Privacy & Data Protection Policy

1. Statutory Overview & Scope

CypressIQ Technology ("CypressIQ", "we", "our", or "us") operates engineering platforms, turnkey software products including Opero and ITIKIA, and digital consulting services. We are firmly committed to preserving the privacy, dignity, and fundamental constitutional rights of all citizens, volunteers, merchants, and corporate partners.

This Privacy & Data Protection Policy is enacted pursuant to the Data Protection Act, No. 24 of 2019 (Laws of Kenya) and the Data Protection (General) Regulations, 2021 overseen by the Office of the Data Protection Commissioner (ODPC). Where cross-border interactions occur, this policy additionally satisfies standard data protection frameworks including the EU General Data Protection Regulation (GDPR).

2. Data Controller & Data Processor Distinction

Under Section 18 of the Data Protection Act, 2019, CypressIQ maintains distinct legal capacities depending on the product ecosystem:

• CypressIQ as Data Controller: CypressIQ acts as a Data Controller for all direct customer interactions on cypressiq.agency, including newsletter subscriptions, CPQ quote submissions, contact inquiries, client contracts, and employee records.
• CypressIQ as Data Processor (ITIKIA & Opero): For enterprise and campaign deployments of ITIKIA and Opero, the sponsoring campaign organization, candidate secretariat, or commercial enterprise acts as the primary Data Controller. CypressIQ acts strictly as the Data Processor, provisioning hardened infrastructure, cryptographic storage, and pipeline execution solely upon documented instructions.

3. Categories of Personally Identifiable Information (PII)

We adhere strictly to the principle of Data Minimization (Section 3 of the Act), collecting only the minimum information necessary to execute requested operations:

A. General & CPQ Visitors

• Contact details: Full Name, Business Email Address, Phone Number, Organization Name.
• CPQ Scoping Data: Architectural parameters, estimated budget ranges, transaction volume requirements, SLA preferences.
• Technical Telemetry: IP addresses, browser fingerprint, request timestamps, referring URLs.

B. ITIKIA Civic & Campaign Volunteers

• Identity Data: National Identity Card Number (Encrypted), Full Legal Name, Date of Birth.
• Field Telemetry: Mobile Telephone Number, County, Constituency, Ward, and designated Polling Station Name/Code.
• Accreditation Records: Polling agent badge allocations, dual-key verification tokens, training completion status.

C. Opero Commerce & Enterprise Users

• Fiscal Identifiers: Kenya Revenue Authority (KRA) Personal Identification Numbers (PIN).
• Commercial Telemetry: Point-of-sale sales logs, cryptographic invoice control numbers, customer billing contacts.

4. Lawful Basis of Processing & Explicit Consent

Under Section 30 of the Data Protection Act, CypressIQ processes personal data exclusively under one of the following recognized lawful grounds:

• Sec 30(1)(a) Explicit Consent: Clear, affirmative, unbundled opt-in consent provided by the data subject prior to intake.
• Sec 30(1)(b) Contractual Performance: Processing necessary for fulfilling commercial software service level agreements or quote proposals.
• Sec 30(1)(c) Legal Obligation: Statutory reporting requirements, including KRA eTIMS invoice transmission and ODPC disclosure obligations.
• Sec 30(1)(f) Legitimate Interests: Defending against denial-of-service cyberattacks, automated intrusion detection, and system optimization.

5. Special Governance: ITIKIA Campaign & Parallel Vote Tabulation (PVT)

Electoral and political campaign data processing represents an elevated risk profile under Kenya law. ITIKIA incorporates specialized statutory guardrails:

• Unbundled Volunteer Consent: Volunteer signup forms mandate an unbundled opt-in checkbox confirming understanding that contact numbers and polling locations are collected solely for legitimate campaign coordination.
• Dual-Agent Result Verification: Field polling tally submissions require cryptographic dual-agent signing, preventing unilateral manipulation of vote telemetry.
• Pre-Validation & CSV Formula Sanitization: All intake inputs are sanitized before rendering or administrative export to prevent spreadsheet formula injection attacks (e.g. =cmd|).

6. Opero Platform & Fiscal Invoicing Privacy

Opero integrates real-time Point of Sale and ERP workflows with statutory fiscalization authorities, including the Kenya Revenue Authority (KRA) electronic Tax Invoice Management System (eTIMS).

• Transaction records submitted to eTIMS adhere to KRA OSCU/VSCU encryption standards.
• Customer mobile numbers captured for digital receipting are stored in pseudonymized form and are never transmitted to unauthorized third parties.

7. Role-Based Access Control (RBAC) & Anti-Exfiltration Safeguards

In accordance with Sections 72 & 73 of the Data Protection Act (Unlawful disclosure and sale of personal data), CypressIQ enforces hardened architectural controls preventing bulk database exfiltration:

• Immutable Audit Logging: Every administrative inspection, PDF generation, or status modification is permanently recorded in the activity_logs audit table with administrator user ID, role, IP address, and timestamp.
• Field-Level Encryption: Sensitive citizen identifiers, including National IDs, are encrypted at rest using AES-256-GCM authenticated cipher algorithms.
• Edge Origin Shielding: Edge-level web application firewalls (WAF) throttle repetitive scrapers and ban IP addresses attempting brute-force database exfiltration.

8. Rights of Data Subjects Under Kenyan Law

Pursuant to Part IV of the Data Protection Act, 2019, every citizen whose information is ingested into CypressIQ or its powered systems possesses the following enforceable statutory rights:

• Sec 26(a) Right to be Informed: To receive transparent notice regarding how personal data is collected and processed.
• Sec 26(b) Right of Access: To request confirmation and copies of personal data maintained within our systems.
• Sec 26(c) Right to Rectification: To update inaccurate, incomplete, or outdated data fields.
• Sec 26(d) Right to Erasure ("Right to be Forgotten"): To request permanent cryptographic deletion of personal data where processing lacks continued lawful basis.
• Sec 26(e) Right to Object: To object to automated profiling, unsolicited direct marketing, or campaign outreach.
• Sec 26(f) Right to Data Portability: To obtain personal data in a structured, commonly used, machine-readable format.

9. Data Retention & Cryptographic Erasure

Data is retained only for the duration necessary to satisfy specified business, civic, or statutory purposes:

• General Inquiries & CPQ Quotes: Retained for twenty-four (24) months to facilitate enterprise architecture follow-ups, unless earlier erasure is requested.
• ITIKIA Electoral Telemetry: Retained during the active campaign cycle and statutory election petition window (typically 60–90 days following gazettement), after which volunteer contact records are cryptographically sanitized or anonymized.
• Fiscal & Tax Records: Retained for seven (7) years in compliance with Kenya Revenue Authority statutory audit guidelines.

10. Data Protection Officer (DPO) & ODPC Escalation

If you have questions regarding this policy, wish to exercise statutory data rights, or suspect unauthorized data handling, contact our designated Data Protection Officer:

Regulatory Recourse (ODPC Kenya)

You have the statutory right to file a formal complaint with the Office of the Data Protection Commissioner if you believe your personal data has been processed in violation of the Act: