Privacy Policy

DRAFT pending advocate review. Version 2026-11-14-draft. This text has not yet been approved by a Kenyan advocate and is not final.

1. Who we are (Data Controller)

Duit Technology Limited, a company in Kenya (“Duit”), is the Data Controller of the personal data described here. Data Protection contact: privacy@duitechnology.com. Registered Office: Hardy, Karen-Hardy Road, Karen, P.O. Box 13429 - 00800, Nairobi, Kenya. Principal Operating Address: Santack Estate, Ngong Road, Nairobi, Kenya. Duit Technology Limited processes personal data in accordance with the Data Protection Act, 2019 and the regulatory standards of the Office of the Data Protection Commissioner (ODPC).

2. What we collect, and why

National Infrastructure Careers (engineers, technicians, project managers, surveyors, logistics specialists, RPL-certified artisans): name, phone, county, role category, profession or trade, optional RPL certificate or professional registration number, and your national ID number. The ID number is stored only as a one-way keyed hash, never in readable form. Purpose: match you to project opportunities.
SMEs: business name, sector, county, contact name and phone, financing interest. Purpose: profiling and introductions to contractors and financiers, with your permission.
Tech startups: company and founder name, phone, stage, sector, summary, capital sought, equity stake offered. Purpose: assessing an Equity-for-Growth partnership.
Infrastructure / PPP sponsors: project details, sponsor organisation, contact name and phone, cost and funding targets. Purpose: project review and partner alignment.
Investors: investor type, organisation, contact name, email, phone, ticket size, sectors, thesis. Purpose: vetting and introductions.
People and organisations outside Kenya: your country or jurisdiction, an international (E.164) phone number, and, for individuals, a passport number, which we store only as a one-way keyed hash and never in readable form; optionally a corporate registration or tax ID (for example CAC, CIPC, EIN, EU VAT/HRB or USCC), which our staff can read for due diligence (this may be personal data for a sole trader). We do not verify these documents. Purpose: identifying you, avoiding duplicate records and due diligence.
Off-platform investor prospects: organisation, a public or referred business contact (name and email), investment focus, and a note of where the contact came from. We never scrape or bulk-import contacts. Every message to a prospect is approved by our CEO first, is blinded (no company or founder details) and carries a one-click opt-out. Purpose: introducing relevant opportunities to investors.
Contract signers: name, phone, optional email, a one-time code check, your signature, and the time and hashes needed to prove the signing. Purpose: executing agreements you choose to sign.
Payments: amount (in KES or USD), status, receipt reference and a masked phone number. We do not store card numbers. For card and bank payments through our payment processor Paystack, Paystack requires an email address for the payment receipt. We send Paystack your email only if it is on file and you have verified it (by completing a one-time code sent to that address); otherwise we send our own receipts mailbox (receipts@duitechnology.com), so no email of yours is shared. Paystack processes your payment details under its own privacy terms; we never see your card number. Purpose: processing and receipting the payment you choose to make.

3. Lawful basis

Your explicit consent, given by ticking the box on each form, and, for contracts and payments, performing a contract you enter. You may withdraw consent at any time (section 8). We record which version of this policy you agreed to and when.

4. Who sees it

Only authorised Duit staff. Contact details of founders, sponsors and investors are never published and are not shared with any other party without Duit executive approval and, where required, your agreement. Service providers (hosting, SMS delivery, payments) process data only on our instructions.

4a. Automated matching

We score vetted investors against vetted ventures with fixed rules (sector, ticket size, jurisdiction and stage); no AI provider receives your data for this. No decision is made solely by the machine: a Duit executive approves every match before any notice is shown, and notices show only type, sector, stage, country and an amount band. You may ask us not to be matched.

4B. Non-custodial platform

Duit Technology Limited is a non-custodial technology platform and never holds, pools, or takes custody of client investment funds. We therefore do not collect or store bank, card or wallet credentials for holding funds.

5. Cross-border transfers

Some providers or non-Kenyan investors may be outside Kenya. Cross-border transfers (including EU/German sovereign cloud hosting and international corridor routing) are governed by contractual data-protection safeguards, encryption in transit and at rest, and Section 48 of the Data Protection Act, 2019. We transfer personal data only where permitted by the Data Protection Act, 2019.

6. Retention

Verification hashes, executed KICA Cap 411A agreements, and statutory audit logs are retained for seven (7) years in compliance with Kenyan tax, anti-money-laundering, and commercial record-keeping laws, after which non-statutory records are securely purged. Signed-contract records and audit logs are kept as needed for legal and accountability purposes; the audit log contains no personal contact data.

7. Security

Access controls, separate approval credentials, rate limiting, hashed identifiers, an append-only audit log, and human approval before any investor introduction or contract is issued. No system is perfectly secure.

8. Your rights

Under the Kenya Data Protection Act, 2019 you may ask to access, correct or delete your data, object to or restrict processing, withdraw consent, and request a copy. Email privacy@duitechnology.com. You may also complain to the Office of the Data Protection Commissioner.

9. Children

Our services are for adults. We do not knowingly collect data from children.

10. Changes

We will publish updates here and change the version above. Material changes will ask for fresh consent.