Plain-English summary
We collect the minimum we need to operate the Service and reply to you. We never sell your data. You can ask us to delete it any time.
Legal · Privacy
Privacy Policy
Last reviewed 2026-05-01 · version 1.0
> Launch placeholder — pending legal review. This document is a good-faith placeholder prepared for the 2026 launch of Gwinto Cloud. It has not yet been reviewed by a qualified legal professional and should be validated against the laws of the Republic of Kenya before being relied on.
1. Who we are
Gwinto (the "Data Controller") operates the Gwinto Cloud platform from Nairobi, Kenya. Company details appear in our [Imprint](/legal/imprint).
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email, phone, role | To create your account and authenticate you |
| Customer data | Company name, tax/registration id, billing address | To bill correctly and meet legal requirements |
| Operational data | Records, content, and files you upload to your apps | To run the Service for you |
| Diagnostic data | IP address, browser, timestamps | Security, abuse prevention, debugging |
| Communications | Contact-form submissions, support tickets | To reply to you and improve the product |
3. Lawful basis
We process personal data under Kenya's **Data Protection Act, 2019 on the bases of (a) performance of a contract** (running the Service), (b) legitimate interests (security, abuse prevention, product analytics in aggregate), and (c) consent for non-essential cookies and the newsletter.
4. Sharing + sub-processors
We share personal data only with sub-processors that help us deliver the Service. The current sub-processor list is published at [/legal/subprocessors](/legal/subprocessors) and we notify existing customers before adding a new one.
We never sell personal data and never share it for advertising.
5. Data location and international transfers
We host Customer Data with reputable cloud providers and aim to keep it within suitable, secure data centres. Where a sub-processor processes data outside Kenya, we rely on an appropriate transfer safeguard as required by the Data Protection Act, 2019 and any guidance from the Office of the Data Protection Commissioner (ODPC). The transfer mechanism for each is noted in the [sub-processor list](/legal/subprocessors).
Where you use the Service to handle the personal data of individuals in other regions (for example EU end users), you remain responsible for meeting any additional obligations that apply to you, such as the GDPR.
6. Retention
- Account + customer data: kept for the lifetime of the account.
- Operational data: kept while you're a customer; 30 days after
termination, then permanently deleted.
- Audit logs: 24 months from the event date, then deleted.
- Marketing communications: kept until you unsubscribe.
- Diagnostic data: 30 days rolling window.
7. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be informed of the use of your personal data
- access the personal data we hold about you
- request correction or deletion
- object to or restrict processing
- data portability (CSV / JSON exports are built into the dashboard)
- lodge a complaint with the Office of the Data Protection
Commissioner (ODPC)
To exercise these rights, email [legal@gwinto.com](mailto:legal@gwinto.com). We respond within the timeframes set by the Data Protection Act, 2019.
8. Cookies
We use a small set of strictly-necessary cookies to keep you logged in and remember your theme preference. Analytics and marketing cookies are opt-in only and explained in the [Cookie Policy](/legal/cookies).
9. Changes
We notify you of material changes by email (account holders) and by banner on the next dashboard sign-in. The "last reviewed" date at the top of this page tracks any change.
10. Contact
[legal@gwinto.com](mailto:legal@gwinto.com) for any privacy question or rights request.
Questions about this policy? Email legal@gwinto.com or use the contact form.