Netpaq Business Systems

HomeLegal

Privacy Policy

How we collect, use and protect your personal data — KDPA & GDPR aligned.

Last updated: 27 May 2026

1. Who we are

Netpaq Business Systems Limited ("Netpaq", "we", "us") is a Kenyan-registered company with offices at Astrol Business Park, Ridgeways, Kiambu Road, P.O. Box 5305–00100, Nairobi. We act as a data controller for personal data collected through this website and as a data processor when handling personal data on behalf of our enterprise customers.

2. The law

This policy aligns with the Kenya Data Protection Act, 2019 ("KDPA"), the regulations issued by the Office of the Data Protection Commissioner (ODPC), and — where applicable — the EU General Data Protection Regulation (GDPR).

3. Data we collect

  • Identity & contact — name, business email, phone, company.
  • Enquiry data — the message you send via the contact form and your service interest.
  • Technical — IP address, browser type, device, pages visited, referrer.
  • Consent — your cookie preferences and timestamp.

4. Why we process it (lawful basis)

  • Consent — analytics, marketing and non-essential cookies.
  • Contract / pre-contract — responding to your enquiries and quotes.
  • Legitimate interest — securing the site, preventing fraud, improving services.
  • Legal obligation — tax, audit and regulatory reporting.

5. Cookies

We use strictly necessary cookies to operate the site, and — only with your consent — analytics and marketing cookies. You can change your preferences at any time via the cookie banner or by clearing your browser's site data.

6. Sharing your data

We share personal data only with:

  • Sub-processors who help us deliver the service (hosting, email, CRM) under written data-processing agreements.
  • Authorised partners (e.g. Oracle, Sage, Microsoft) where you have explicitly requested a quote or onboarding.
  • Regulators, courts and law enforcement where required by law.

We do not sell personal data.

7. International transfers

Where data leaves Kenya, we rely on adequacy decisions, Standard Contractual Clauses, or your explicit consent — as permitted by the KDPA.

8. Retention

We keep enquiry data for up to 24 months from your last interaction, unless a longer retention period is required by law or by an active contract.

9. Your rights

Under the KDPA and GDPR you have the right to:

  • Access the personal data we hold about you.
  • Request correction or deletion ("right to be forgotten").
  • Object to or restrict processing.
  • Withdraw consent at any time.
  • Port your data to another controller.
  • Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

10. Security

We apply ISO-aligned technical and organisational measures — encryption in transit, least-privilege access, audit logging, vendor due-diligence and breach-response playbooks.

11. Contact our Data Protection Officer

For any privacy request, contact our DPO at info@netpaq.co.ke or write to us at the office address above. We will respond within the statutory 30-day window.

12. Changes to this policy

We review this policy at least annually. Material changes will be highlighted on this page and, where appropriate, communicated by email.