Privacy Policy

This section is particularly important to Taristack.

When you engage Taristack Technologies to audit, configure, develop, integrate, automate, maintain, or otherwise work with your business systems, you may provide us with access to business and personal data contained within those systems.

This may include information stored in:

• CRM systems
• Accounting systems
• Inventory systems
• Marketing platforms
• Websites
• Customer databases
• Operational systems
• Business applications
• Spreadsheets and databases
• Analytics platforms
• Custom software
• Other systems relevant to the engagement

Where Taristack processes personal data on behalf of a client, Taristack will process that data only as necessary to provide the agreed services and in accordance with the client's instructions and applicable data protection requirements.

Kenya's Data Protection Act defines a data processor as an entity that processes personal data on behalf of a data controller, and requires appropriate contractual and security arrangements for such processing.

When we access client systems or data, we will only use the information to the extent reasonably necessary to deliver the agreed services.

Depending on the engagement, this may include:

• Conducting a systems or operational audit
• Reviewing data quality
• Identifying process or system issues
• Configuring software
• Developing or modifying systems
• Creating reports or dashboards
• Developing automations
• Testing integrations
• Troubleshooting technical issues
• Migrating or transforming data
• Providing training or support
• Maintaining or improving systems
• Providing other services specifically agreed with the client

We will not use client data for unrelated purposes.

For system, operational, website, or data audits, Taristack may need to access information contained within a client's systems.

Such access will be limited to what is reasonably necessary to conduct the agreed assessment.

Information accessed during an audit will not be used for purposes unrelated to that audit.

Taristack will not:

• Sell client data
• Use client data for advertising
• Use client data to build unrelated products or services
• Use client customer information for its own marketing
• Share client data with unrelated third parties
• Use client data to benefit another client

Where possible, we will recommend or use the least amount of data and level of access necessary to complete the engagement.

This principle is consistent with the data minimisation requirements under Kenya's Data Protection Act.

All non-public information provided to Taristack Technologies in connection with an engagement will be treated as confidential.

This includes, where applicable:

• Business information
• Customer information
• Financial information
• Operational information
• System configurations
• Credentials and access information
• Source code
• Databases
• Reports
• Internal processes
• Commercial information
• Strategic information
• Other information identified as confidential or reasonably understood to be confidential

Taristack will only disclose confidential information where:

• The client has authorised the disclosure
• Disclosure is necessary to provide the agreed service and has been appropriately authorised
• Disclosure is required by law or a lawful authority
• Disclosure is otherwise permitted under the applicable agreement with the client

Where possible, Taristack will use the access method that provides the appropriate level of security and control for the engagement.

Clients may provide access through:

• Named user accounts
• Role-based access
• Temporary access
• Delegated access
• API access
• Other appropriate technical mechanisms

Clients should avoid providing passwords or credentials through ordinary email or unsecured communication channels where a safer access method is available.

Where credentials or access information are provided to Taristack, they will be treated as confidential information and used only for the agreed purpose.

Taristack Technologies takes reasonable technical and organisational measures to protect information against:

• Unauthorised access
• Unauthorised disclosure
• Accidental loss
• Destruction
• Alteration
• Misuse
• Unauthorised processing

Security measures may include appropriate access controls, authentication mechanisms, secure communication methods, limited permissions, device security, and other safeguards appropriate to the nature of the information and the engagement.

The specific security controls applicable to a client engagement may also be defined in the applicable agreement or statement of work.

Kenya's Data Protection Act requires controllers and processors to implement appropriate technical and organisational measures and to identify and address reasonably foreseeable risks to personal data.

Taristack may use trusted third-party technology providers where necessary to operate our business or deliver services.

Examples may include:

• Cloud hosting providers
• Business communication platforms
• Project management tools
• Analytics platforms
• Software development tools
• Email providers
• File storage services
• Automation and integration platforms

We will not intentionally provide client data to a third party for an unrelated purpose.

Where Taristack engages another party to process personal data on behalf of a client, such processing will be subject to appropriate authorisation and contractual arrangements where required.

Under Kenya's Data Protection (General) Regulations, a processor generally requires the controller's prior authorisation before engaging a third party to process personal data.

We do not sell, rent, or trade personal information or client business data for advertising or commercial purposes unrelated to the services we provide.

We retain information only for as long as reasonably necessary for the purpose for which it was collected, to fulfil our contractual obligations, maintain appropriate business records, resolve disputes, comply with legal requirements, or protect our legitimate interests.

Client data

For client engagements, retention of client data will generally be limited to the period necessary to complete the agreed services and any agreed support period.

Following completion of an engagement, Taristack may:

• Return relevant information to the client
• Delete information from systems under Taristack's control
• Retain limited records where required for legitimate business or legal purposes
• Follow a different retention period where agreed contractually with the client

Where a client requires a specific deletion or retention period, this should be defined in the applicable agreement.

For audit engagements, Taristack's use of client data ends when the agreed audit activities have been completed, except where continued retention is:

• Specifically authorised by the client
• Required to provide an agreed follow-up service
• Necessary to maintain contractual or business records
• Required by law

Client data obtained solely for the purpose of an audit will not subsequently be used for unrelated Taristack activities.

If Taristack becomes aware of a security incident involving personal data under our control, we will take appropriate steps to investigate, contain, and address the incident.

Where Taristack is acting as a data processor on behalf of a client, we will notify the relevant client in accordance with the applicable agreement and applicable legal requirements.

Kenya's data protection framework provides specific obligations relating to personal data breaches and oversight by the Office of the Data Protection Commissioner (ODPC).

Client or personal data may, where necessary, be processed or stored using technology providers located outside Kenya.

Where this occurs, Taristack will take appropriate steps to ensure that applicable data protection requirements and contractual obligations are respected.

Kenya's Data Protection Act places requirements on transfers of personal data outside Kenya, including safeguards or consent in applicable circumstances.

Where applicable under Kenyan law, individuals have rights relating to their personal data, including rights to:

• Be informed about the use of their personal data
• Access their personal data
• Object to certain processing
• Request correction of inaccurate or misleading data
• Request deletion of certain personal data

These rights are recognised under Kenya's Data Protection Act.

Where Taristack is processing personal data on behalf of a client, requests relating to that client-controlled data may need to be directed to the relevant client as the data controller.

Our website may contain links to third-party websites or services.

Taristack Technologies is not responsible for the privacy practices, content, or security of third-party websites.

We encourage users to review the privacy policies of third-party services they use.

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or privacy practices.

The updated version will be published on this page with the revised “Last Updated” date.