Privacy Policy

1. Who we are

Gelom Technologies (“Gelom”, “we”, “us”, “our”) is a managed cybersecurity and data protection company based in Nairobi, Kenya. We act as a data controller for information collected through this website, and as a data processor when we deliver managed security, monitoring and compliance services on behalf of client organisations.

This policy explains how we handle personal data when you visit gtechltd.com, request an assessment, contact us, or engage us as a client. It does not cover how our clients themselves handle the personal data of their own customers or employees, which remains their responsibility as data controllers.

2. Information we collect

We collect information in the following ways.

Information you give us directly

• Name, job title and organisation, when you book a free assessment, contact us, or fill in a form on our website.
• Email address, phone number and WhatsApp number.
• Any details you share about your organisation’s security posture, infrastructure or compliance requirements when requesting an assessment or proposal.

Information collected automatically

• Technical data such as IP address, browser type, device information and general location, collected when you visit our website.
• Usage data such as pages visited, time spent on site and referring pages, typically via cookies or similar technologies.

Information collected while delivering services

Where you are a client, we may collect operational and technical data from your environment (such as log data, alerts and configuration details) strictly to deliver monitoring, detection, response and compliance services under the terms of your service agreement with us.

3. How we use your information

• To respond to enquiries and schedule cyber risk assessments.
• To prepare proposals, quotations and service agreements.
• To deliver, monitor, and improve our managed security and compliance services.
• To send updates about our services, unless you have opted out.
• To meet our own legal, regulatory and contractual obligations, including obligations under the Data Protection Act, 2019.
• To maintain the security and integrity of our own systems and website.

4. Legal basis for processing

Under the Data Protection Act, 2019, we process personal data on one or more of the following bases: your consent, the necessity of processing to perform a contract with you or your organisation, our legitimate interests in operating and improving our business, and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time by contacting us.

5. Sharing and disclosure

We do not sell personal data. We may share information with:

• Trusted technology and service partners who support our security tooling, hosting or communications infrastructure, under confidentiality obligations.
• Professional advisors, such as auditors or legal counsel, where necessary.
• Regulators or authorities, including the Office of the Data Protection Commissioner, where required by law.
• A successor entity in the event of a merger, acquisition or restructuring, subject to the same privacy commitments.

6. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, meet legal or contractual obligations, and resolve disputes. Client operational data collected while delivering services is retained according to the terms agreed in the applicable service agreement, and securely deleted or anonymised thereafter unless a longer retention period is required by law.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your data is being used.
• Access the personal data we hold about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data, subject to legal or contractual limits.
• Object to or restrict certain processing.
• Request data portability, where applicable.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise any of these rights, contact us using the details at the end of this policy.

8. Security

As a cybersecurity company, we hold ourselves to a high internal standard. We use administrative, technical and physical safeguards, including access controls, monitoring and encryption where appropriate, to protect personal data against unauthorised access, loss or misuse. No system is completely secure, and we continuously review and improve our own security posture.

9. Cookies and tracking

Our website uses cookies and similar technologies to remember preferences, understand how visitors use the site, and support basic functionality. You can control cookies through your browser settings. Disabling cookies may affect some website features.

10. International transfers

Where personal data is transferred outside Kenya, for example to a hosting or technology partner, we take reasonable steps to ensure it receives a level of protection consistent with the Data Protection Act, 2019, including the use of contractual safeguards where required.

11. Children’s privacy

Our website and services are directed at businesses and organisations, not children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page shows when it was last revised. Material changes will be highlighted on this page.

13. Contact us

For questions about this policy, or to exercise your rights under the Data Protection Act, 2019, contact us: