Privacy & Data Protection Policy

For the purposes of the United Kingdom General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and the Kenya Data Protection Act, 2019 (regulated by the Office of the Data Protection Commissioner, ODPC), the Data Controller for personal data collected through https://cagneith.com and during direct commercial relationships is Cagneith Limited.

We practice strict data minimization. We only collect information necessary to evaluate, scope, deliver, and secure our B2B consulting and engineering engagements:

• Commercial Inquiry & Contact Data: Full name, corporate email address, telephone number, company name, job title, and project scoping details submitted via our Contact form or direct correspondence.
• Contractual, Billing & KYB Records: Authorized signatory details, statutory tax identifiers (VAT / KRA PIN), purchase orders, and bank remittance references required for statutory accounting and anti-money-laundering compliance.
• Technical & Security Telemetry: IP address, TLS cipher negotiation logs, HTTP request headers, and firewall security telemetry required to protect our web properties against credential stuffing, DDoS, and automated exploitation.

Under Article 6 of the UK GDPR and Section 30 of the Kenya Data Protection Act 2019, we process personal data only where one or more of the following lawful bases apply:

When Cagneith Limited designs, deploys, or maintains operational systems on behalf of a client, such as Port & Gate Automation (ANPR/LPR licence plate recognition, driver biometric/RFID authentication kiosks, QR code document verification, and weighbridge telemetry), Enterprise Data Warehouses, or Zero-Trust Security Enclaves, the client remains the Data Controller and Cagneith acts strictly as a Data Processor under a written Data Processing Agreement (DPA).

In all such engineering deployments: (a) biometric templates, driver identity tokens, and vehicle registration plates are processed exclusively within the client's designated tenancy or on-premise industrial enclave; (b) cryptographic keys are managed via hardware-backed KMS vaults; and (c) Cagneith never sells, mines, or repurposes client operational data across engagements.

As a cybersecurity and automation consultancy, we enforce institutional security controls across our own corporate and engineering environments:

Where personal data is transferred between the United Kingdom, the European Economic Area (EEA), and Kenya, we execute transfers under the UK International Data Transfer Agreement (IDTA) / EU Standard Contractual Clauses (SCCs) and comply with Part VI (Cross-Border Transfers of Personal Data) of the Kenya Data Protection Act, 2019.

We retain commercial inquiry records for 24 months following the last substantive interaction unless converted into an active client contract. Statutory accounting, tax, and executed contract ledgers are retained for 7 years in accordance with UK HMRC and Kenya Revenue Authority (KRA) statutory requirements, after which they are cryptographically purged.

Depending on your jurisdiction, you hold enforceable statutory rights over your personal data, including:

• Right of Access (DSAR)Request a copy of the personal data we hold about you and how it is processed.
• Right to RectificationRequest correction of inaccurate or incomplete personal records.
• Right to ErasureRequest deletion of personal data where no statutory retention duty applies.
• Right to Object / RestrictObject to processing based on legitimate interests or direct B2B outreach.

To exercise any of these rights, email [email protected] with the subject line DATA SUBJECT REQUEST. We respond to all verified requests within the statutory 30-day window (21 days where applicable under Kenya ODPC regulations).