Privacy Policy

1. Introduction

SDFM Group Limited ("SDFM," "we," "us" or "our") designs, builds and deploys custom AI and business systems for companies operating in Kenya and beyond. This Privacy Policy explains what personal data we collect through sdfmgroup.com and our related booking and project-management tools (the "Services"), why we collect it, how we use and protect it, and the choices and rights you have over it.

We are a Kenyan company and our primary legal obligations arise under the Kenya Data Protection Act, 2019 ("Kenya DPA") and its subsidiary regulations, enforced by the Office of the Data Protection Commissioner ("ODPC"). Because our website is publicly accessible, this policy also explains the additional rights available to visitors covered by the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

By using our website or Services, you acknowledge the practices described in this policy. If you do not agree with this policy, please do not use our website or Services.

2. Information we collect

We collect as little personal data as we need to run our business and deliver our Services. Depending on how you interact with us, this may include:

Information you give us directly

• Contact details — name, email address, phone number and job title, for example when you book a discovery call or submit an inquiry.
• Business information — company name, industry, team size and details about your operations and workflows, which you share so we can scope an AI Gap Assessment or a project.
• Project and communications data — messages, files, requirements documents and any other information you provide while we work together, including through project-management tools we use to deliver a Service.
• Billing information — invoicing details and payment records for clients (we do not store full card numbers; these are handled by our payment processors).

Information we collect automatically

• Technical and usage data — IP address, browser type, device information, pages viewed and referring URLs, collected through standard web server logs when you visit our website.
• Advertising and conversion data — if you accept cookies via our cookie banner, the LinkedIn Insight Tag (see Cookies and tracking) shares data about your visit with LinkedIn, such as pages viewed, browser and device information, IP address, and, if you are logged into LinkedIn, certain LinkedIn profile data (for example, job title, company, industry and seniority, in aggregated or hashed form) used to measure ad performance and build advertising audiences. This data is not collected if you decline or have not yet responded to the cookie banner.

3. How we collect information

• Directly from you — when you fill out our discovery-call intake form, email us, or communicate with us during a project.
• Automatically — through standard server logs generated as your browser interacts with our website, and through the LinkedIn Insight Tag running on every page.
• From service providers — such as our hosting and scheduling providers, who process data on our instructions to help us run our website and booking tools.
• From advertising partners — LinkedIn, which independently collects data through the Insight Tag under its own privacy policy when you visit our website.

4. How we use your information

We use personal data only for purposes connected to running our business and delivering our Services, including to:

• Respond to inquiries and schedule discovery calls and AI Gap Assessments;
• Design, build, deploy and support the systems we are engaged to deliver;
• Communicate with you about your project, including updates, invoices and support;
• Maintain the security, integrity and proper functioning of our website and Services;
• Measure the performance of our LinkedIn advertising campaigns and build audiences of people likely to be interested in our Services (see Cookies and tracking);
• Comply with our legal, tax and accounting obligations; and
• Enforce our agreements and protect our legal rights.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data for money.

5. Our legal basis for processing

Under the Kenya DPA and, where applicable, the GDPR, we rely on the following legal bases to process personal data:

• Consent — where you have voluntarily provided information, such as by submitting an inquiry or booking form.
• Performance of a contract — to deliver the Services you have engaged us for, including project work, support and invoicing.
• Legitimate interests — to operate, secure and improve our website and business, provided this does not override your rights and interests.
• Legal obligation — where processing is required to comply with tax, accounting or other applicable laws.

6. How we share information

We do not sell, rent or trade your personal data for money. We share personal data only in the following limited circumstances:

• Service providers — vetted third parties that host our website, manage scheduling/intake, or support project delivery and communications, bound by confidentiality and data protection obligations.
• Advertising partners — LinkedIn Corporation, through the LinkedIn Insight Tag installed on our website, for ad measurement, conversion tracking and audience building. LinkedIn acts as an independent controller of the data it collects through the tag; see Cookies and tracking for details and your opt-out options.
• Professional advisers — lawyers, accountants and auditors, where necessary for their services to us.
• Legal and safety reasons — where disclosure is required by law, regulation, legal process or governmental request, or to protect the rights, property or safety of SDFM, our clients or others.
• Business transfers — if SDFM is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy or a successor policy.

7. International data transfers

We are based in Kenya, but some of our service providers (for example, cloud hosting and scheduling tools) may process or store data outside Kenya. Where we transfer personal data internationally, we take reasonable steps to ensure it receives a level of protection consistent with the Kenya DPA and, where applicable, GDPR requirements for cross-border transfers, such as using providers with appropriate safeguards or standard contractual protections.

8. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy, including to deliver our Services, maintain business records, and meet legal, tax and accounting requirements. Retention periods vary depending on the type of data and our relationship with you — for example, inquiry data from someone who does not become a client is retained for a limited period before deletion, while client project and billing records are retained for the period required by Kenyan tax and company law. When data is no longer needed, we securely delete or anonymise it.

9. How we protect your information

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, including access controls, encrypted connections (HTTPS) and limiting data access to personnel who need it to do their jobs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep your data appropriately protected and to respond promptly to any incident.

10. Cookies and tracking

Our website uses the LinkedIn Insight Tag, a piece of JavaScript provided by LinkedIn Corporation. It allows us to:

• Measure how visitors who click through from our LinkedIn ads interact with our website (conversion tracking);
• Understand the demographics of our website visitors, in aggregated and anonymised form; and
• Build retargeting audiences on LinkedIn of people who have visited our website, so we can show them relevant ads.

The Insight Tag sets cookies in your browser and, where you are logged into LinkedIn, may associate your visit with your LinkedIn account. Where you are not logged into LinkedIn, it does not link browsing data to your identity. LinkedIn processes this data as an independent controller under its own privacy policy, and further detail on the categories of data collected and how LinkedIn uses it is available on LinkedIn's Insight Tag policy page.

Your consent choice

The Insight Tag does not load until you make a choice. On your first visit, a cookie banner asks you to Accept or Reject this tracking:

• If you Accept, the tag loads and the cookies described above are set.
• If you Reject, the tag never loads and no LinkedIn advertising cookies are set on our website.
• Your choice is remembered in your browser so you are not asked again on later visits.

You can change your choice at any time by selecting "Cookie Preferences" in the footer of any page, which reopens the banner. You can also control or opt out of LinkedIn's tracking directly through:

• LinkedIn's own settings — logged-in members can turn off "off-LinkedIn use of my data for ad targeting" in their LinkedIn account settings, and LinkedIn provides a general Insight Tag opt-out for browsers not logged into LinkedIn;
• Your browser — blocking or deleting third-party cookies, or using private/incognito browsing; and
• Industry opt-out tools — such as the Digital Advertising Alliance or Your Online Choices (EU) opt-out pages.

First-party analytics

We also run our own analytics, hosted in our own database, to understand how people find and use our website and booking form. It records pages viewed, time on page, scroll depth, which links and buttons are clicked (by label only), downloads, outbound links, the referring website or campaign (UTM parameters), and your approximate device type, browser, operating system, language and time zone. It does not store your IP address, and it does not record names, email addresses or phone numbers.

• Without consent, visits are counted anonymously. A random session identifier is kept in your browser's session storage only and is deleted when you close the tab.
• If you Accept on the cookie banner, a random visitor identifier is also stored in your browser's local storage so we can tell new visitors from returning ones.
• If you Reject, or your browser sends a Do Not Track or Global Privacy Control signal, no visitor identifier is stored and any existing one is removed.

Aside from the LinkedIn Insight Tag and Meta Pixel (both of which load only if you Accept on our cookie banner) and our first-party analytics, we do not currently use additional analytics or advertising pixels. If we add further tracking tools, we will update this section and gate them behind the same consent mechanism where required by law.

11. Your privacy rights

Under the Kenya DPA, you have the right to:

• Be informed of how your personal data is being used;
• Access personal data we hold about you;
• Request correction of inaccurate or outdated personal data;
• Request deletion of personal data we no longer have a lawful basis to hold;
• Object to or restrict certain processing of your personal data;
• Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal; and
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in the "Contact us" section below. We may need to verify your identity before acting on a request.

12. Additional rights for EU/UK/EEA residents (GDPR)

If you are located in the European Union, United Kingdom or European Economic Area, you have the rights described above plus the right to data portability (to receive certain data you provided us in a structured, machine-readable format) and the right to lodge a complaint with your local supervisory authority in addition to, or instead of, the ODPC. Non-essential tracking such as the LinkedIn Insight Tag only runs after you give consent through the cookie banner described in Cookies and tracking, and you can withdraw that consent at any time via "Cookie Preferences" in the footer.

13. Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, disclose and share; the right to request deletion of your personal information; the right to correct inaccurate personal information; and the right to non-discrimination for exercising these rights. We do not sell personal information for money. Our use of the LinkedIn Insight Tag for ad measurement and retargeting may be considered "sharing" for cross-context behavioural advertising under the CPRA. This tag only loads if you click "Accept" on our cookie banner — selecting "Reject," or later changing your choice via "Cookie Preferences" in the footer, opts you out of this sharing. You may also exercise these rights by contacting us using the details below.

14. Children's privacy

Our website and Services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

15. Third-party links

Our website may link to third-party sites, such as LinkedIn or our booking platform. We are not responsible for the privacy practices of those sites, and we encourage you to review their privacy policies before providing any personal data.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services or applicable law. We will post the updated policy on this page with a revised "Last updated" date. Material changes will be highlighted, where appropriate, through the website or direct communication with active clients.

17. Contact us