Privacy notice

Who we are

Thrivy Technologies, registered in Kenya in 2019, is the data controller for the personal data described on this page. Thrivy is App Artery’s East Africa arm.

For anything to do with your personal data, including any of the requests set out below, write to us at info@thrivy.co.ke.

What we collect, and why

The contact form on this site has four fields: your name, your email address, what you need (optional, chosen from a short list), and your message. We use them for one purpose, which is to read your enquiry and reply to it.

Those are the four fields you can fill in, and there is no phone, company, budget or attachment field. The form does send one more value with them: a field kept out of sight and out of the tab order that only an automated submission would ever fill in. It asks you for nothing, a submission that fills it is dropped before any mail is sent, and nothing is kept of it either way.

The site sets no cookie, runs no analytics and loads no third party script, and we do not log or store your IP address in any form.

The legal basis we rely on

We rely on one basis and only one: section 30(1)(b)(i) of the Data Protection Act 2019, processing that is necessary in order to take steps at your request before entering into a contract. Sending us an enquiry is that request.

Who receives your message

Your message is handled by two service providers before it reaches our mailbox, and each of them holds it for a while. They are listed here in the order they touch it.

Amazon Web Services

This website, and the code that receives what you send, both run on Amazon Web Services. Your message is taken in first by an Amazon CloudFront edge location, which is chosen by where you are and can be outside Kenya, and is then read by a small function running in the AWS London region, in the United Kingdom. That function checks your message, hands it to Resend and keeps nothing: there is no database, no bucket and no queue behind it. Its logs carry no personal data and are deleted after 30 days.

Resend

Resend, operated by Plus Five Five, Inc., is our processor for sending email. Your message passes through Resend and is stored in the United States. Resend retains the content and metadata of the email for 30 days and then deletes it. There is no data residency option on any Resend plan, so there is no version of this that keeps your message inside Kenya.

Our mailbox

The enquiry arrives at info@thrivy.co.ke, a mailbox hosted on cPanel and a separate recipient from the two above. We keep enquiries there for 24 months, and then delete them.

Sending your data out of Kenya

Every enquiry leaves Kenya, and it leaves more than once. The first destination is the United Kingdom, where the function that receives the form runs; the edge location that takes your message in before that can also sit outside Kenya. The second is the United States, where Resend stores the message.

We rely on one condition for all of it: section 48(c)(i) of the Act, that the transfer is necessary for the implementation of pre-contractual measures taken at your request. What crosses the border is the four fields listed above and nothing more.

How we protect it

Section 29(f) of the Act requires us to describe the security measures we take. These are ours.

• Your message travels over TLS, from your browser to us and from us to Resend.
• Nothing you send is stored on this website or in any database. There is no table, no bucket and no queue holding enquiries: the site is a set of static files.
• The credential that lets us send mail is held as an encrypted parameter that only the function sending your message can decrypt. It is not in the website, not in the code and not in a build log.
• Our logs carry no personal data, and they expire after 30 days.
• There is no analytics, no cookie and no third party script anywhere on this site, so nothing here follows you and there is nothing of yours to leak.

Whether you have to give us this

Giving us your data is voluntary. No law and no contract requires it, and nothing on this site is withheld from you if you keep it to yourself.

The only consequence of not providing it is that we cannot reply, because we would have nothing to reply to and nowhere to send a reply. If you would rather not use the form, write to info@thrivy.co.ke from your own mail client instead. That route reaches the same mailbox without passing through Resend or the infrastructure this website runs on.

What we never do with your data

• We do not profile you.
• We do not use your address for marketing, and we never add it to a mailing list. Section 37 of the Act requires express consent, obtained separately, before a personal address is used for commercial purposes. We do not ask you for that consent and we do not have it.
• We run no analytics and set no third party cookie, here or anywhere on this site.

Your rights

Under section 26 of the Act you have the right:

• to be informed of the use to which your personal data is put;
• to access the personal data we hold about you;
• to object to the processing of all or part of it;
• to have false or misleading data about you corrected;
• to have false or misleading data about you deleted.

Three further rights sit alongside those.

• Objection, section 36. You can object to our processing of your personal data.
• Portability, section 38. You can ask us to give you the personal data you provided, or to transfer it to another data controller. We will act on that within 30 days and at reasonable cost.
• Erasure, section 40. You can ask us to delete or destroy personal data that we are no longer authorised to retain, that is irrelevant or excessive for the purpose we collected it for, or that was obtained unlawfully.

To exercise any of these, write to info@thrivy.co.ke and tell us what you would like done.

Complaints

If you believe we have handled your personal data wrongly, you can complain to the Office of the Data Protection Commissioner, Kenya’s data protection authority. You can do that whether or not you have raised it with us first.