---
title: "Privacy Policy: How We Handle Your Data | Invictus Forma"
description: "How Invictus Forma collects, uses and protects personal data on this website and in the salon systems we host, under Kenya’s Data Protection Act, 2019."
canonical_url: "https://www.invictusforma.com/privacy"
meta:
  "og:description": "How Invictus Forma collects, uses and protects personal data on this website and in the salon systems we host, under Kenya’s Data Protection Act, 2019."
  "og:image": "https://www.invictusforma.com/og.png"
  "og:image:alt": "Invictus Forma: Your Own Salon & Spa System. Pay Once, Own It."
  "og:image:height": "630"
  "og:image:width": "1200"
  "og:title": "Privacy Policy: How We Handle Your Data | Invictus Forma"
---

> Index of every page on this site: [llms.txt](https://www.invictusforma.com/llms.txt)

§ Privacy

# Privacy policy

**Draft.** Have a lawyer review before relying on it.

Last updated: \[TODO: date of review]

This policy explains what personal data Invictus Forma collects, why, and what we do with it. We follow Kenya's Data Protection Act, 2019.

## Who we are

Invictus Forma builds and hosts booking and management systems for salons, spas and barbershops in Kenya. You can reach us on [+254 791 434 211](tel:+254791434211) or at [ntruderleroy@gmail.com](mailto:ntruderleroy@gmail.com).

\[TODO: registered business name, physical address, and registration number]

\[TODO: confirm whether Invictus Forma is registered with the Office of the Data Protection Commissioner, and as controller, processor or both]

## Two kinds of data, two roles

- **Data about you, when you use this website or contact us.** We decide how this is used, so we are the data controller.
- **Data inside a system we build and host for a client.** This is data the salon collects about its own customers and staff. The salon (our client) is the data controller and is responsible for it. We act as the hosting provider and data processor: we store and handle it only to run the system for them. \[TODO: confirm roles]

## What we collect on this website

- **The contact form:** your name, phone number, business type, number of branches and your message.
- **Calls, WhatsApp and email:** your number or address, your name if you give it, and what you send us.
- **Analytics:** we use Google Analytics to count visits and see which pages are used. It uses cookies and collects details such as pages viewed, device and browser type, and approximate location. \[TODO: decide on a cookie consent banner for analytics]

## Why we use it

- To reply to you and give you a quote. You asked us to.
- To build, host and support a system if you become a client. We need to, under our agreement.
- To understand how the website is used and improve it.

We don't sell personal data, and we don't use it for anyone else's advertising.

## Data in client systems

A salon's system can hold its customers' names and phone numbers, booking history, M-Pesa payment records, and staff details. The salon decides what is collected and why. We:

- store and process it only to run, host, back up and support the system;
- don't use it for our own purposes or share it with anyone except the providers listed below;
- limit access to people who need it to keep the system running;
- back up the database every night, encrypted, and keep the backups off the server, on Cloudflare R2.

If you are a salon's customer and want to see, correct or delete your data, contact the salon first. We'll help them respond.

\[TODO: hosting provider and server location]

## Who else handles data

We use these providers to run our services:

- Google: email for contact form messages, and Google Analytics
- WhatsApp (Meta), when you message us there
- Cloudflare: website delivery, security, and storage for encrypted backups
- Our server hosting provider \[TODO: name]
- Safaricom (M-Pesa), for payments taken through client systems
- An SMS or WhatsApp messaging provider, if a client adds reminders

Some of these providers store data outside Kenya. Where they do, we rely on the safeguards the Data Protection Act requires for transfers out of Kenya. \[TODO: confirm the transfer basis with a lawyer]

## How long we keep it

\[TODO: how long you keep enquiries, client records, and backups, and what happens to a client's data when they stop hosting with you]

## Keeping it safe

Every system runs over SSL. Backups are encrypted. We apply security updates and monitor for downtime. No system is perfectly secure, but we work to keep the risk low.

If a breach affects a client's data, we tell that client without delay, so they can meet their own duty to notify the Data Protection Commissioner, which the Act sets at within 72 hours of becoming aware of it.

## Your rights

Under the Data Protection Act, you have the right to:

- be told how your data is used;
- see the data held about you;
- object to it being processed;
- have false or misleading data corrected, and have data deleted;
- receive your data in a format you can take elsewhere.

To use any of these, call, WhatsApp or email us. If you're not happy with our answer, you can complain to the [Office of the Data Protection Commissioner](https://www.odpc.go.ke).

## Changes to this policy

If we change this policy, we'll update it here and change the date at the top.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://www.invictusforma.com/#website","@type":"WebSite","description":"Custom booking and management systems for salons, spas and barbershops in Kenya. Pay once for the build, then yearly hosting. No per-staff monthly fees.","name":"Invictus Forma","url":"https://www.invictusforma.com/","publisher":{"@id":"https://www.invictusforma.com/#identity"}},{"@id":"https://www.invictusforma.com/privacy#webpage","@type":"WebPage","description":"How Invictus Forma collects, uses and protects personal data on this website and in the salon systems we host, under Kenya’s Data Protection Act, 2019.","name":"Privacy Policy: How We Handle Your Data | Invictus Forma","url":"https://www.invictusforma.com/privacy","breadcrumb":{"@id":"https://www.invictusforma.com/privacy#/schema/breadcrumb-list/#breadcrumb"},"isPartOf":{"@id":"https://www.invictusforma.com/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://www.invictusforma.com/privacy"]}],"primaryImageOfPage":{"@id":"https://www.invictusforma.com/#logo"}},{"@id":"https://www.invictusforma.com/#identity","@type":"Organization","description":"Invictus Forma builds custom booking and management systems for salons, spas and barbershops in Kenya.","email":"ntruderleroy@gmail.com","name":"Invictus Forma","telephone":"+254791434211","url":"https://www.invictusforma.com","areaServed":{"@type":"Country","name":"Kenya"},"contactPoint":{"@type":"ContactPoint","contactType":"sales","telephone":"+254791434211","email":"ntruderleroy@gmail.com","areaServed":"KE","availableLanguage":["English"]},"logo":{"@id":"https://www.invictusforma.com/#logo"}},{"@id":"https://www.invictusforma.com/privacy#/schema/breadcrumb-list/#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://www.invictusforma.com/","position":1},{"@type":"ListItem","name":"Privacy","item":"https://www.invictusforma.com/privacy","position":2}]},{"@id":"https://www.invictusforma.com/#logo","@type":"ImageObject","caption":"Invictus Forma","contentUrl":"https://www.invictusforma.com/logo.png","inLanguage":"en","url":"https://www.invictusforma.com/logo.png"}]}
```

## Sitemap

See the full [sitemap](https://www.invictusforma.com/sitemap.md) for all pages.