies, use “Cookie settings” in the footer of any page;
- for marketing, use the unsubscribe link in any marketing message, or email us.
Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Direct marketing
In line with section 37 of the Act, we will only use your personal data to send you marketing communications if you have given express consent. Every marketing message will identify Andora and give you a simple way to opt out at no cost. We do not share your personal data with third parties for their own marketing.
Live chat and AI assistant
The live chat on the Website is provided by Tidio, including its AI assistant, Lyro. Lyro replies automatically to common questions using information we have supplied about our services, and a member of our team can take over the conversation.
The chat loads only after you accept chat cookies or choose to start a chat. The content of chat conversations is processed by Tidio on our behalf and may be used by Tidio’s AI features to generate answers.
No automated decisions. The assistant does not make any decision about you that produces legal effects or similarly significantly affects you, within the meaning of section 35 of the Act. Quotations and contractual decisions are always made by our staff. You may ask for a human at any time, or contact us by email, telephone or WhatsApp instead.
Transfers outside Kenya
Some of our service providers store or process personal data outside Kenya. For example, Tidio operates from the European Union and the United States, and Google operates data centres worldwide.
We transfer personal data outside Kenya only in accordance with Part VI of the Act (sections 48 to 50) and the Data Protection (General) Regulations, 2021. That means one of the following applies:
- the recipient is subject to appropriate safeguards for the security and protection of personal data, including binding contractual commitments;
- the transfer is necessary to perform a contract with you or to take steps at your request before entering into one; or
- you have consented to the transfer after being informed of the possible risks.
We do not transfer sensitive personal data outside Kenya without your consent and appropriate safeguards (section 49 of the Act).
How long we keep personal data
Under section 39 of the Act, we keep personal data only for as long as is reasonably necessary for the purpose for which it was collected, unless a longer period is required or authorised by law.
| Record | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | Up to 24 months from our last contact |
| Live chat conversations | Up to 12 months, unless they form part of a client record |
| Client, contract and project records | For the duration of the engagement and 7 years afterwards, to cover limitation periods for contract claims under the Limitation of Actions Act |
| Invoices, receipts and accounting records | At least 5 years, as required by section 23 of the Tax Procedures Act, 2015 |
| Server logs | A short period set by our hosting provider, typically a few weeks |
| Marketing consent and opt-out records | For as long as we send you marketing, and for 24 months after you opt out, so that we can respect your choice |
At the end of the applicable period, we securely delete, erase, anonymise or pseudonymise the personal data.
Security and breach notification
We implement appropriate technical and organisational measures, with data protection by design and by default, as required by the Act. These include encryption in transit (HTTPS/TLS), multi-factor authentication, role-based access on a need-to-know basis, secure configuration and timely patching, backups, and written confidentiality obligations for staff and contractors.
If a personal data breach creates a real risk of harm to you, we will notify the Data Commissioner within 72 hours of becoming aware of it, as required by section 43 of the Act. We will also tell you in writing, within a reasonably practical period, unless the law provides otherwise. We will describe the likely consequences and the measures we have taken, and recommend steps you can take to protect yourself.
No method of transmission or storage is completely secure. Please use strong, unique passwords and never share system credentials with us through the Website chat or forms.
Where we act as a data processor
When we build, host, support, audit or test systems that contain personal data controlled by a client, we act as that client’s data processor. We will:
- process the personal data only on the client’s documented instructions, and only to deliver the agreed services;
- ensure that everyone authorised to process it is bound by confidentiality;
- implement appropriate technical and organisational security measures;
- engage sub-processors, such as cloud hosting providers, only with the client’s general or specific authorisation and on terms that protect the data;
- assist the client in responding to data subject requests, carrying out data protection impact assessments, and meeting its other obligations under the Act;
- notify the client without undue delay after becoming aware of a personal data breach affecting its data, as required by section 43(2) of the Act; and
- on termination, return or securely delete the personal data at the client’s choice, unless the law requires us to keep it.
The client remains responsible, as data controller, for having a lawful basis for the processing and for informing its own data subjects. A data processing agreement is available on request and forms part of our engagement terms.
Your rights
Subject to the Act, you have the right to:
- be informed of the use to which your personal data is to be put (section 26(a));
- access your personal data in our custody (section 26(b));
- object to the processing of all or part of your personal data, including for direct marketing (sections 26(c) and 36);
- correct false or misleading data (sections 26(d) and 40);
- delete false, misleading or unlawfully held data, or data we are no longer authorised to retain (sections 26(e) and 40);
- restrict processing in the circumstances set out in section 34;
- data portability, meaning to receive your personal data in a structured, commonly used and machine-readable format and have it sent to another controller (section 38);
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (section 35); and
- withdraw consent at any time, where we rely on consent (section 32).
How to exercise your rights
Send your request to info@andorainnovationslimited.com with the subject “Data subject request”, stating which right you wish to exercise. We may ask for reasonable proof of identity before acting, so that we do not disclose your data to someone else.
We will respond within the periods prescribed by the Data Protection (General) Regulations, 2021. Currently, that is seven (7) days for a request to access your data, and fourteen (14) days for a request to correct or delete it. Requests are free of charge. If we cannot comply, in whole or in part, we will tell you why in writing.
Complaints
If you are concerned about how we have handled your personal data, please contact us first so that we can try to resolve the matter.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) under section 56 of the Act, at www.odpc.go.ke. You may also have a right to compensation under section 65 of the Act if you suffer damage because of a contravention of the Act.
Children
The Website and our services are directed at organisations and adults. We do not knowingly process the personal data of a child (a person under 18 years of age) except with the consent of a parent or guardian and in the child’s best interests, as required by section 33 of the Act. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We review this policy regularly and may update it to reflect changes in the law, our services or our practices. The “Last updated” date at the top shows when it was last revised. Where changes are material, we will give prominent notice on the Website and, where appropriate, notify clients directly before the changes take effect.
Contact us
For questions about this policy, to exercise your rights, or to raise a concern:
- CompanyAndora Innovations Limited
- Emailinfo@andorainnovationslimited.com
- Phone+254 710 337 605
- LocationNairobi, Kenya