1. Policy Statement

Arybit Technologies is committed to protecting the privacy, confidentiality, and security of personal and organizational data entrusted to us by clients, partners, employees, users, and stakeholders. We recognize that responsible data management is essential for maintaining trust and enabling secure digital transformation.

Arybit Technologies applies privacy-by-design principles throughout the development and operation of our systems. Our privacy practices are designed to align with the Kenya Data Protection Act, 2019, GDPR principles where applicable, and international best practices.

2. Purpose & 3. Scope

This policy defines how Arybit collects, processes, and protects data, manages privacy risks, and supports individual data rights. It applies to all employees, contractors, partners, and clients, and covers all data processed through our AI platforms, software, cloud services, and internal systems.

4. Privacy Principles

5. Types of Data We Process

Depending on the services provided, Arybit may process Business Information, Personal Information (e.g., names, contact details), Technical Information (e.g., system logs), and Geospatial/Environmental Data.

6. Data Processing Activities

Arybit may process data for providing technology services, developing software, operating AI platforms, customer support, system administration, security monitoring, research, and meeting compliance obligations.

7. Artificial Intelligence & Data Responsibility

Arybit recognizes that AI systems require responsible data governance. Our AI development practices include responsible data usage, data quality assessment, privacy considerations during design, and human oversight for important decisions. We design AI systems to support human decision-making, not replace accountability.

8. Data Security Measures

Arybit applies technical and organizational safeguards including:

• Access Controls: Role-Based Access Control (RBAC), user authentication, and least-privilege access.
• Encryption: Encryption of data during transmission (TLS) and encryption of stored sensitive data (AES-256).
• System Security: Secure software development practices, vulnerability management, security monitoring, and secure infrastructure configuration.

9. Data Sharing and Disclosure

Arybit does not sell personal data. Data may only be shared when necessary for delivering contracted services, supporting approved integrations, or meeting legal obligations. Where third parties process data on our behalf, appropriate confidentiality and security obligations apply.

10. Third-Party Service Providers

Arybit may use trusted technology providers for cloud infrastructure, software platforms, and development tools. These providers are selected based on their security practices, reliability, and data protection capabilities.

11. International Data Transfers

Where services involve international infrastructure, Arybit considers applicable data protection requirements, contractual obligations, and data residency needs. For sensitive deployments, we support private, hybrid, and on-premise models.

12. Data Subject Rights

Where applicable, individuals may have rights including the right to access, correct, or request deletion of their personal information. Requests should be submitted through official Arybit communication channels.

13. Data Retention

Arybit retains information only for as long as necessary based on contractual, legal, operational, and security requirements. When no longer required, data is securely deleted or anonymized.

14. Data Breach Management

Arybit maintains procedures for identifying, responding to, and managing potential data breaches. The process includes detection, assessment, containment, investigation, notification where required, and recovery.

15. Privacy by Design

Privacy considerations are integrated into our solution development lifecycle, including secure architecture design, data minimization, and responsible AI practices.

16. Client Responsibilities

Clients using Arybit solutions are responsible for providing lawful instructions for data processing, ensuring appropriate permissions for supplied data, and protecting user credentials.

17. Employee Responsibilities

Personnel must protect confidential information, follow security procedures, avoid unauthorized disclosure, and report suspected privacy incidents.

18. Compliance Alignment

Arybit Technologies aligns its privacy practices with the Kenya Data Protection Act, 2019, GDPR principles, and ISO/IEC 27001 information security principles. Where formal certifications have not been obtained, references indicate alignment with principles rather than certified compliance.

19. Policy Review

This policy is reviewed annually, after significant technology changes, following privacy incidents, or upon regulatory updates.

20. Contact

For privacy-related inquiries, please contact us at:

Arybit Technologies
Nairobi, Kenya
Website: https://arybit.co.ke
Email: info@arybit.co.ke
Telephone: +254 720 989818

---

Document Control & Approval

Document Title: Data Protection & Privacy Policy
Document Number: DPP-001
Version: 1.0
Effective Date: July 2026
Next Review: July 2027
Owner: Founder & Principal Consultant