Privacy notice

Who we are

XELQ Ltd, company registration PVT-5JUED9LZ, 14 Ring Road Parklands, Nairobi, Kenya. Write to [email protected] or call +254 738 250 260. One address and one number cover privacy, support and security questions.

XELQ Ltd is registered with the Office of the Data Protection Commissioner as a data processor for the payroll software, Registration No. 705-703B-EC94. For enquiries sent through this website we act as the data controller.

What this website collects

We measure how this website is used. We do not know who you are unless you fill in the contact form or the subscribe box. Three things do the measuring:

• Cloudflare Web Analytics counts visits. It sets no cookies, follows you to no other website and tells us nothing that identifies you.
• Google Analytics tells us which pages are read and what people do next. It sets cookies in your browser (names beginning _ga) so that a second page you read is counted as the same visit as the first.
• Microsoft Clarity records how the page was used — scrolling, clicks, and a replay of the pointer moving over the page — so we can see where a page confuses people. It sets cookies too (_clck, _clsk). It does not record what you type into the contact form.

There is still no advertising anywhere on this site, and nothing here is sold to anybody. If you switch the site between light and dark, that one choice is remembered in your own browser’s local storage — it never reaches us and is not a cookie. The fonts load from our own server. The contact page also loads Cloudflare’s spam check (Turnstile). The film on the home page is a still picture until you press play; press it and the player is loaded from YouTube, which is the only moment anything of yours reaches them.

You can stop all of it. Every one of these tags honours your browser’s tracking-protection settings, and blocking cookies or using a content blocker leaves the rest of this site working exactly as it does now — nothing on it needs the measurement to run.

If you use the contact form, we receive:

What	Why
Your name	To address you properly in a reply
Your company	To prepare for the conversation
Number of people on payroll	To know whether the product fits before we take your time
How you run payroll now	To make the first call useful
An email address or phone number	To reply
Anything you type in the notes box	Because you chose to tell us
Which page of this site you arrived on, and the address of the page that linked you here	To know which page is doing the work. It travels inside your enquiry email and is kept nowhere else

Our server also sees your IP address in the moment of submitting, as every web server does. We do not record it.

If you subscribe to updates

The box at the foot of every page takes one thing: an email address. We use it to send a short email when a statutory rate or a filing date changes, and now and then one about Pesa Sahihi itself. Nothing else is collected with it, and nothing is inferred from it.

The address goes straight to Flodesk, the service that sends those emails, in the United States, into a list kept for this website alone. It is not stored here. Every email carries an unsubscribe link and using it removes you at once; writing to [email protected] does the same. We keep the address until you do one of those.

The legal basis

Your consent: the box you tick on the contact form, or pressing Subscribe under an address you typed yourself. You can withdraw it at any time by writing to [email protected], and withdrawing it does not affect anything we did while it was given.

Where it goes

The contact form sends your message to our [email protected] mailbox, and the subscribe box sends your address to Flodesk. This website has no database and keeps no copy of either. The companies involved:

• Cloudflare hosts this site and runs the spam check on this form (Turnstile). To tell a person from a bot it looks at your IP address and signals from your browser. Cloudflare states it is not used to track you or to build an advertising profile, and it sets no cookies.
• Resend turns the form into an email and delivers it. That happens in the United States.
• Flodesk keeps the list of addresses from the subscribe box and sends those emails, from the United States.
• Google hosts the mailbox it arrives in, and runs the analytics described above.
• Microsoft runs Clarity, described above. It sees only your use of this website — never your enquiry.

Resend, Flodesk and Google handle the data outside Kenya. We rely on your consent for that transfer, under sections 48 and 49 of the Data Protection Act 2019. This is your business contact details only. No employee payroll data ever leaves a customer’s own machine; the software has no way to send it.

How long we keep it

Only as long as we need it to answer you and follow up on the conversation. After that the email is deleted. Ask us to delete yours sooner and we will do it. If you become a customer, your contact details move into our licensing records, which the software notice covers.

Your rights

Under the Data Protection Act 2019 you can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, object to what we are doing, or receive it in a portable form. The basis here is consent, so you can withdraw that too. Write to [email protected]. In practice nearly all of these come down to deleting one email, and we will do it.

If you are not satisfied you can complain to the Office of the Data Protection Commissioner.

Security

Both forms are submitted over HTTPS and nothing from either is stored on this website. Access to the mailbox is limited to XELQ Ltd staff. If personal data is ever compromised we will notify affected people and the Commissioner within 72 hours of becoming aware.

Changes

If this notice changes materially we will date the change here. It does not apply retrospectively to data already deleted.

10 September 2026: the subscribe box was added, and Flodesk with it.