Data Retention Policy — NgenoTech Global

1. Purpose

NgenoTech Global is committed to responsible data management in compliance with the Kenya Data Protection Act, 2019. This policy explains what data we collect, how long we retain it, and how it is disposed of securely.

2. Scope

This policy applies to all personal data processed by NgenoTech Global, including data collected through:

Our website (ngenotechglobal.co.ke)
User account registration
Software purchases and downloads
Customer support communications
Marketing and newsletter subscriptions

3. Data Retention Schedule

Data Category	Retention Period	Legal Basis
Account information (name, email, password hash)	Duration of account + 12 months after deletion request	Contract performance
Purchase and payment records	7 years	Kenya Tax laws (Income Tax Act)
Download access logs	3 years	Legitimate interest / license verification
Customer support emails	3 years	Legitimate interest
Marketing consent records	Until consent withdrawn + 1 year	Consent
Website analytics data (anonymised)	26 months	Legitimate interest
Security and access logs	12 months	Legitimate interest / security
User action logs (admin audit trail)	2 years	Legitimate interest

4. Data Deletion

When the retention period expires or when a valid deletion request is received (and no legal retention requirement overrides it), data is deleted or anonymised using secure methods:

Database records are permanently deleted (not just soft-deleted)
Backup copies containing the data are overwritten within 30 days of scheduled deletion
Anonymised analytics data may be retained indefinitely as it cannot be linked to an individual

5. Data Subject Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

Access: Request a copy of your personal data we hold
Correction: Request correction of inaccurate data
Deletion: Request erasure of your data (where no legal retention requirement applies)
Portability: Receive your data in a machine-readable format
Object: Object to processing based on legitimate interest

Requests are processed within 30 days. To make a request, contact us at info@ngenotechglobal.co.ke.

6. Security of Retained Data

All retained data is protected with appropriate technical and organisational measures:

Database encryption at rest
HTTPS for data in transit
Hashed and salted passwords (bcrypt)
Role-based access controls — only authorised staff can access personal data
Regular security audits

7. Third-Party Processors

Where data is processed by third parties on our behalf (e.g. payment gateways, email providers), we ensure those parties maintain equivalent or higher data protection standards and do not retain data beyond what is necessary.

8. Policy Review

This Data Retention Policy is reviewed annually or when there are significant changes to applicable laws or our data processing activities. The current version supersedes all previous versions.

9. Contact & Complaints

NgenoTech Global — Data Protection
Nairobi, Kenya
Email: info@ngenotechglobal.co.ke
Phone: +254 723 148 223

You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.