Privacy Policy

1. Who is responsible for your data

The data controller is Wilson Mbuthia, trading as Wilson Devops, an independent web engineering practice based in Nairobi, Kenya. For anything in this policy — including access, correction or deletion requests — contact:

• Email: info@wilsondevops.com
• WhatsApp: +254 703 639 230
• Postal enquiries: Nairobi, Kenya (full address supplied on request for contracting purposes)

I am not required to appoint a statutory Data Protection Officer, but I do treat data-protection requests as a priority and aim to respond within 7 days and substantively within 30 days.

2. What personal data I collect

2.1 Data you give me directly

• Identity & contact details — your name, email address, phone/WhatsApp number, company name, and country.
• Project information — the brief you send, requirements, technical documentation, brand assets, access credentials for systems I am asked to work on, and any content you provide.
• Commercial records — proposals, quotes, invoices and payment confirmations (payment card numbers are never received or stored by me; they go directly to the payment processor).
• Correspondence — emails, chat messages, call notes and meeting summaries.

2.2 Data collected automatically through this website

• Technical request data — the hosting and security layer records IP address, user agent, requested URL, timestamp and response status in short-lived operational logs to serve the page, block abuse and keep the site available.
• Browser storage — a single local preference key for your colour-theme choice, plus a session-only flag that stops the intro animation replaying on every navigation. Neither is used to identify you. See the Cookie Policy.

2.3 What I do not collect

This site has no contact form, no newsletter, no advertising pixels, no cross-site trackers and no profiling. I do not buy personal data from third parties and I do not sell or rent it to anyone.

3. Why I use your data

• To reply to enquiries and hold a discovery conversation.
• To prepare proposals and quotes, and to agree scope, timeline and price.
• To deliver, test, deploy and support the work you have commissioned.
• To invoice you, keep accounting records and meet Kenyan tax obligations.
• To send project updates, security and maintenance notices for systems I maintain.
• To keep the website and my email operation secure, and to prevent fraud and abuse.
• To send occasional service announcements to existing clients — with an unsubscribe link, and never to cold lists.

I do not use your data for automated decision-making that produces legal or similarly significant effects, and I do not train machine-learning models on your private project data.

4. Legal basis for processing

• Contract — processing needed to quote for and deliver the services you requested.
• Legitimate interests — answering business enquiries, securing the site, and maintaining records, balanced against your rights.
• Legal obligation — retaining invoices and tax records as Kenyan law requires.
• Consent — for optional marketing email, which you can withdraw at any time.

5. Cookies and browser storage

I set no advertising or analytics cookies. The site stores two non-identifying values in your browser (a colour-theme preference in localStorage and a one-session flag in sessionStorage), and the hosting provider may set strictly necessary security cookies. Full details, including how to clear them, are in the Cookie Policy.

6. Who I share data with

I share the minimum necessary, and only with processors who are bound by contract to protect it:

• Hosting & CDN — the site is served through Cloudflare, which processes request data as my hosting and security provider.
• Email & messaging — your email provider and mine, and WhatsApp/Meta when you choose to message me on WhatsApp.
• Payments & accounting — the bank or payment gateway that settles invoices, and my accounting records.
• Project collaborators — freelancers or specialists subcontracted on your project, only where needed and only under confidentiality obligations.
• Authorities — where I am legally compelled to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.

If you contact me through a third-party platform (WhatsApp, LinkedIn, GitHub or X), that platform’s own privacy policy also applies to what you send there.

7. International transfers

Some providers above are located outside Kenya, so your data may be transferred to and stored in the European Union, the United Kingdom or the United States. Where that happens I rely on appropriate safeguards — standard contractual clauses or an equivalent lawful transfer mechanism — and I only use providers that publish security and transfer commitments I can rely on.

8. How long I keep it

• Enquiries that don’t become projects — up to 12 months, then deleted.
• Client contracts and project files — for the duration of the engagement plus 6 years, so I can support the work and defend claims.
• Invoices, tax and accounting records — as long as Kenyan tax law requires (currently at least 5 years).
• Server and security logs — short-lived, typically 24 hours to 30 days, depending on the provider.
• Access credentials you share with me — deleted or handed back at project close, whichever you prefer.

When retention ends I delete or irreversibly anonymise the data, usually by removing it from active systems and allowing provider backups to expire on their normal cycle.

9. How I protect it

• HTTPS everywhere, with HSTS, a strict Content-Security-Policy and other hardened browser headers.
• Encrypted devices, unique passwords, multi-factor authentication and screen locks on every system I use.
• Least-privilege access: I request the narrowest access needed for a task, and use staging environments rather than live systems where possible.
• Secure handling of secrets — credentials, keys and tokens are never committed to a repository or shared over insecure channels.

No system is perfectly secure. If a breach ever affects your personal data, I will notify you and any relevant authority without undue delay, in line with the Kenya Data Protection Act 2019 and, where applicable, the GDPR.

10. Your rights

Subject to the law of Kenya (Data Protection Act 2019, enforced by the Office of the Data Protection Commissioner) and, where it applies to you, the EU/UK GDPR, you may:

• Access the personal data I hold about you.
• Correct anything inaccurate or incomplete.
• Erase data I no longer need a lawful reason to keep.
• Restrict or object to certain processing, including direct marketing.
• Port data you provided, in a structured machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.

Email info@wilsondevops.com with the right you want to exercise. I may ask for proof of identity so I don’t disclose data to the wrong person, and I will respond within 30 days. If you are unhappy with how I handle it, you can complain to the Office of the Data Protection Commissioner (Kenya) or, in the EU/UK, your national supervisory authority.

11. Children

My services are business services and this website is not directed at children. I do not knowingly collect personal data from anyone under 18; if you believe a child has provided data, contact me and I will delete it.

12. Changes to this policy

I version this policy and update the “last updated” date whenever it materially changes. Significant changes affecting existing clients will also be communicated by email. Continuing to use the site or my services after an update means you accept the revised policy.

13. Contact

Questions about this policy, or about anything else on the site:

• Email: info@wilsondevops.com
• WhatsApp: wa.me/+254703639230
• LinkedIn: wilson-mbuthia-k