Privacy Policy

Margsutech is a technology company registered and operating in Kenya, based in Nairobi and serving clients internationally. For the purposes of the Kenya Data Protection Act 2019 and the UK and EU General Data Protection Regulation, we act as a data controller for the data described in this policy.

Questions about this policy, or any request relating to your data, should go to hello@margsutech.com. Security matters should go to security@margsutech.com.

Enquiries submitted through this site

When you submit the project form we collect your name, email address, and optionally your company name, along with the service you are interested in, your description of the project, budget range, and timeline. We collect this to respond to your enquiry and to prepare for a discovery call. The lawful basis is legitimate interest: you have contacted us about work, and responding requires keeping what you sent.

We also record the IP address and browser user agent of the submission. This is used solely to detect and prevent abuse of the form, and is deleted after 90 days by an automated process.

Client portal accounts

If you are given access to the client portal we hold your name, email address, role, and the organisation you belong to, together with a record of when you last signed in. Authentication itself is handled by Clerk, which holds your credentials; we never see or store your password.

The lawful basis is contract: this data is necessary to provide the portal you have been given access to.

Project and billing records

For active engagements we hold project details, milestones, documents you or we upload, messages exchanged through the portal, invoices, and payment records. Payment records include the amount, currency, provider, and the provider's transaction reference. We do not store card numbers: card processing is handled entirely by Stripe and Paystack, and M-Pesa transactions are handled by Safaricom.

Analytics

We use privacy-conscious product analytics to understand which pages are used and where people encounter difficulty. This is configured not to record form contents, and is used in aggregate rather than to build a profile of you.

What we do not collect

We do not buy personal data from third parties, we do not sell or rent your data to anyone, and we do not use your data to train machine learning models.

We use the following processors. Each holds only the data needed for its function, and each is bound by its own data processing terms.

We disclose data to law enforcement or regulators only where we are legally required to do so, and we will tell you when that happens unless we are prohibited from doing so.

We are based in Kenya and several of our processors operate in the United States and the European Union. Where personal data of individuals in the EU or UK is transferred outside those regions, the transfer relies on the Standard Contractual Clauses incorporated into our processors' data processing agreements.

We apply GDPR-aligned handling to all client data by default, not only where it is legally required, because operating two standards makes the weaker one the one that eventually gets applied by mistake.

Under the Kenya Data Protection Act and the GDPR you have the right to ask us for a copy of the data we hold about you, to have inaccurate data corrected, to have data deleted where we have no continuing need for it, to object to processing based on legitimate interest, and to receive your data in a portable format.

To exercise any of these, email hello@margsutech.com. We will respond within 30 days. We may ask you to verify your identity first, since acting on an unverified request would itself be a breach.

Some data cannot be deleted on request. Invoices and payment records are subject to statutory retention, and audit log entries cannot be removed without breaking the integrity of the log. Where we cannot delete something, we will tell you why.

If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner in Kenya, or to your local supervisory authority if you are in the EU or UK.

Data is encrypted in transit and at rest. Access is restricted by role and enforced at the database level rather than only in application code, so a fault in the application cannot expose another organisation's records. Multi-factor authentication is required for all internal and subcontractor accounts, and privileged actions are recorded in a tamper-evident audit log.

Subcontractors who work on client systems sign a non-disclosure agreement, complete background vetting proportionate to the sensitivity of the work, and are granted access scoped to the specific project rather than to everything.

Our security practices are described in more detail on our security page.

If a breach occurs that is likely to result in a risk to your rights, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the risk is high. Our incident response procedure is documented and rehearsed rather than written and filed.

Our services are provided to businesses and are not directed at children. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.

If we change this policy in a way that materially affects how we handle your data, we will update the date at the top and, for portal users, notify you directly. Continuing to use the service after a change means the updated policy applies.