Privacy Policy
Last updated: 29 October 2026
This policy explains how Linchpin Limited uses personal data on this blog. It works alongside the Privacy & Cookie Notice on linchpin.co.ke and follows the Kenya Data Protection Act, 2019 and, where it applies, the EU/UK General Data Protection Regulation (GDPR).
Who we are
Linchpin Limited (“Linchpin”, “we”), Nairobi, Kenya, is the data controller for personal data collected through this blog. You can contact us about your data at [email protected] or through the contact form on this blog.
What we collect, why, and our legal basis
- Contact form: your name, email address, topic and message, so we can reply. Legal basis: your consent (the box you tick) and our legitimate interest in answering enquiries.
- Email subscription: your email address, the time you consented and whether you confirmed. We use a confirmation email (double opt-in) so that nobody can subscribe you without your agreement. Legal basis: your consent. You can withdraw it at any time.
- Security and spam protection: a scrambled (hashed) version of your IP address is kept for up to an hour to limit repeated submissions, and Cloudflare Turnstile may process technical data to tell people from bots. Legal basis: our legitimate interest in keeping the blog secure.
- Server logs: our hosting provider keeps standard technical logs (such as IP address and pages requested) for security and troubleshooting.
- Comments are switched off on this blog, so we do not collect comment data.
We do not sell personal data and we do not use it for advertising.
Cookies and similar technologies
See our Cookie Policy. Cookies that are not strictly necessary are used only with your consent.
Who receives your data
Providers that act on our instructions: Microsoft 365 (Exchange Online), which delivers our emails; Cloudflare, for spam protection and DNS; and our website hosting provider. Where these providers process data outside Kenya or the European Economic Area, we rely on safeguards such as adequacy decisions or standard contractual clauses, as the Kenya Data Protection Act, 2019 and the GDPR require.
How long we keep it
- Contact enquiries: for as long as needed to handle your enquiry and any resulting relationship, then we delete or anonymise them.
- Subscriptions: until you unsubscribe. After that we keep only the minimum needed to remember that you opted out.
Your rights
Under the Kenya Data Protection Act, 2019 and, where it applies, the GDPR, you may ask to access your data, correct it, delete it, restrict or object to its use, receive a copy of it, and withdraw consent at any time without affecting earlier processing. Every subscription email contains an unsubscribe link. To use any other right, email [email protected] and we will respond without undue delay.
Complaints
You may complain to the Office of the Data Protection Commissioner in Kenya (odpc.go.ke) or to your local data protection authority.
Security
We use encrypted connections (HTTPS), limit who can access the data, use spam and abuse protection on our forms, and keep the website software up to date.
Children
This blog is written for businesses and organisations and is not aimed at children under 18.
Changes to this policy
If our practices change we will update this page and the date above.