Privacy Policy — Medjay Digital Solutions

Pending final sign-off. The substance of this policy is final; the fields shown as [bracketed] are completed once our company is registered in Kenya, after which a Kenyan advocate confirms the wording. Until then it is published for reference only.

Last updated: 25 July 2026

This Privacy Policy explains how [Medjay Digital Solutions legal entity name] ("", "we", "us") handles personal information when you visit our website or get in touch. We operate from Kenya [registered address] and, once incorporated, are registered under company number [company registration no.]. We handle personal data in line with the Kenya Data Protection Act 2019 and, depending on where you are, the EU/UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and Canada's PIPEDA and anti-spam law (CASL). Wherever you live, we apply the same core standard: collect only what we need, be clear about why, and honour your choices.

What we collect

Enquiry details you give us — your name, company, email, phone (if you provide it), and anything you write in the message field of our contact or pricing forms.
Basic technical data your browser sends automatically — such as IP-derived approximate location, device and browser type — used only to keep the site secure, fast and working.
Site-usage & analytics data — which pages you view, how you arrived (the referring link), and general device/browser information, so we can understand and improve the site. This is collected by our own cookieless page-view counter and, with your consent, by Google Analytics — which sets cookies and may associate your visit with information Google holds. See Analytics & measurement below.

We ask for no more than we need, we do not run advertising or profiling, and we never sell your data.

Cookies

We keep cookies to a minimum. Essential cookies (set by our hosting provider) are needed for security and basic functionality and are always on. Analytics cookies — specifically Google Analytics — are optional and are set only if you accept them in our cookie banner; you can change your choice at any time via Cookie settings in the footer. We use no advertising or profiling cookies, your browser lets you block or delete cookies at any time, and we honour your browser's "Do Not Track" signal.

To be precise about how this works: the Google Analytics tag is present on every page, but it runs in Google's Consent Mode with analytics and advertising storage set to denied by default. Until you accept, it writes no cookies and creates no identifier for you — it sends only an anonymous, cookieless signal that a page was viewed, which cannot be linked to you or to your other visits. If you accept, that consent is passed to Google and full analytics measurement begins; if you decline, the denied state simply stays in place.

Analytics & measurement

We measure how the site is used in two ways:

Our own page-view count — a lightweight, cookieless, first-party measure (which page, and the referring link) that stays in our own systems and does not identify you. We rely on our legitimate interest in keeping the site working and improving it, and we do not run it when your browser sends a "Do Not Track" signal.
Google Analytics — loaded on every page in Consent Mode with storage denied by default, so before you accept it sets no cookies and no identifier and sends only an anonymous cookieless page signal to Google, which we rely on our legitimate interest to send and which cannot be tied to you. Full analytics runs only with your consent. When enabled it sets cookies and collects usage information (pages viewed, approximate location from a truncated IP, device/browser and interactions) and shares it with Google LLC, which processes it on our behalf and may associate your visit with information Google holds about you. IP addresses are anonymised where the feature is available, and Google may transfer data to the United States and other countries under its own safeguards. You can decline or withdraw consent at any time (Cookie settings in the footer), install Google's opt-out browser add-on, or block cookies in your browser.

Our lawful basis for analytics cookies — including any association of your visit data with Google's information — is your consent, which you can withdraw at any time without affecting your use of the site.

How we use it

To respond to your enquiry and, if it progresses, to prepare and discuss a proposal.
To keep a record of our correspondence and any agreement that follows.
To send you marketing only if you have separately opted in — never by default, and you can unsubscribe at any time.

Our lawful bases are your consent (which you can withdraw), and our legitimate interest in responding to enquiries and running our business.

Where it goes

Your enquiry is stored in our own customer-relationship management system. To run the site and reach you, we rely on a small number of trusted service providers who process data on our behalf under their own safeguards:

Cloudflare — website hosting, security and content delivery.
Render — hosting for our CRM, where enquiries are stored.
Google — our business email, and (only with your consent) Google Analytics for website-usage measurement.

Some of these providers operate servers outside Kenya; where data is transferred abroad, we rely on providers that offer appropriate contractual and technical protections. We never sell your data, and we do not share it for anyone else's marketing.

How long we keep it

If an enquiry does not lead to us working together, we keep it for up to 24 months and then delete it. Where we do go on to work together, we keep the relevant records for as long as the relationship lasts and for the period afterwards required to meet our legal, tax and accounting obligations, then delete them.

Your rights & choices

Whoever and wherever you are, you can ask us to access the personal data we hold about you, correct or complete it, delete it, restrict or object to how we use it, receive a portable copy of what you gave us, and stop any marketing. Just write to md@medjaydigital.com and we'll action it — free of charge, normally within 30 days. We never make you accept marketing to get a reply.

Depending on where you live, you also have specific protections:

EU / UK (GDPR). Our lawful bases are your consent (which you can withdraw at any time) and our legitimate interest in answering enquiries and running our business. You can complain to your local data-protection authority.
California (CCPA/CPRA). You have the right to know what we collect and why, to delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information, and we will never discriminate against you for exercising a right.
Canada (PIPEDA & CASL). You may access and correct your information and withdraw consent. We send commercial electronic messages only with your express opt-in, and every message includes an unsubscribe link.
Kenya (Data Protection Act 2019). You may exercise the rights above and, if unsatisfied with our response, complain to the Office of the Data Protection Commissioner (ODPC) of Kenya.

Contact

Questions about this policy, or about your data? Email md@medjaydigital.com, or write to us at [registered address, Kenya].