Privacy policy

Who we are

OraForge Tech Company (“OraForge”, “we”, “us”) is an independent software studio based in Nairobi, Kenya. We design and build production software for organisations across Africa and beyond.

For personal data collected through this website, OraForge is the data controller. That means we decide why and how that information is processed.

Privacy contact: hello@oraforgetech.com. Postal enquiries may be addressed to OraForge Tech Company, Nairobi, Kenya.

Scope

This policy covers personal data processed through this website, including contact and lead forms, cookie preference choices, and ordinary server logs created when you visit.

Client project work is governed by a separate statement of work or master services agreement. Those contracts may include additional privacy terms for systems we build or operate on your behalf.

What we collect

We collect only what we need to run the site and respond to you:

• Enquiry details you submit — name, email address, telephone number, company (if provided), service interest, budget range, and project description
• Consent records for form submissions and cookie preferences, including the time of your choice
• Technical logs from our hosting provider — IP address, browser type, pages requested, and timestamps — used for security and reliability
• Preference values stored in your browser (for example cookie consent and whether you dismissed the enquiry prompt), which are not used to track you across other sites

What we do not collect

We do not sell personal data. We do not buy marketing lists. We do not run advertising networks on this site.

We do not load third-party analytics, advertising, social, or font CDNs that would let another company set trackers through our pages unless you have accepted analytics cookies and we have enabled that tooling.

Fonts used on this site are self-hosted. Maps, video embeds, and chat widgets from third parties are not embedded by default.

Why we process your data

We process personal data for these purposes and legal bases:

• Responding to project enquiries and scheduling discovery — your consent, and where an engagement follows, performance of a contract
• Operating and securing the website — legitimate interests in keeping the service available and protecting it from abuse
• Remembering cookie and interface preferences — your consent for non-essential categories; necessity for essential preferences
• Meeting legal, tax, and accounting duties that apply to our business in Kenya

Cookies and similar technologies

We use a small number of cookies and browser storage keys. Essential ones remember your cookie choice and keep basic site functions working. Analytics and advertising categories stay off unless you accept them.

Details are in our Cookie policy. You can change your mind at any time via the cookie banner’s “More choices” controls, or by clearing site data in your browser.

How long we keep it

Enquiries that do not become a client engagement are kept for up to 12 months, then deleted or anonymised, unless you ask us to keep talking sooner or longer.

Records needed for active or completed client work — contracts, invoices, and project correspondence — are kept for seven years to meet Kenyan tax and commercial record-keeping expectations, or longer if a dispute is open.

Server logs are retained according to our host’s rotation settings, typically no longer than 90 days unless needed to investigate an incident.

Cookie preference records in your browser remain until you clear them or update your choice.

Who else sees it

We use service providers who process data on our instructions as processors — for example website hosting, email delivery, and (if configured) a form endpoint that receives enquiries. They may only use the data to provide those services to us.

We do not share enquiry data with unrelated third parties for their marketing. We may disclose information if required by Kenyan law, a court order, or to protect our rights, users, or the public from harm.

If we transfer personal data outside Kenya, we take steps appropriate to the destination — including contractual safeguards — so that the data remains protected to a standard consistent with the Kenyan Data Protection Act 2019 and, where applicable, UK/EU GDPR expectations.

Your rights

Under the Kenyan Data Protection Act 2019, and where UK or EU GDPR applies to you, you may request access to your personal data, correction of inaccurate data, deletion, restriction of processing, objection to certain processing, and portability of data you provided to us.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

Email hello@oraforgetech.com with “Privacy request” in the subject. We aim to respond within 30 days. You may also complain to the Office of the Data Protection Commissioner in Kenya, or to your local supervisory authority if you are in the UK or EEA.

Children

This website is aimed at business decision-makers. We do not knowingly collect personal data from children under 18 through this site. If you believe a child has submitted information to us, contact hello@oraforgetech.com and we will delete it.

Security

We use HTTPS for this site, limit access to enquiry data to people who need it to respond, and prefer vendors who support encryption in transit. No method of transmission or storage is perfectly secure; if we become aware of a personal-data breach that must be notified, we will do so as required by applicable law.

Changes

We will update this page when our practices or the law change, and revise the “Last updated” date. Material changes will be reflected here before new processing begins where that is required.