Privacy Policy

Last updated 27 October 2026. This policy explains how Basal Systems Limited (“Basal Systems”, “we”, “us”), a company registered in Kenya, collects, uses and protects personal data when you use this website or contact us. We comply with the Data Protection Act, 2019 and the regulations made under it.

1. Who is responsible for your data

Basal Systems Limited, based in Mombasa, Kenya, is the data controller for personal data collected through this website. Our full company details appear in every proposal and agreement.

Data protection contact: privacy@basalsys.com.

When we process data inside a client’s systems as part of a project, the client is the data controller and we act as a data processor under a written data processing agreement. This policy does not cover that work.

2. What we collect

Contact form: your full name, email address, the service you are interested in, project stage, timeline, budget range and the message you write. Please do not include passwords, access keys or other secrets in the form.

Calls and email: anything you choose to share when you book, attend or follow up on a call, including notes we take about your project.

Technical data: your IP address, browser and device type, pages requested and timestamps, recorded in server and hosting logs for security and reliability.

We do not knowingly collect special categories of personal data (such as health, biometric or children’s data) and ask that you do not send us any.

3. Why we use it, and our lawful basis

To respond to your enquiry, scope an audit, prepare a proposal and arrange calls. Our basis is taking steps at your request before entering a contract, and your consent when you submit the form.

To deliver and administer an engagement, including invoicing and record keeping. Our basis is performance of the contract and compliance with legal obligations such as tax and accounting law.

To keep this website and our systems secure, detect abuse and fix faults. Our basis is our legitimate interest in running a secure service, balanced against your rights.

We do not sell personal data, use it for advertising, or make decisions about you by automated means.

4. Who we share it with

Only with service providers that help us run the site and our business, and only what they need: Formspree (processes contact form submissions and forwards them to us), our email provider, Cal.com (call scheduling), our website hosting provider and our accountants and legal advisers where needed. They are bound by confidentiality and data protection terms.

We may also disclose data where the law requires it or to protect our legal rights, for example in response to a lawful order from a court or regulator.

5. Transfers outside Kenya

Some of our providers, including Formspree and Cal.com, may process data outside Kenya. Where that happens we rely on the safeguards the Data Protection Act allows, such as contractual data protection terms with the provider, and on your consent where it is required. You can avoid the form by emailing us directly at hello@basalsys.com, though our email provider may also process data outside Kenya.

6. How long we keep it

Enquiries that do not become a project: up to 12 months, then deleted or anonymised.

Clients: for the life of the engagement and then for 7 years to meet tax, accounting and legal obligations, after which the records are deleted or anonymised.

Server and hosting logs: up to 90 days unless needed to investigate a security incident.

If you ask us to delete your data sooner, we will do so unless the law requires us to keep it.

7. How we protect it

Security is how we work. Access to personal data is limited to the engineers and staff who need it. We use encryption in transit, access controls and least-privilege permissions, and we review our own systems for weaknesses. No system is completely secure, but we apply safeguards appropriate to the risk.

8. Personal data breaches

If a breach is likely to put your rights at risk, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it where feasible, and will tell affected people without unreasonable delay, as the Data Protection Act requires.

9. Your rights

You have the right to be informed about how we use your data, to access it, to correct inaccurate data, to have it deleted, to object to or restrict processing, to receive a copy of data you gave us in a portable format, and to withdraw consent at any time. Withdrawing consent does not affect processing that already took place.

To exercise a right, email privacy@basalsys.com. We may need to confirm your identity first, and we will respond without undue delay and within the time limits set by law.

If you are unhappy with how we handle your data, please tell us first so we can fix it. You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke).

10. Cookies

This website uses only essential browser storage that it needs to work, such as keeping the navigation menu working. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner. If that changes, we will update this policy and ask for your consent before setting them. You can block or delete cookies in your browser settings; the site will still work.

11. Children

This website is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

12. Links to other sites

This site may link to websites we do not control. We are not responsible for their content or privacy practices.

13. Changes to this policy

We may update this policy and will change the date above when we do. For material changes we will make the update clear on this page.