This policy explains what personal data Invictus Forma collects, why, and what we do with it. We follow Kenya's Data Protection Act, 2019.
Who we are
Invictus Forma builds and hosts booking and management systems for salons, spas and barbershops in Kenya. You can reach us on +254 791 434 211 or at ntruderleroy@gmail.com.
[TODO: registered business name, physical address, and registration number]
[TODO: confirm whether Invictus Forma is registered with the Office of the Data Protection Commissioner, and as controller, processor or both]
Two kinds of data, two roles
- Data about you, when you use this website or contact us. We decide how this is used, so we are the data controller.
- Data inside a system we build and host for a client. This is data the salon collects about its own customers and staff. The salon (our client) is the data controller and is responsible for it. We act as the hosting provider and data processor: we store and handle it only to run the system for them. [TODO: confirm roles]
What we collect on this website
- The contact form: your name, phone number, business type, number of branches and your message.
- Calls, WhatsApp and email: your number or address, your name if you give it, and what you send us.
- Analytics: we use Google Analytics to count visits and see which pages are used. It uses cookies and collects details such as pages viewed, device and browser type, and approximate location. [TODO: decide on a cookie consent banner for analytics]
Why we use it
- To reply to you and give you a quote. You asked us to.
- To build, host and support a system if you become a client. We need to, under our agreement.
- To understand how the website is used and improve it.
We don't sell personal data, and we don't use it for anyone else's advertising.
Data in client systems
A salon's system can hold its customers' names and phone numbers, booking history, M-Pesa payment records, and staff details. The salon decides what is collected and why. We:
- store and process it only to run, host, back up and support the system;
- don't use it for our own purposes or share it with anyone except the providers listed below;
- limit access to people who need it to keep the system running;
- back up the database every night, encrypted, and keep the backups off the server, on Cloudflare R2.
If you are a salon's customer and want to see, correct or delete your data, contact the salon first. We'll help them respond.
[TODO: hosting provider and server location]
Who else handles data
We use these providers to run our services:
- Google: email for contact form messages, and Google Analytics
- WhatsApp (Meta), when you message us there
- Cloudflare: website delivery, security, and storage for encrypted backups
- Our server hosting provider [TODO: name]
- Safaricom (M-Pesa), for payments taken through client systems
- An SMS or WhatsApp messaging provider, if a client adds reminders
Some of these providers store data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires for transfers out of Kenya. [TODO: confirm the transfer basis with a lawyer]
How long we keep it
[TODO: how long you keep enquiries, client records, and backups, and what happens to a client's data when they stop hosting with you]
Keeping it safe
Every system runs over SSL. Backups are encrypted. We apply security updates and monitor for downtime. No system is perfectly secure, but we work to keep the risk low.
If a breach affects a client's data, we tell that client without delay, so they can meet their own duty to notify the Data Protection Commissioner, which the Act sets at within 72 hours of becoming aware of it.
Your rights
Under the Data Protection Act, you have the right to:
- be told how your data is used;
- see the data held about you;
- object to it being processed;
- have false or misleading data corrected, and have data deleted;
- receive your data in a format you can take elsewhere.
To use any of these, call, WhatsApp or email us. If you're not happy with our answer, you can complain to the Office of the Data Protection Commissioner.
Changes to this policy
If we change this policy, we'll update it here and change the date at the top.