Privacy Policy & Data Protection

VALDACE AI ("we", "us", "our") is the data controller responsible for your personal data. We provide AI automation, custom digital systems, and technology consultancy services. For any privacy-related enquiry, contact us at privacy@valdace.ai.

This Privacy Policy is prepared and enforced in compliance with: • Kenya Data Protection Act, 2019 (No. 24 of 2019) — the primary legislation governing personal data in Kenya • The Data Protection (General) Regulations, 2021 • The Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021 • Directives issued by the Office of the Data Protection Commissioner ("ODPC")

We process personal data in accordance with the eight data protection principles under Section 25 of the Act: 1. Lawfulness, fairness, and transparency 2. Purpose limitation 3. Data minimisation 4. Accuracy 5. Storage limitation 6. Integrity and confidentiality 7. Accountability 8. Non-transfer without adequate protection

We collect personal data necessary for our services: Identity & Contact Data • Full name, email address, telephone number, job title, and company name provided via contact and booking forms. Technical Data • IP address, browser type and version, device type, operating system, and pages visited. Communications & Financial Data • Content of messages and billing name/address required to process invoices.

We process personal data only when at least one lawful basis under Section 30 applies: Consent (Section 32), Contract (Section 30(b)), Legal obligation (Section 30(c)), or Legitimate interests (Section 30(f)).

We use personal data to respond to enquiries, schedule discovery calls, deliver contracted services, improve security, and comply with legal obligations. We do not sell your personal data.

We share personal data only with technology sub-processors bound by data-processing agreements, professional advisers, or regulatory authorities where required by law.

Under Section 25(e) of the Act, we retain personal data for no longer than necessary: • Enquiry data: 24 months • Client records: Duration of engagement plus 7 years (tax requirement) • Security logs: 90 days

You hold rights to Information, Access, Rectification, Erasure, Restriction, Data Portability, and Objection under the DPA 2019. To exercise your rights, email privacy@valdace.ai. We respond within 21 days.

We use strictly necessary and anonymous analytics cookies to maintain website functionality. We do not use cross-site tracking or advertising cookies.

Our services are not directed to individuals under 18. If you believe data of a child was inadvertently collected, contact privacy@valdace.ai for prompt erasure.

International data transfers adhere strictly to Sections 48–49 of the Act, using standard contractual clauses and ODPC adequacy determinations.

We enforce TLS 1.2+ encryption, role-based access controls, and security audits. In the event of a breach, we notify the ODPC within 72 hours per Section 43.

Contact our appointed Data Protection Officer at dpo@valdace.ai.

You maintain the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke or info@odpc.go.ke.

We review this Privacy Policy annually and post updates directly to this page with an updated effective date.