Privacy Policy

CobrazoTech Limited is a web development and digital services company incorporated and operating in Kenya. We are the data controller for personal information collected through our website and in the course of providing our services. Contact: privacy@cobrazotech.com

We collect the following categories of personal data: • Identity Data: name, company name, job title • Contact Data: email address, phone number, physical address • Technical Data: IP address, browser type, device type, pages visited, time spent on site (collected via analytics cookies with your consent) • Enquiry Data: project brief, budget, messages sent through our contact forms • Client Account Data: login credentials, project documents, communication history • Payment Data: billing address; we do not store card numbers — payments are processed by PCI-DSS compliant third parties (M-Pesa, Stripe)

We use your personal data to: • Respond to enquiries and provide project quotes • Deliver agreed services and manage client accounts • Process payments and issue invoices • Send service-related communications (project updates, invoices) • Send marketing communications where you have consented • Improve our website and services through analytics • Comply with legal obligations under Kenyan law

Under the Kenya Data Protection Act 2019 and GDPR, we process your data on the following lawful bases: • Contract: to fulfil our obligations under a project agreement • Legitimate Interests: to manage our business, improve services, and prevent fraud • Consent: for marketing emails and non-essential cookies (you may withdraw consent at any time) • Legal Obligation: where required by Kenyan law

We do not sell your personal data. We share it only: • With service providers who assist in delivering our services (hosting providers, email platforms, accounting software) under data processing agreements • With payment processors (Safaricom M-Pesa, Stripe) for transaction processing • Where required by Kenyan law or court order • With your explicit consent

We retain personal data for as long as necessary for the purposes described in this Policy: • Client project data: 7 years after project completion (for tax and legal compliance) • Marketing communications preferences: until you unsubscribe or withdraw consent • Website analytics data: 26 months (or as configured in Google Analytics) • Enquiry / contact form data: 2 years if no contract follows

Under Kenya's Data Protection Act 2019, you have the right to: • Access your personal data we hold about you • Correct inaccurate or incomplete data • Request deletion of your data ("right to erasure") • Object to processing based on legitimate interests • Withdraw consent at any time (for consent-based processing) • Data portability — receive your data in a machine-readable format • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya To exercise any of these rights, email: privacy@cobrazotech.com

We implement appropriate technical and organisational measures to protect your personal data, including: • TLS/SSL encryption for all data in transit • Access controls limiting data access to authorised personnel • Regular security audits and vulnerability assessments • Secure, encrypted backups In the event of a data breach that poses risk to your rights and freedoms, we will notify you and the ODPC within 72 hours as required by law.

Some of our service providers are located outside Kenya (e.g., Vercel in the USA for hosting, Google for analytics). When transferring data internationally, we ensure adequate protections are in place, such as Standard Contractual Clauses or equivalent safeguards recognised under the Kenya Data Protection Act.

We use cookies and similar tracking technologies on our website. Please see our Cookie Policy for full details. You can manage cookie preferences through our cookie consent banner or your browser settings.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you are a registered client) and by posting the updated Policy on our website. The "Last Updated" date at the top indicates when the latest changes were made.

For privacy questions or to exercise your rights: CobrazoTech Limited — Data Protection Office Email: privacy@cobrazotech.com Nairobi, Kenya If you are not satisfied with how we handle your request, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke