Privacy policy

1. Data we collect

Through this website we collect only what you give us via the contact form — name, email address, company, and your message — plus standard server logs (IP address, user agent, requested pages). We do not run advertising trackers. Data processed inside client ERP deployments is governed by the engagement contract and data processing agreement, not this policy.

2. Lawful basis and purpose

We process enquiry data to respond to you (legitimate interest and steps prior to a contract) and engagement data to perform the contract. We do not use your data for unrelated marketing without consent.

3. Data security

We employ industry-standard encryption (AES-256 at rest, TLS 1.3 in transit), role-based access controls, and immutable audit trails. We do not claim certifications we do not hold; our security controls are documented in the security overview, available on request via sales@coale.tech.

4. Retention

Enquiry records are retained for up to 24 months unless an engagement follows, in which case they form part of the engagement record. Server logs are retained for 90 days. We delete or anonymise data when the retention purpose ends, unless law requires longer retention.

5. Sharing

We do not sell personal data. We share it only with service providers needed to operate this website and our business (for example email and hosting providers), each bound by appropriate agreements. A current subprocessor list is available on request.

6. International transfers

Where data is stored depends on the deployment model agreed with each client — on-premise, private cloud, or CoaleTech-hosted. Any cross-border transfer of personal data is subject to the safeguards set out in the applicable data processing agreement and the Kenya Data Protection Act, 2019.

7. Your rights

Under the Kenya Data Protection Act, 2019 you may request access to, correction of, or deletion of your personal data, and object to processing. Write to sales@coale.tech. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

8. Data processing agreement

A DPA template covering our processing on your behalf is available on request, alongside our security overview, data-residency statement, and subprocessor list.

9. Contact

Privacy enquiries: sales@coale.tech, CoaleTech, Nairobi, Kenya.