Privacy Policy

1. Who we are

Neurobyte Technologies Ltd is a software engineering and cybersecurity company registered in Kenya and based in Nairobi. For the data we collect through this website and about our own clients, we act as a data controller. For personal data we process inside systems we build or operate on a client's instructions, we act as a data processor, and the client's own privacy notice governs that processing alongside our Data Processing Agreement.

We are registered with the Office of the Data Protection Commissioner in both capacities: registration number 805-7801-3679, certificate serial 25934 as a data controller and 25933 as a data processor.

2. Information we collect

We collect information you provide directly, such as your name, email address, phone number, organisation and message content when you use our contact, scoping, booking or application forms.

We also collect limited technical data through standard web technologies: IP address, browser and device type, referring page and the pages you visit. This is used to keep the site secure and to understand which content is useful, not to build a profile of you.

Our free security tools are designed to collect as little as possible. Where a tool needs an input to work, for example a domain name or a password to score, that input is processed to produce your result and is not retained as a record against you.

3. How we use your information

We use the information you give us to respond to enquiries, prepare quotations and scopes of work, deliver and support the services you have engaged us for, maintain the security of our platforms, and meet our legal, accounting and tax obligations.

Our lawful bases are the steps taken at your request before entering a contract, the performance of a contract, our legitimate interest in running and securing our business, your consent where we have asked for it, and compliance with a legal obligation.

We do not sell your personal data to third parties, and we do not use it to train third-party AI models.

4. Partner and reseller applications

If you apply to our reseller or channel partner programme, we collect the details you submit: your company name, contact name, role, email, phone number, company website, country or territory, the partnership types and services you are interested in, your estimated deal volume, and any message you provide. We collect this only where you have consented to be contacted about a potential partnership.

We use it solely to evaluate your application, determine partnership fit, and communicate with you about a possible partnership. Any internal assessment or scoring notes we record are for our own review and are not shared with you or with third parties. We do not use partner application data for unrelated marketing without a separate lawful basis, and we do not sell it.

We retain partner application data for as long as needed to assess the application and, if a partnership proceeds, for the duration of that relationship and any period required to meet our legal, accounting and tax obligations. Where an application does not lead to a partnership we delete or anonymise it within a reasonable period. You may ask us to delete your application at any time.

5. Job and internship applications

When you apply for a role, an internship or an industrial attachment, we collect the details and documents you submit, including your CV. We use them to assess your application, to contact you about it, and to keep a record of the hiring decision.

If you are not successful we may keep your application on file to consider you for future openings. Tell us if you would rather we did not, and we will delete it.

6. Who we share data with

We share personal data with service providers who help us run the business: hosting and database infrastructure, email delivery, calendar and video conferencing, and payment processing. Each is engaged under terms that limit them to processing on our instructions.

We may disclose data where the law requires it, where it is necessary to establish or defend a legal claim, or to protect the safety and security of people and systems.

Some of our providers operate outside Kenya. Where personal data is transferred out of Kenya we do so on a basis permitted by the Data Protection Act, 2019, and we assess the safeguards the provider has in place before we use them.

7. How long we keep it

We keep enquiry and contact data for as long as needed to deal with the enquiry and for a reasonable period afterwards in case you come back to us. Client and project records are kept for the life of the engagement plus the period our legal, accounting and tax obligations require. Application data is handled as described above.

When a retention period ends, data is deleted or irreversibly anonymised.

8. Data protection and security

We apply the same controls to our own systems that we sell to clients: encryption in transit and at rest, least-privilege access with multi-factor authentication, logging and monitoring, dependency and vulnerability scanning in CI/CD, and regular penetration testing.

No system is risk-free. If a breach affects your personal data and meets the threshold in the Act, we will notify the Office of the Data Protection Commissioner and, where required, you, within the timelines the law sets.

9. Cookies

Our website uses essential cookies for authentication and session management. We do not set third-party tracking or advertising cookies without your explicit consent. You can block or delete cookies in your browser, though doing so may stop parts of the site that require sign-in from working.

10. Your rights

Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to have inaccurate data corrected, to have data erased, to object to processing, and to request that we restrict processing in certain circumstances. Where processing is based on consent you may withdraw that consent at any time.

To exercise any of these rights, email info@neurobyte.co.ke. We will respond within the statutory timeframe. If you are not satisfied with our response you have the right to lodge a complaint with the Office of the Data Protection Commissioner.

11. Changes to this policy

We update this policy when our processing changes or the law does. The date at the top of this page shows when it was last revised. Material changes will be highlighted on the page.

12. Contact

For questions about this privacy policy, or to exercise your rights, contact us at info@neurobyte.co.ke, on +254 727 686 606, or by post to Neurobyte Technologies Ltd, P.O. Box 17888 – 00100, Nairobi, Kenya.