CraftDuka Limited (“CraftDuka”, “we”, “us”, or “our”) is a software development and AI automation agency based in Nairobi, Kenya. We are responsible for the personal information described in this policy when we decide how and why it is processed.
This policy is provided for transparency and should be read together with any service-specific notices or agreements we give you.
01 Scope
This policy applies when you visit craftduka.com, contact us, request a proposal, join a waitlist, apply for a role, become a client, or otherwise interact with CraftDuka. It does not govern a client’s own products or services that we build or support. Where we process information solely on a client’s instructions, that client is responsible for its privacy practices and we act as its service provider or data processor.
02 Information we collect
Depending on how you interact with us, we may collect:
- Contact and identity information, such as your name, email address, phone number, company, and job title.
- Project and business information, including your requirements, budget, business size, website, areas of interest, messages, and files you choose to share.
- Commercial information, such as proposals, contracts, billing details, transaction records, and our communications with you.
- Technical and usage information, such as IP address, approximate location, device and browser type, referring pages, pages viewed, clicks, session activity, and cookie or similar identifiers.
- Recruitment information, such as your CV, portfolio, employment history, and other information submitted with an application.
We collect information directly from you, automatically through our website, from organisations you represent, and from public or professional sources where permitted by law. Please do not send us sensitive personal information unless we specifically request it and explain why it is needed.
03 How we use information
We use personal information to:
- respond to enquiries, prepare proposals, and provide requested services;
- manage client relationships, projects, payments, and support;
- operate, maintain, secure, and improve our website and services;
- understand website performance and how visitors use our content;
- measure campaigns and communicate relevant services, where permitted;
- review job applications and manage recruitment;
- detect fraud, misuse, security incidents, or technical problems; and
- meet legal, regulatory, tax, accounting, and contractual obligations.
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you.
04 Legal bases for processing
We process personal information only where we have a lawful basis. This may be your consent; taking steps at your request or performing a contract; compliance with a legal obligation; protection of vital or public interests; or our legitimate interests, such as operating our business, improving our services, securing our systems, and communicating with prospective and existing clients, where those interests are not overridden by your rights.
If we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.
07 International data transfers
Some providers or team members may process information outside Kenya. Where personal information is transferred internationally, we take steps designed to ensure an appropriate level of protection, such as using contractual safeguards, transferring to a jurisdiction with adequate protection, or obtaining consent where required by the Kenya Data Protection Act, 2019 and other applicable law.
08 Data retention
We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining business and tax records, resolving disputes, enforcing agreements, and meeting legal requirements. Retention periods vary based on the type of information, our relationship with you, and applicable law. When information is no longer required, we delete, anonymise, or securely isolate it.
09 Data security
We use reasonable administrative, technical, and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration, or disclosure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your information or interaction with us is no longer secure, please contact us promptly.
10 Your privacy rights
Subject to applicable law, you may have the right to be informed about our use of your information; request access to it; ask us to correct or delete inaccurate or unlawfully held information; object to or restrict processing; withdraw consent; request data portability; and complain to a data protection authority.
To exercise a right, email us at info@craftduka.com. We may need to verify your identity before responding. Rights may be limited where an exemption applies, and we will explain our decision where required. If you are in Kenya, you may also lodge a complaint with the Office of the Data Protection Commissioner.
11 Children’s privacy
Our website and services are intended for businesses and are not directed to children. We do not knowingly collect personal information from a child without the consent of a parent or guardian where that consent is required. If you believe a child has provided information to us improperly, please contact us so we can take appropriate action.
12 Third-party links
Our website may link to websites, platforms, or services we do not control. Their privacy practices are governed by their own notices. We encourage you to review those notices before providing personal information.
13 Changes to this policy
We may update this policy to reflect changes in our services, practices, or legal obligations. We will post the revised version on this page and update the effective date. If a change is material, we may provide an additional notice where appropriate.
14 Contact us
Questions, requests, or concerns about this policy or our handling of personal information can be sent to:
Last updated: 21 September 2026
Talk to our team