Data and privacy
This page sets out, in ordinary language, three things: what personal data comes to me when you write through geokisumu.com, why I hold it, and what the law lets you do about it. I run a small independent wording practice from Kisumu, on the shore of Lake Victoria — there is no sales funnel behind the scenes and no newsletter waiting to collect your address.
Who is responsible
This site is operated by Nalo Odira, a one-person Kisumu practice. For the purposes of Kenya's Data Protection Act, 2019, the data controller for everything described below is the operator of geokisumu.com. Should a privacy matter come up, or should you wish to exercise any of your rights, write to hello@geokisumu.com and I will take it from there.
What the form gathers
When you send the intake form, these details arrive with it:
- Your name and email — the minimum I need to write back to the right person.
- Anything else you choose to include: the business in question, the AI-visibility problem troubling you, and any page, listing, draft profile or link you think the answer should follow. Only the name and email are mandatory; the rest is entirely up to you.
There is a single use for what you send: answering the matter you brought to me. You are never added to any list, and none of your details are sold or passed to third parties. I do record the time each message lands, together with a salted SHA-256 hash of your IP address, and that exists for one reason only — to keep the form from being flooded by bots. The IP address itself is never stored in raw form, nor are browser fingerprints or device metadata.
What I never gather
- No tracking cookies are set. The analytics works without cookies and never tags one visitor apart from the next.
- No remarketing pixels, no advertising-network tags, no marketing-automation scripts are present.
- Nothing here profiles you automatically, and no automated decision carries any legal weight over you.
- Your data is not sold and not shared with commercial partners — that has never been the point of this practice.
The lawful basis
Under Kenya's Data Protection Act, 2019, whatever you submit through the form is processed on the basis of steps taken at your request before any agreement is in place. The IP hash that protects the form rests on a different footing — the legitimate interest of keeping it secure against abuse. Any payment-status data that arises is covered by the contractual basis instead.
Retention periods
- Form messages: while a piece of work is live they stay on file, and for a further 24 months afterwards so the exchange can be traced, then they are removed. A message that never turns into work is kept 12 months and then deleted.
- Payment records: held for precisely as long as tax and accounting law requires, and cleared once that period ends.
- IP hashes: kept for 90 days — enough time to fend off abuse — and deleted after that.
- Email threads: retained for the life of the work, or until 24 months after the last message, whichever of the two comes later.
Rights you can use
Kenya's Data Protection Act, 2019 gives you the right to access your data, to correct or delete it, to object to how it is processed, and to learn the way it is being used. One message to hello@geokisumu.com is enough to start any of these, and a reply will follow within a reasonable time. If you believe your data has been mishandled, you are always free to bring the matter to the Office of the Data Protection Commissioner.
Where data lives
The servers that serve this site sit in European Union (Germany). Where additional processors (email provider) work from outside Kenya, any such transfer relies on standard contractual clauses alongside whatever safeguards the receiving party publishes.
Updates to this notice
Any time the way data is handled changes in a real sense, this notice is revised to match. The wording that applies now is the one marked by the "Updated" date at the top of the page. A meaningful change stays signposted on the home page for 30 days so that people who return will notice it.