Privacy Policy

1. About Cryosoft Corporation

Cryosoft Corporation ("Cryosoft", "we", "us", or "our") is a registered business enterprise incorporated in the Republic of Kenya under Business Registration Certificate Number: BN-9PCGED8Y.

Cryosoft provides software development services, custom digital solutions, mobile and web applications, cloud technologies, and IT consultancy across Africa and internationally. This Privacy Policy governs your use of our primary website (cryosoft.co.ke), related web applications, project portals, communication channels, and customer support touchpoints.

We are committed to processing your personal data lawfully, fairly, and transparently, in compliance with the Data Protection Act, 2019 (Act No. 24 of 2019 of the Laws of Kenya) and international best practices (such as the General Data Protection Regulation - GDPR, where applicable).

2. Information We Collect

We collect personal information that you provide to us directly, as well as data gathered automatically through your device when interacting with our digital channels:

A. Personal Data Provided Directly by You

• Contact Information: Your full name, email address, telephone/mobile number, company name, and job title when submitting inquiries, requesting quotes, or corresponding with our team.
• Inquiry & Support Messages: Any details, project briefs, specifications, or feedback you submit via our online contact form, email (info@cryosoft.co.ke), WhatsApp, or Telegram.
• Customer & Account Details: Billing address, contractual details, and authorized representative credentials provided during client onboarding.

B. Data Collected Automatically

• Device & Connection Data: Your Internet Protocol (IP) address, operating system, browser type and version, language settings, and screen resolution.
• Usage Data: Navigation paths, pages viewed, time spent on each section, referral source (how you arrived at our website), and timestamp logs.

C. Payment & Billing Information

When you make payments for services or voluntary contributions (such as via M-Pesa, bank transfer, or Buy Me a Coffee), payment confirmation identifiers, timestamps, and receipt records are collected to credit your account. Cryosoft does not store sensitive payment credentials, credit card numbers, or mobile money PINs on our servers. All card and mobile transactions are handled by PCI-DSS compliant and Central Bank of Kenya licensed payment providers.

3. How We Use Your Information

Cryosoft Corporation utilizes collected data for specific, lawful purposes:

• Fulfilling Service Agreements: To build, deploy, host, and maintain software, websites, and IT solutions commissioned by you or your organization.
• Communication & Support: To respond promptly to inquiries, provide quotes, send project milestones, and deliver technical support.
• System Security & Diagnostics: To protect our applications against unauthorized access, malicious attacks, security breaches, and software defects.
• Performance Optimization: To analyze usage trends, improve user experience, and optimize website responsiveness.
• Legal & Regulatory Compliance: To satisfy tax, invoicing, auditing, and corporate statutory obligations in Kenya.

4. Legal Basis for Data Processing

In accordance with Section 30 of the Kenya Data Protection Act, 2019, we process personal data under the following lawful grounds:

5. Cookies & Tracking Technologies

Our website uses cookies and similar web storage technologies to improve responsiveness, remember your preferences, and track aggregate usage statistics.

• Strictly Necessary Cookies: Required for the fundamental operation of the website, session handling, and security.
• Performance & Analytics Cookies: Allow us to quantify visits and traffic sources so we can evaluate and elevate site performance.

You can configure your web browser settings to block or notify you about cookies. Please note that disabling essential cookies may impact certain functionality of our web applications.

6. Third-Party Sharing & Disclosures

Cryosoft Corporation does not sell, lease, or monetize your personal data. We disclose personal data only under the following limited circumstances:

• Service Providers & Infrastructure Partners: We work with trusted technology partners who provide essential infrastructure (such as cloud hosting, database services via Supabase, content delivery networks, email delivery, and customer messaging tools like WhatsApp/Telegram). These partners are contractually bound to maintain strict confidentiality and security.
• Legal & Law Enforcement Demands: We may disclose data if required in good faith by a competent court of law, statutory body, or regulatory authority under the Laws of Kenya.
• Business Transfers: In the event of a merger, corporate restructuring, or asset reorganization, customer information may be transferred as an operational business asset, subject to continuing confidentiality.

7. Data Retention Policy

We retain personal data only for the period necessary to accomplish the purposes set out in this Privacy Policy, unless a longer retention duration is mandated or permitted by applicable Kenyan statutory law (such as statutory book-keeping, financial audits, or ongoing dispute resolution).

When personal data is no longer needed, it is securely deleted, overwritten, or irreversibly anonymized in accordance with our data sanitization procedures.

8. International Data Transfers

While Cryosoft Corporation is based in Kenya, some cloud service providers, code repositories (e.g. GitHub), or database services may host data across servers located in international jurisdictions.

Whenever cross-border transfers occur, we ensure compliance with Part VI (Transfers of Personal Data Outside Kenya) of the Kenya Data Protection Act, 2019, including ensuring appropriate safeguards, robust encryption, and contractual data protection agreements with all cloud vendors.

9. Security Safeguards

We implement comprehensive technical and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, accidental loss, or destruction:

• Encryption in Transit: End-to-end TLS/HTTPS encryption across all web traffic and API integrations.
• Access Restrictions: Strict role-based authentication, principle of least privilege, and regular credential cycling.
• Environment Hardening: Regular vulnerability scanning, dependency updates, automated firewalls, and server monitoring.

While we employ industry-standard defenses, no method of transmission over the Internet or electronic storage is 100% impenetrable. In the event of an identified personal data breach, we will notify affected individuals and the Office of the Data Protection Commissioner (ODPC) in accordance with Section 43 of the Kenya Data Protection Act.

10. Your Rights & Choices

Under the Kenya Data Protection Act, 2019 (Sections 26 – 40), you are endowed with distinct rights regarding your personal data:

11. Children's Privacy

Our commercial services, digital software tools, and website are not directed to children under the age of 18. We do not knowingly collect or solicit personal information from minors. If you believe that a minor has provided us with personal information without parental or guardian consent, please contact us immediately at info@cryosoft.co.ke, and we will promptly purge such records.

12. Changes to This Policy

We may periodically update this Privacy Policy to reflect modifications in our software offerings, operational workflows, or regulatory directives. When material changes occur, we will update the "Effective Date" at the top of this document. We encourage you to review this page periodically to stay informed about our privacy safeguards.

13. Contact & Grievance Redress

To exercise any of your data rights, request clarification, or submit an inquiry regarding our data handling practices, please reach out to our team: