Privacy Policy
Last updated: July 2026 · Governing law: Republic of Kenya
This policy explains how CodeUnit collects, uses, and protects your personal data. It is written in compliance with the Kenya Data Protection Act 2019 (No. 24 of 2019) and reflects GDPR-equivalent principles for international visitors.
1. Who we are
CodeUnit is a personal portfolio and digital products platform operated by an independent developer based in Mombasa, Kenya. We are the data controller for personal information collected through this website.
Contact: admin@codeunit.dev
2. What data we collect and why
When you register an account
- Name and email address — to create and identify your account
- Hashed password — we never store your actual password, only a bcrypt hash
- Email verification status and timestamp
- Last login date and IP address — for your security (helps detect unauthorised access)
When you make a purchase
- Name, email, and phone number — to process and confirm your order
- Payment gateway used (M-Pesa, Stripe, or PayPal) and payment reference — we do not store card numbers, PINs, or full M-Pesa account details
- Order total, items purchased, and download history
- IP address at time of purchase — for fraud prevention
When you subscribe to the newsletter
- Email address and optional name
- Confirmation status and timestamp
- IP address at time of subscription
When you submit a contact or inquiry form
- Name, email, and message content
- IP address — for spam prevention
When you visit any page
- Page URL and referrer — for analytics (understanding which content is popular)
- IP address and approximate location
- Browser and device type
- We respect the Do Not Track (DNT) browser signal — if you have DNT enabled, we do not record your page views
When you leave a comment
- Name, email, and comment content
- IP address
- All comments require manual approval before they appear on the site
3. Legal basis for processing (Kenya DPA 2019 / GDPR)
| Purpose | Legal basis |
|---|---|
| Processing your purchase and delivering downloads | Performance of a contract |
| Sending order confirmations and download links | Performance of a contract |
| Sending newsletter emails | Consent (double opt-in confirmation) |
| Responding to contact and inquiry messages | Legitimate interest |
| Security monitoring, fraud prevention, rate limiting | Legitimate interest |
| Page view analytics | Legitimate interest (anonymised, DNT respected) |
| Audit logging of admin actions | Legitimate interest (operational security) |
4. Third parties we share data with
We do not sell, rent, or trade your personal data. We share limited data only with the payment processors required to complete your transaction:
| Service | What is shared | Their privacy policy |
|---|---|---|
| Safaricom (M-Pesa) | Phone number, amount, order reference | safaricom.co.ke |
| Paystack | Email, amount, transaction metadata | paystack.com/privacy |
| PayPal | Name, email, amount, order ID | paypal.com/privacy |
We may also disclose data if required by Kenyan law, a court order, or to prevent fraud or protect the rights of others.
5. Cookies
We use only essential cookies — no advertising or tracking cookies from third parties.
| Cookie | Purpose | Duration |
|---|---|---|
portfolio_sess | Session authentication — keeps you logged in | 24 hours or browser close |
remember_me | Optional persistent login when "Remember me" is ticked | 30 days |
We do not use Google Analytics, Facebook Pixel, or any external tracking scripts. Our analytics are self-hosted and privacy-respecting.
6. Data retention
| Data type | Retention period |
|---|---|
| User accounts | Until you request deletion, or 2 years of inactivity |
| Purchase records and order history | 7 years (required for financial record-keeping) |
| Newsletter subscriptions | Until you unsubscribe |
| Contact and inquiry messages | 2 years |
| Comments | Until deleted by admin or requested by commenter |
| Page view analytics | 90 days (auto-purged by scheduled cleanup) |
| Server and audit logs | 30 days (auto-purged by scheduled cleanup) |
7. Your rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — ask us to correct inaccurate data (you can also update most data yourself in your profile)
- Deletion — request that we delete your account and personal data (except purchase records required for financial compliance)
- Restriction — ask us to stop processing your data in certain ways
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent — unsubscribe from the newsletter at any time using the link in any email
- Object — object to processing based on legitimate interest
To exercise any right, email admin@codeunit.dev with the subject "Data Request". We will respond within 21 days as required by the Act.
8. Security
We implement industry-standard security measures including:
- All passwords hashed with bcrypt (never stored in plain text)
- HTTPS encryption for all data in transit
- HttpOnly and SameSite session cookies
- Rate limiting on login and form submissions
- PHP execution blocked in the uploads directory
- All sensitive files protected from direct web access
In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of it, as required by the Kenya Data Protection Act.
9. International transfers
Our website is hosted in a shared hosting environment. When you pay via Stripe or PayPal, your payment data is processed on servers located outside Kenya. These processors maintain their own GDPR and international data transfer compliance. M-Pesa transactions are processed within Safaricom's Kenyan infrastructure.
10. Children
This website is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify registered users by email. Continued use of the site after changes constitutes acceptance of the updated policy.
12. Contact and complaints
For any privacy concern or to exercise your rights, contact us at: admin@codeunit.dev
If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.