Privacy Policy

1. Who we are

Ndakita (“we,” “us,” or “our”) is a software business based in Kenya. This policy covers ndakita.com, build.ndakita.com and the Ndakita Build product. It does not cover GiveHaven, which publishes its own policy on its own site.

• For our own visitors and customers we are the data controller. That covers anyone who fills in a form here, and the person who signs up for Ndakita Build.
• For the records a customer keeps inside Ndakita Build such as their own staff, clients and suppliers, the customer is the controller and we are their processor. We act on their instructions, we do not decide what goes in, and we do not use it for anything except running the service for them. If your data is in a customer's workspace, ask them first, and we will support them in answering you.

2. What we collect

• What you send us. Your name, email address, phone number, company name and anything you write in a message, when you use a contact or demo form.
• ERP assessment answers. Your answers about industry, company size, current systems, priorities, budget range and timeline, together with the contact details you give at the end.
• Ndakita Build account data. If you start a workspace, the details needed to create and run it, plus the business records you enter into it. Those records belong to you and we process them only to provide the service.
• Technical data. Server logs from our host, which include IP addresses, and aggregate page-view statistics. We do not build advertising profiles and we do not track you across other websites.

3. Why we process it, and on what basis

The Data Protection Act 2019 requires us to have a lawful basis for each purpose. Ours are:

• To answer your enquiry and prepare a quote. Basis: taking steps at your request before entering a contract.
• To provide and support Ndakita Build. Basis: performance of our contract with you.
• To keep the site working and free of abuse. Basis: our legitimate interest in a functioning, spam-free service.
• To send marketing messages. Basis: your consent. You can withdraw it at any time and we will stop.
• To meet tax, accounting and legal obligations. Basis: compliance with a legal obligation.

4. Who we share it with

We do not sell, rent or trade personal information. We use service providers in the following roles, and only for the purposes listed:

• Website hosting. Serves this site and keeps server logs, which include IP addresses.
• Form delivery. Receives what you type into a contact or demo form and passes it to us.
• Bot protection. The check on our forms. It sees your IP address and browser characteristics in order to tell a person from a script.
• Assessment delivery. Receives ERP assessment submissions where that route is configured.
• Analytics. Aggregate page-view statistics only. Cookieless, stores no IP addresses and builds no visitor profiles. Provided by our hosting platform.
• Ndakita Build hosting. A customer's workspace and every record in it.

We will tell you which company provides any of these, and where it operates, if you ask. Use the contact form, and if you are assessing us as a supplier, say so and we will send the full list rather than answer one at a time.

We may also disclose information where the law requires it, or as part of a merger or sale of the business, in which case we will let you know as soon as we are able to.

5. Transfers outside Kenya

Every provider above operates outside Kenya. Where personal information leaves Kenya we rely on the safeguards in sections 48 to 50 of the Data Protection Act 2019, including the contractual protections in our agreements with each processor. You can ask us for details of the safeguards that apply to you.

6. Cookies and local storage

We set no cookies of our own, and our analytics are cookieless. The only cookies that can appear are strictly necessary ones, which do not require your consent, and that is why you do not see a cookie banner.

• Our currency switcher stores your choice of shillings or dollars in your browser's local storage. It never reaches our servers, and clearing your browser data removes it.
• The bot check on our forms may set a strictly necessary cookie when a form is shown. It exists to tell a person from a script, not to track you, and it is set by that provider rather than by us.

7. How long we keep it

• Enquiries and demo requests: up to 24 months from our last contact, then deleted.
• ERP assessment submissions: up to 24 months from submission.
• Ndakita Build account and business records: for as long as your subscription runs, and for 90 days after it ends so you can export your data. After that they are deleted, except where we must keep a record for tax, which the Tax Procedures Act sets at five years.
• Server logs: held by our hosting provider under its own retention schedule, which we do not set. We do not copy them or keep our own archive of them.

8. Your rights

Under the Data Protection Act 2019 and the Data Protection (General) Regulations 2021 you have the right to:

• Be told how your personal information is being used
• Access the personal information we hold about you. We answer within 7 days.
• Have inaccurate, false or misleading information corrected. 14 days.
• Have your personal information erased. 14 days.
• Object to processing, including for marketing. 14 days.
• Ask us to restrict processing while a question is resolved. 14 days.
• Receive your data in a portable format, or have it sent to another provider. 30 days.

Use the contact form to make any of these requests. We do not charge for them. Where we must keep something despite an erasure request, for example a record we are required to hold for tax, we will tell you what and why. If you are not satisfied with our response you can complain to the Office of the Data Protection Commissioner in Kenya.

9. Security

Traffic to this site and to Ndakita Build is encrypted in transit. Access to customer data is limited to the people who need it to run the service, and Ndakita Build keeps each customer's data in its own separate database. No system is perfectly secure, so we cannot promise absolute security. If a breach affects your information we will report it to the Office of the Data Protection Commissioner within 72 hours, as section 43 of the Act requires, and tell you where the risk to you is real.

10. Other websites

This site links to services we do not operate, including the Google Play listings for our apps and the ERP vendors named on our comparison page. Their privacy practices are their own.

11. Changes to this policy

We may update this policy. Changes are posted here with a new date below. If a change materially affects how we use information you have already given us, we will tell you directly.