Legal
Privacy policy
How LitWebTech (James Obaigwa) collects, uses, keeps and protects personal data on this website under the Kenya Data Protection Act 2019, and your rights. Last updated 8 October 2026.
1. Who is responsible
LitWebTech is the trading name of James Obaigwa, a sole proprietor at Kiambu Road, Nairobi, Kenya ("I", "me"). I am the data controller for this website. Contact for anything about personal data: info@litwebtech.com, +254 115 586 624.
For the systems I build and host for clients, the client institution is the data controller and I act as its data processor under a written data processing agreement, as section 42 of the Data Protection Act 2019 requires. This policy covers this website only; each client system carries its own notice issued by that institution.
2. What this website collects, and why
| Data | When | Purpose | Lawful basis |
|---|---|---|---|
| Name, organisation, email, phone, topic, message | You send the contact form | To reply to you and, if we work together, to prepare a proposal | Your consent (the tick box) and my legitimate interest in answering an enquiry you made |
| IP address, browser identifier, time of submission | You send the contact form | To limit spam and abuse of the form (rate limiting, honeypot) | Legitimate interest |
| Consent record (that you ticked the boxes, and when) | You send the contact form | To prove consent was given | Legal obligation |
| Server logs (IP, page, time, browser) | Every visit | Security, error diagnosis | Legitimate interest |
| Google Analytics usage data | Only after you accept cookies | To see which pages are useful | Your consent, withdrawable any time |
| Your cookie choice | You click Accept or Decline | So the notice does not reappear | Strictly necessary |
I do not collect sensitive personal data through this site, do not profile visitors, and make no automated decisions about you. There are no advertising cookies and I do not sell or rent personal data.
3. Third parties who may receive data
- Hosting provider: the website and its database are hosted on a managed server; the provider processes data only to run the server.
- Email: form submissions are also emailed to me through my mail provider.
- Google (Analytics): only after you accept cookies. Google processes this data outside Kenya under its own terms and the Google Ads data processing terms.
- WhatsApp: if you choose the WhatsApp button, the conversation happens in WhatsApp under Meta's terms; this site sends nothing to WhatsApp itself.
- Authorities: where the law requires disclosure.
Where data leaves Kenya (Google), it does so only with your consent, which the Act allows under section 48.
4. How long I keep it
- Contact form submissions: 24 months from submission, then deleted; if we enter into a contract, the enquiry becomes part of the client file and is kept for the life of the contract plus 7 years for tax and legal purposes.
- Consent records: as long as the submission they relate to.
- Server logs: as kept by the hosting provider, typically 90 days.
- Analytics data: 14 months (Google Analytics retention setting).
5. Children
This website is meant for organisations, not children. I do not knowingly collect a child's data through it; if a child's data reaches me by mistake I delete it. Where a client system holds learners' data, the institution is the controller and guardian consent is handled under its own notice.
6. Your rights
Under section 26 of the Data Protection Act 2019 you may: be told what data I hold about you and how it is used; receive a copy of it in a portable form; have it corrected; have it deleted; object to or restrict processing; and withdraw consent at any time (for cookies, use "Cookie preferences" in the footer; for a form submission, email me). Email info@litwebtech.com. I confirm your identity before acting, respond to access requests within 7 days and to other requests within 14 days, as the Data Protection (General) Regulations 2021 require, and there is no charge.
If you are not satisfied, you may complain to the Office of the Data Protection Commissioner, odpc.go.ke, complaints@odpc.go.ke.
7. Security and breaches
The site is served over HTTPS. Form data is stored in a database that is not publicly reachable, protected by access controls, and accessible only to me. Backups are encrypted. If a breach is likely to cause you real risk of harm, I notify the Data Commissioner within 72 hours and tell you without undue delay, as section 43 of the Act requires.
8. Links to other sites
Client sites and other pages linked from here have their own privacy practices, for which I am not responsible.
9. Changes
Changes are posted here with a new date. Substantive changes to what is collected are highlighted at the top of this page.