Privacy Policy

1. Who We Are

EcoLynk Creations Ltd (“EcoLynk”, “we”, “us”, or “our”) is a technology and digital solutions company registered in Kenya. We operate the website at ecolynk.co.ke and provide services including web development, mobile apps, AI solutions, cloud infrastructure, UI/UX design, and digital marketing.

Data Protection Officer (DPO): privacy@ecolynk.co.ke | +254 797 916 411 | Nairobi, Kenya.

2. Data We Collect

• Account data: name, email address, phone number, company name, hashed password.
• Project data: briefs, files, and communications shared during service engagements.
• Payment data: billing address, M-Pesa transaction references, Stripe payment tokens (we do not store raw card numbers).
• Usage data: IP address, browser type, pages visited, time on site (via analytics tools, subject to your consent).
• Communications: emails, support tickets, chat messages, and project messages you send us.
• Cookies & tracking: session cookies, analytics cookies (GA4), and preference cookies. See Section 5 for details.

3. How We Use Your Data

• To deliver, manage, and improve our services and client portal.
• To process payments and generate invoices.
• To communicate project updates, milestones, support responses, and transactional emails.
• To send marketing emails (you may unsubscribe at any time via the link in each email).
• To analyse site performance and usage patterns (only with your consent for non-essential cookies).
• To comply with legal obligations under Kenyan and applicable international law.

4. Legal Basis for Processing

• Contract: processing necessary to deliver services you have ordered.
• Consent: analytics cookies, marketing emails.
• Legitimate interests: fraud prevention, security monitoring, service improvement.
• Legal obligation: financial record-keeping, regulatory compliance.

5. Cookies

We use the following categories of cookies:

• Strictly necessary: session authentication, CSRF protection. Always active — no consent required.
• Analytics: Google Analytics 4 — measures page views, traffic sources, and user journeys. Only activated with your consent.
• Preference: stores your UI preferences (e.g. language, cookie consent decision).

You can manage or withdraw cookie consent at any time via our Cookie Policy page.

6. Third-Party Services

We do not sell your personal data. We share data with trusted processors solely to operate our services. Current processors include:

• Stripe — card payment processing (Privacy Policy)
• Safaricom / M-Pesa — mobile payment processing
• AWS / Cloudflare R2 — file and backup storage
• Resend — transactional email delivery
• Google Analytics 4 — website analytics (with your consent)
• Sentry — error monitoring (no PII in error payloads)

All processors are contractually bound to protect your data in accordance with applicable law.

7. Data Retention

We retain personal data for as long as necessary to provide services and comply with legal obligations. Account data is retained for the duration of your active account. Financial records are retained for 7 years in line with Kenyan legal requirements. You may request deletion at any time — see Section 8.

8. Your Rights

As a data subject you have the following rights. Authenticated users can exercise the export and deletion rights directly via the client portal:

• Access: request a copy of all personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure (right to be forgotten): request deletion of your account and all associated data. Authenticated users may use the DELETE /api/v1/users/me/delete endpoint or email privacy@ecolynk.co.ke.
• Data portability (export): download all your data as a JSON file. Authenticated users may call GET /api/v1/users/me/export from the portal.
• Restriction of processing: ask us to pause processing in certain circumstances.
• Object to processing: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: withdraw consent for analytics or marketing at any time without affecting prior processing.

To exercise any right, contact our DPO at privacy@ecolynk.co.ke. We will respond within 30 days.

9. Security

We implement industry-standard security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, bcrypt password hashing, JWT authentication with short-lived access tokens, HTTP-only refresh token cookies, Helmet.js security headers, rate limiting, and regular penetration testing. DDoS protection is provided by Cloudflare.

10. International Transfers

Some of our processors (Stripe, AWS, Resend) store or process data outside Kenya. Where transfers occur to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a prominent notice on our website at least 14 days before the changes take effect.

12. Contact Us