Privacy notice
What we collect, why, and how long we keep it.
We sell data-protection work. It would be embarrassing to get this wrong on our own site, so this notice describes what the code on this site actually does rather than what a template says.
Last updated September 2026 · Data controller: Hemi Tech Co., Nairobi, Kenya
The short version
This site has two forms. If you use one, we store what you typed and reply to you. We do not add you to a mailing list, we do not sell or share your details, and there are no cookies, no analytics and no third-party trackers on any page.
What we collect
The contact form collects your name, your organisation, your email address, your website if you give it, and your message. All of it is needed to reply sensibly; the website field is optional and marked as such.
The audit form collects your email address and the website you want checked. Nothing else: in particular, which of the seven checks you ticked is never sent to us unless you type it into a message yourself.
Both forms include a hidden field that real people never fill in. If it is filled in, the submission is discarded as automated. That field is not personal data.
Our server records the usual request information for a short period as part of ordinary operation and abuse prevention, including a rate-limiting counter. We do not build a profile from it.
What we do not collect
- No cookies are set by this site, for any purpose.
- No analytics. If we ever add any it will be cookieless and self-hosted, and this notice will say so before it goes live.
- No third-party scripts, fonts, embeds or pixels. Every asset on every page is served from this domain.
- No tracking of what you ticked in the audit tool.
What stays in your own browser
The audit tool remembers your ticks in sessionStorage under a single key, so a reload does not lose them. That value never leaves your device, is not readable by us, and is discarded when you close the tab.
Why we are allowed to hold it
Under the Data Protection Act 2019 our lawful basis is your consent, given by choosing to send us the form, together with our legitimate interest in responding to an enquiry about our services. You are never required to give us anything to read this site.
Where it is stored, and who can see it
Submissions are stored in our hosting provider's object storage and a notification is sent to us by email. Access is limited to the people at Hemi Tech Co. who need it to reply to you. We do not pass it to anyone else, and we do not use it to train anything.
Our hosting and storage provider processes the data on our instructions as a processor. Data residency is stated per project: where a client requires data to stay in a named jurisdiction we scope the hosting to meet it, and the arrangement goes into the contract.
How long we keep it
Submissions are deleted after 24 months unless you become a client, in which case the correspondence is kept for the life of the engagement and the period our records obligations require. The deletion is implemented in the system, not merely promised here.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Write to hello@hemitech.co.ke and we will act within the statutory period. You do not have to give a reason.
If you are not satisfied with how we have handled it, you can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya. Our own ODPC registration is listed on the credentials page with its real status, which is currently an application in progress.
Changes
If this notice changes, the date at the top changes with it. We will not quietly broaden what we collect.
Contact
Hemi Tech Co. · Nairobi, Kenya · hello@hemitech.co.ke · +254 704 820 334