Last updated: 20 May 2026 · Effective date: 20 May 2026
1. Who we are
Arton Technologies ("Arton", "we", "our", "us") is a business process and digital transformation consulting firm registered in Kenya. Our registered office is at Kilimanjaro Road, Upperhill, Nairobi, Kenya.
We are the data controller for personal data collected through this website (arton.co.ke) and our contact channels. We process personal data in accordance with the Kenya Data Protection Act 2019 and any applicable regulations issued thereunder.
2. Data we collect
2.1 Data you provide directly
- Contact form: name, company, work email address, phone number, and the content of your message.
- Email capture (CTA): your email address when you submit an enquiry via our quick-contact widget.
- Correspondence: any information you include in emails or calls to our team.
2.2 Data collected automatically
- Server logs: IP address, browser type, operating system, referring URL, pages visited, and timestamps. These are standard web-server logs retained for security and diagnostic purposes.
- Cookies: see the Cookies section below.
We do not collect sensitive personal data (special category data) through this website. If an engagement requires the processing of sensitive data, that is governed by a separate data-processing agreement.
3. How we use your data
- To respond to your enquiry or brief — the primary reason you contact us.
- To send an auto-acknowledgement confirming receipt of your message.
- To follow up on a proposal, engagement, or demo request you have initiated.
- To comply with legal obligations (e.g., record-keeping under Kenyan tax law).
- To improve this website and diagnose technical issues using anonymised server logs.
We do not use your data for automated profiling or automated decision-making that produces legal or significant effects.
4. Legal basis for processing
- Contractual necessity: processing needed to take pre-contractual steps at your request (responding to a brief).
- Legitimate interests: maintaining server logs for security and site improvement — balanced against your privacy interests.
- Legal obligation: retaining records as required by Kenyan law.
- Consent: where we send marketing emails, we will obtain your explicit consent and you may withdraw it at any time.
5. Sharing and disclosure
We do not sell, rent, or trade your personal data. We share data only in these limited circumstances:
- Service providers: our email and hosting infrastructure providers who process data on our behalf under appropriate data-processing agreements.
- Professional advisers: lawyers, auditors, or insurers under strict confidentiality obligations.
- Legal requirement: where we are required to disclose by court order, law, or regulatory authority.
- Business transfer: in the event of a merger or acquisition, your data will transfer subject to the same privacy protections.
6. Retention
- Contact enquiries: retained for up to 3 years from last contact, then securely deleted unless an engagement has commenced.
- Engagement records: retained for 7 years in line with Kenyan statutory requirements.
- Server logs: retained for 90 days then purged.
- Marketing consent records: retained until consent is withdrawn.
7. Your rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your data where there is no compelling reason for us to continue processing it.
- Restriction — ask us to restrict processing in certain circumstances.
- Portability — receive your data in a structured, commonly-used format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any right, contact us at info@arton.co.ke. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya.
8. Cookies
This website uses a strictly necessary cookie to store your cookie consent preference. We do not use tracking, advertising, or analytics cookies by default.
- arton_consent — stores whether you have dismissed the cookie notice. Expires after 1 year. Essential for the consent banner to work.
If we add analytics in the future (e.g., Google Analytics), we will update this policy and seek your consent before setting any non-essential cookies.
9. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, or destruction. These include TLS encryption for data in transit, access controls, and regular security reviews. No internet transmission is entirely secure; we cannot guarantee absolute security but we take all reasonable precautions.
10. Children
This website is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.
11. Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page with an updated "Last updated" date. We encourage you to review this page periodically.
For privacy-related queries, requests, or complaints: