Privacy Policy

Blueflag Digital (“we”, “us”) provides domain registration, web hosting and professional email services to businesses and healthcare facilities in Kenya. This policy explains what personal data we collect when you use our website and sign-up process, why we collect it, and what rights you have over it.

We process personal data in line with the Data Protection Act, 2019 (Kenya) and the regulations made under it.

Who we are

Blueflag Digital
Syokimau, Mombasa Road, Nairobi, Kenya
Email: sales@blueflagdigital.co.ke

For any question about this policy or your data, contact us at the address above. If we appoint a Data Protection Officer, their contact details will be published here.

What we collect

When you place an order

• Organisation or facility name, and sector
• Your name, email address and phone number
• The domain name and mailbox addresses you request
• The package you select and the amount payable
• Your IP address, recorded for fraud prevention and rate limiting

When you pay

Card and M-Pesa payments are processed by Paystack. Your card number, CVV, PIN and M-Pesa credentials are entered on Paystack’s own secure checkout and are never seen by, transmitted to, or stored on our systems. We receive only a transaction reference, the amount, the currency and whether the payment succeeded.

When you contact us

Your name and email address, the service you are interested in and your message, plus your phone number, organisation and budget range if you choose to give them. We email your enquiry to our sales inbox and send you a confirmation; we do not add you to a mailing list.

Automatically

Standard web server logs (IP address, browser type, pages requested, timestamps). Cloudflare Turnstile is used to distinguish humans from bots on our forms; it does not track you across other websites.

We use the Meta Pixel (Meta Platforms) to measure how visitors from our Facebook and Instagram adverts use this site and to show our adverts to relevant people. It sets cookies in your browser and sends Meta the pages you view and when you send our contact form (not the contents of your message). You can block it with your browser’s tracking-protection settings or through your Facebook ad preferences.

Why we use it, and on what basis

Purpose	Lawful basis
Register your domain and provision your mailboxes	Performance of a contract
Take payment and issue receipts and invoices	Performance of a contract
Contact you about your order, setup and renewals	Performance of a contract
Respond to an enquiry you send through our contact form	Consent, given on the form
Keep accounting and tax records	Legal obligation
Prevent fraud and abuse of our sign-up and contact forms	Legitimate interest
Send marketing about our other services	Consent — you may withdraw it at any time

Who we share it with

We share the minimum necessary with the providers that deliver the service:

• Domain registrar / registry — registrant details must be supplied to register a domain. For .ke domains this means KeNIC; for .com, the relevant ICANN-accredited registry. Some of these details may appear in the public WHOIS record.
• Hosting and email provider — to create and run your mailboxes.
• Paystack — to process payments.
• Brevo — to deliver transactional email such as order confirmations, contact-form enquiries and their acknowledgements.
• Cloudflare — Turnstile checks that a form submission comes from a person, not a bot.
• Government authorities — where we are legally required to disclose.

We do not sell your personal data, and we do not share it for anyone else’s marketing.

Where your data is held

Order records are stored on our servers. Some of our providers process data outside Kenya. Where that happens, we rely on the safeguards permitted under section 48 of the Data Protection Act, 2019, including contractual protections with those providers.

How long we keep it

• Order and billing records: seven years, to meet Kenyan tax and accounting requirements.
• Abandoned sign-ups that never became orders: cancelled after 7 days and deleted within 12 months.
• Contact form messages: 24 months.
• Server and security logs: 12 months.

Security

Our site is served over HTTPS. Payment card data never reaches our infrastructure. Access to order records requires authentication, and our order database is not reachable from the public web. No system is perfectly secure, but if a breach affects your rights we will notify you and the Office of the Data Protection Commissioner as the Act requires.

A note for healthcare facilities

We provide domain, hosting and email infrastructure. We do not process patient records, and our services are not a clinical system. If you use email we provide to send patient information, you remain the data controller for that information and are responsible for handling it lawfully — including under the Health Act, 2017 and the Data Protection Act, 2019.

Your rights

Under the Data Protection Act, 2019 you have the right to be informed about how your data is used, to access it, to have inaccurate data corrected, to have data erased where the law allows, to object to processing, and to request that we stop sending you marketing. To exercise any of these, email sales@blueflagdigital.co.ke. We will respond within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner at odpc.go.ke.

Changes

If we change this policy we will update the date at the top of this page. Where a change materially affects you, we will email you.