Privacy Policy
ICON GERSIS LIMITED (Icon Gersis) and Debish Tech
Last updated: 21 October 2026
This policy explains what personal data we collect through https://icongersis.com, why we collect it, and the choices and rights you have. We have written it for Kenya’s Data Protection Act, 2019.
1. Who we are
The website is run by ICON GERSIS LIMITED, a private limited company registered in Kenya (company no. PVT-2719QARV). Debish Tech (https://debishtech.com) is our digital division. In this policy, “we”, “us” and “our” mean ICON GERSIS LIMITED, including Debish Tech.
We decide how and why your personal data is used on this website, so we are the “data controller” for it.
- Address: The Promenade, General Mathenge Rd, Westlands, Nairobi. P.O. Box 22157-00100, Nairobi, Kenya
- Phone and WhatsApp: +254 762 120 120
- Email: info@icongersis.com
2. What we collect and why
When you use our proposal request form. The form on our Contact page asks for:
- your full name and email address (required)
- your phone number and organisation (optional)
- the service you are interested in
- the details you choose to give about your project
Your submission is stored in our website’s database and sent to our team by email. It may also include technical information, such as the date and time you sent it. We use it to reply to you, to understand what you need, and to prepare a proposal or quote. Please don’t send sensitive information (for example health or financial details) through the form.
When you contact us directly. If you call, email or message us on WhatsApp, we receive the details you share, such as your name, phone number, email address and what you write. We use them to reply and to handle your request.
When you visit the website. Like most websites, our hosting provider’s servers automatically record basic technical information when a page is requested, such as your IP address, browser type, the page requested and the time. This is used to deliver the site, keep it secure and fix problems.
We do not use analytics, advertising or social media tracking tools on this website, we do not sell your personal data, and we do not use it to make automated decisions about you.
3. Our legal basis
We only use your personal data when the law allows it. Depending on the situation, we rely on:
- Steps before a contract, or a contract: when you ask us for a proposal, quote or service, we use your details to respond and, if you go ahead, to deliver the work.
- Legitimate interests: to answer general enquiries, keep business records, and keep the website running and secure. We only do this where it does not override your rights.
- Consent: where we ask for it, for example if you ask to receive updates from us. You can withdraw consent at any time, and this does not affect anything we did before.
- Legal obligation: where a law requires us to keep or share information, for example tax records.
4. Who we share it with
We share personal data only with service providers that help us run the website and our communications, and only as much as they need:
- Hostinger hosts this website and runs the content delivery and security service in front of it. Form submissions and server logs are stored on Hostinger’s systems.
- Our email service provider delivers form notifications and the emails you send us to our team.
- WhatsApp (Meta): if you choose to message us on WhatsApp using a click-to-chat link on our website, WhatsApp processes that chat under its own privacy policy.
- Google Fonts (Google): if our hosting provider’s security service shows you a short “checking your browser” page, that page loads a font from Google, which receives your IP address.
We may also share information if the law requires it, or to protect our rights, our clients or the public. We do not sell or rent personal data.
5. Cookies
A cookie is a small file a website stores in your browser. This website uses very few:
| Cookie | Set by | Purpose | How long |
|---|---|---|---|
| hcdn | Hostinger (hosting and content delivery) | Security and traffic protection, for example telling real visitors apart from automated traffic | Until you close your browser |
This cookie is needed for the site to work securely, so it is set without asking. We do not use analytics, advertising or social media cookies. You can block or delete cookies in your browser settings, but parts of the site may not work properly.
If you log in to the website’s admin area, WordPress sets its own login cookies. Ordinary visitors do not log in.
If we add analytics, advertising or other optional cookies in future, we will update this policy and ask for your consent first.
6. How long we keep it
We keep personal data only as long as we need it:
- Proposal requests and enquiry emails: 24 months after our last contact with you, unless you become a client.
- WhatsApp messages: 24 months after our last contact with you, unless you become a client.
- Client records: for as long as we work together, and then for 5 years. Section 23 of the Tax Procedures Act, 2015 requires tax records to be kept for five years from the end of the reporting period they relate to. We keep them longer only if the law requires it, for example during a tax dispute.
- Server logs: our hosting provider keeps standard server logs for a limited period for security and troubleshooting.
After that, we delete the data or make it anonymous.
7. How we protect it
We take reasonable steps to keep personal data safe. The website uses an encrypted (HTTPS) connection, access to the website’s admin area and our inboxes is limited to the people who need it, and we keep the website software updated. No system is completely secure, so if a breach affects your personal data and puts you at real risk, we will inform you and the Office of the Data Protection Commissioner as the law requires.
8. Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your personal data is used (this policy)
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete data that is wrong, out of date or no longer needed
- object to us using your data, including for any marketing
- withdraw your consent where we rely on it
- ask for your data in a format you can pass to someone else, where this applies
To use any of these rights, contact us using the details in section 13. We may need to confirm your identity first. We will not charge you for a reasonable request, and we will reply within the time the law requires.
If you are unhappy with how we have handled your data, please tell us first so we can try to fix it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC): https://www.odpc.go.ke
9. Children
Our services are for businesses and organisations. The website is not meant for children under 18, and we do not knowingly collect their personal data. If you think a child has sent us their details, please contact us and we will delete them.
10. International transfers
Some of our providers may store or process data on servers outside Kenya. This includes Hostinger, as well as WhatsApp (Meta) and Google, which run services from other countries, including the United States and the European Union. Where personal data is transferred outside Kenya, we rely on providers that apply appropriate safeguards, in line with the cross-border transfer provisions of the Data Protection Act, 2019.
11. Links to other websites
Our website links to other sites, such as the websites we have built for clients and debishtech.com. Those sites have their own privacy policies, and we are not responsible for how they handle your data.
12. Changes to this policy
We may update this policy when our website or the law changes. The date at the top shows when it was last updated. If we make an important change, we will make it clear on the website.
13. Contact us
For any question about this policy or your personal data:
ICON GERSIS LIMITED
The Promenade, General Mathenge Rd, Westlands, Nairobi
P.O. Box 22157-00100, Nairobi, Kenya
Phone and WhatsApp: +254 762 120 120
Email: info@icongersis.com