1. Who we are
Assure is a product of Deltacraft. Deltacraft is registered as a data controller with the Office of the Data Protection Commissioner (ODPC) in Kenya, under the Data Protection Act 2019.
Contact for any privacy matter: info@deltacrafthq.com.
2. Two different roles, and why it matters
This policy covers two separate things, and our obligations differ between them:
| Context | Our role | Governed by |
|---|---|---|
| This website | Controller | This policy |
| Data your organisation puts into the Assure platform (risks, findings, staff records, evidence) | Processor, acting on your instructions | Your service agreement and its data processing terms, not this policy |
If you are an employee of an organisation that uses Assure and you want to exercise rights over data held in the platform, your employer is the controller. Contact them first. We will support them in responding, and the platform has a data subject request workflow for exactly that purpose.
3. What this website collects
Very little, by design. This site sets no cookies, runs no analytics, and loads no third-party scripts, pixels or embeds. Typefaces are served from our own domain rather than fetched from a font provider, so your browser makes no third-party request when you read these pages. See our Cookie Policy for detail.
What we do process:
- Anything you send us by email. If you click a “request a demo” or contact link, your mail client opens and you choose what to send. We receive your address, your name if you give it, and the content of your message.
- Standard server logs. Our hosting provider records the usual technical information needed to serve and secure a website, including IP address, user agent, requested page and timestamp. We do not use these to build a profile of you.
4. Lawful basis
- Legitimate interest for operating and securing the website, and for responding to an enquiry you initiated.
- Performance of a contract where we are in discussion about, or already providing, services to your organisation.
- Legal obligation where retention or disclosure is required of us by law.
5. Who we share it with
We do not sell personal data, and we do not share it for advertising. We use a small number of service providers to operate: a hosting provider, and an email provider for correspondence. Each processes data on our instructions under a written agreement.
Where the Assure platform is deployed inside your own infrastructure, your operational data does not reach us at all.
6. Transfers outside Kenya
Where a provider processes data outside Kenya, we rely on the transfer conditions in Part VI of the Data Protection Act 2019 and put appropriate safeguards in place. For platform deployments, data residency is a deployment decision: self-hosted installations keep all processing and storage inside the boundary you choose.
7. How long we keep it
- Enquiry correspondence: for as long as the conversation is live, and then for up to 24 months in case you come back to us, unless you ask us to delete it sooner.
- Server logs: short operational periods set by our hosting provider, typically measured in weeks.
- Contractual records: for the period required by Kenyan tax and company law.
8. Your rights
Under the Data Protection Act 2019 you have the right to be informed, to access your personal data, to have inaccurate data corrected, to have data erased, to object to processing, to restrict processing, and to data portability. You can also withdraw consent where consent was the basis for processing.
To exercise any of these, email info@deltacrafthq.com. We will respond within the statutory timeframe. If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner.
9. Security
Data in transit is protected with TLS 1.3 and data at rest with AES-256. Within the platform, tenant data is isolated by database-level row security, access is governed by role-based permissions, and every mutating action is written to a cryptographically chained audit log. More detail is on our security page.
No system is perfectly secure. If you believe you have found a vulnerability, please tell us at info@deltacrafthq.com before disclosing it publicly, and we will work with you.
10. Children
This website and the Assure platform are business tools. They are not directed at children, and we do not knowingly collect personal data from children through them.
11. Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. Material changes affecting customers will also be communicated directly.