Data Processing & Controller Statement

1. Data Controller Information

Bochie LTD (trading as Bochie Creative Solutions) acts as the data controller for personal information processed in connection with our services.

Registered Address:Uhuru Estate, Rabai road, Nairobi P.O. Box 51360 - 00200
Email: info@bochie.co.ke
Phone: +254722241161 / +254700099705
Registration: Registered company in Kenya

2. Types of Data We Process

As a data controller, we process the following categories of personal data:

Client Data

• Contact information (name, email, phone, address)
• Business information (company name, role, industry)
• Project requirements and communications
• Payment and billing information
• Contract and legal documents

Website Visitor Data

• IP addresses and device information
• Browser and operating system details
• Website usage patterns and analytics
• Cookie and tracking data

Project-Related Data

• Technical specifications and requirements
• User data for applications we develop (when applicable)
• Testing and development data
• Performance and monitoring data

3. Security Measures

We implement comprehensive security measures to protect personal data:

Technical Safeguards

• Encryption of data at rest and in transit
• Secure access controls and authentication
• Regular security updates and patches
• Firewall and intrusion detection systems
• Secure backup and recovery procedures

Organizational Measures

• Staff training on data protection
• Access controls based on need-to-know principle
• Regular security assessments and audits
• Incident response and breach notification procedures
• Confidentiality agreements with staff and contractors

4. Data Processors

We may engage third-party processors to help us provide our services. All processors are carefully selected and bound by data processing agreements. Current processors include:

Hosting and Infrastructure

• Vercel (website hosting and deployment)
• Cloud service providers (as specified per project)
• Content delivery networks

Analytics and Marketing

• Google Analytics (website analytics)
• Meta/Facebook (advertising and analytics)
• Email service providers

Payment Processing

• Payment gateway providers
• Banking and financial institutions
• Accounting and invoicing services

Note: Specific processors may vary based on project requirements and client preferences. We maintain an updated list of all active processors.

5. International Data Transfers

Some of our processors may be located outside Kenya. When transferring personal data internationally, we ensure appropriate safeguards are in place, including:

• Adequacy decisions by relevant authorities
• Standard contractual clauses
• Binding corporate rules
• Certification schemes

6. Data Subject Rights

As a data controller, we respect and facilitate the following rights:

• Right of access to personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Client project data: 7 years after project completion (for legal and business purposes)
• Marketing data: Until consent is withdrawn or 3 years of inactivity
• Website analytics: 26 months (Google Analytics default)
• Financial records: As required by Kenyan law (typically 7 years)

8. Breach Notification

In the event of a personal data breach, we will notify relevant authorities within 72 hours where required by law. Affected individuals will be notified without undue delay if the breach is likely to result in high risk to their rights and freedoms.

9. Contact for Data Requests

For all data protection inquiries, requests to exercise your rights, or concerns about our data processing, please contact us at:

Data Protection Contact
Bochie LTD (trading as Bochie Creative Solutions)
Email: info@bochie.co.ke
Uhuru Estate, Rabai road, Nairobi P.O. Box 51360 - 00200
Phone: +254722241161 / +254700099705

We will respond to all requests within 30 days and provide assistance in exercising your data protection rights.

10. Updates to This Statement

This Data Processing & Controller Statement may be updated to reflect changes in our processing activities, legal requirements, or business practices. Updates will be posted on our website with a revised date.