When you hire an engineering studio to build your web platform, you hand over more than wireframes and brand guidelines. You entrust your commercial roadmap, API secrets, domain credentials, and customer workflows. We treat that trust as an inviolable engineering constraint.
Devaltech operates under a simple standard: we collect only what is strictly required to design, engineer, and deploy your software. We do not sell data, we do not embed invasive cross-site tracking pixels, and we never hold your source code hostage.
We build around your business goals, not ad networks. Your data, code repositories, and credentials remain 100% yours from kickoff to production handover.
The Short Version (Plain English)
Before diving into the statutory clauses, here is what our data protection policy means for your company in day-to-day practice:
- Zero Data Monetization: We will never sell, rent, or trade your contact info, project briefs, or business telemetry to third-party brokers or advertisers.
- Complete Code Ownership: Upon settling your final milestone invoice, you own 100% of all custom source code, design assets, and database schemas.
- No Hidden Trackers: Our websites are built for extreme speed and privacy. We do not inject bloated surveillance scripts or invasive ad retargeting cookies.
- Vaulted Credentials: Any third-party API keys (M-Pesa Daraja, Brevo, AWS, Resend) are encrypted in staging environments and handed over directly upon launch.
Information We Collect
We collect personal and business information only when you voluntarily provide it through our website or direct communication channels:
1. Direct Inquiries & Project Briefs
When you request a quote, submit a 12-point site audit, or book a strategy consultation, we collect your name, business email address, phone number, WhatsApp contact, domain name, and project requirements.
2. Technical Performance Telemetry
To ensure our digital platforms load under 0.8 seconds across Kenyan mobile networks (Safaricom, Airtel) and international broadband, we log anonymous Core Web Vitals (Largest Contentful Paint, Cumulative Layout Shift, server response times). These logs contain no personal identifiers.
3. Production Deployment Credentials
During active builds, clients may provide access to domain registrars (e.g. Kenya Web Experts, Safaricom Domains, Namecheap), cloud hosting providers (Vercel, AWS), or payment gateways. These credentials are used solely for DNS routing and deployment.
How We Use Your Information
Your information is used strictly to fulfill our contractual obligations to you:
- To prepare transparent project proposals, technical scopes, and flexible-price estimates.
- To configure private preview staging URLs where you can test your application in real time.
- To issue official invoices and payment receipts in Kenyan Shillings (KES) or US Dollars (USD).
- To assist with domain propagation, SSL security certificate provisioning, and production handovers.
- To provide ongoing technical maintenance, uptime monitoring, and security patching when retained.
Payment Processing & Financial Security
All financial transactions with Devaltech follow standard commercial escrow and invoicing protocols. Our billing schedule is typically structured as 50% upfront to lock your sprint calendar, and the remaining 50% upon completed handover.
We do not collect or store raw credit card numbers or banking passwords on our web servers. Payments are handled via verified Kenyan banking rails (RTGS/EFT), official M-Pesa Buy Goods/Paybill accounts, or international wire and merchant gateways.
Code Ownership & Intellectual Property
Devaltech works on an absolute ownership model: no proprietary CMS, and no monthly licensing fee just to keep your website live.
Once your final milestone payment is cleared, 100% of the custom codebase, repository access, graphics, and database architectures become your exclusive intellectual property. You have the total freedom to host anywhere, modify anything, or hand the code to another engineer with zero restrictions.
Compliance with Kenya Data Protection Act (2019)
Devaltech complies fully with the provisions of Kenya’s Data Protection Act (2019) and the regulations established by the Office of the Data Protection Commissioner (ODPC), alongside international standards including the European Union GDPR where applicable.
You hold the statutory right to:
- Request a copy of all personal records Devaltech maintains regarding your business.
- Request immediate correction of inaccurate or outdated contact information.
- Request permanent deletion of your project records from our local archives.
- Withdraw consent for email notifications or marketing correspondence at any time.
Data Retention & Vault Security
We retain completed project code repositories and deployment configs securely for 12 months after launch. This ensures rapid disaster recovery should your team accidentally delete a DNS record or corrupt a cloud instance. After 12 months, archives are retained only upon written request under an active maintenance engagement.
Contact Our Data Protection Officer
If you have questions regarding this Privacy Policy, wish to exercise your statutory rights, or require a signed Data Processing Addendum (DPA) for your enterprise, reach out directly:
- Data protection contact
- Devaltech
- [email protected]
- Phone
- +254 768 133 220
- +254 739 958 331
- Address
- Nairobi, Kenya · devaltech.co.ke