PRIVACY*

Dullu Digital ("DDi") builds focused software that is sold one time and owned by you. This page tells you what data we collect, why we collect it, and how to ask us to delete it.

We collect only what we need to operate: (1) Information you give us through forms — contact messages (name, email, message), demo requests, and newsletter signups. (2) A work-role label (founder / manager / sales), stored only in your own browser via localStorage — never sent to us. (3) Anonymous analytics about your visit (pages viewed, clicks, country, device type) via PostHog. (4) Cookies — see below.

To respond to your enquiries, to operate and improve our products, to send you the resources you requested, and to comply with Kenyan tax and business law. We do not sell your data. We never share it with third parties except where the law requires or where a specific service provider (for example an email provider) is needed to run our products.

Transactional emails — like a reply to an enquiry — are sent because you requested them. Marketing emails (product news, guides, offers) are sent only if you opt in on our forms. Each marketing email carries an unsubscribe link, and opting out takes effect immediately. We record your consent when you submit a form, and your choices are respected across every list.

Messages sent through the contact page are emailed to us and stored as a lead record (name, email, message). We keep these to respond to your enquiry and improve our products.

Nothing tracks you until you say yes. On your first visit we ask permission: Accept loads privacy-focused analytics (PostHog); Decline leaves both off entirely — the site works exactly the same either way. Change your mind anytime with the Cookies link in the footer. We do NOT use Google Analytics, Facebook Pixel, or any ad-tech tracker.

Under the Kenya Data Protection Act 2019 and the EU GDPR, we process your data on the basis of (a) your explicit consent (forms, cookies) and (b) legitimate interest (responding to enquiries and operating our products). You have the right to access, correct, delete, or port your data at any time.

Contact and enquiry records are kept for 36 months unless you ask us to delete them sooner. Anonymous analytics events are retained for 12 months. Once deleted, data is permanently removed from our active systems (backups are purged within 30 days).

Every byte moves over TLS (HTTPS everywhere, HSTS preloaded) and rests encrypted at rest. The site ships strict security headers — content-security-policy, frame-ancestors none, same-origin opener policy — and every form endpoint is rate-limited, validated, and spam-shielded. Access to records is restricted to the team behind authentication.

Email hello@dullugroup.co.ke with subject 'Data request' and one of: ACCESS, CORRECT, DELETE, EXPORT. We respond within 7 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (https://www.odpc.go.ke).

We will post any material change here with at least 14 days notice and notify you by email if we have one on file. Last updated: September 2026.