PRIVACY*

Dullu Digital ("DDi") is a delivery firm based in Nairobi, Kenya, serving professional services firms across East Africa and worldwide. We build one thing: a working sales pipeline for your firm. This page tells you what data we collect, why we collect it, and how to ask us to delete it.

We collect only what we need to do business with you: (1) Information you give us through forms (name, business name, email, WhatsApp number, the challenge you describe). (2) The prospect data we research and deliver as part of the Pipeline, Run for You — public business information, decision-maker names, verified emails, phone numbers and why-now notes. (3) Anonymous analytics about your visit (pages viewed, clicks, country, device type) via PostHog. (4) Cookies — see below.

To respond to your enquiries within 4 hours, to build and deliver your pipeline, to improve our website, to send you the resources you requested, and to comply with Kenyan tax and business law. We do not sell your data. We never share it with third parties except where the law requires or where a specific delivery partner (for example an email provider) is needed to run your pipeline.

Transactional emails — like your pipeline health score report, or a reply to your enquiry — are sent because you asked for them; no consent is needed. Marketing and content emails (offers, service news, field notes, guides) are sent only if you tick the consent boxes on our forms. Each marketing email carries an unsubscribe link, and opting out takes effect immediately. We record your consent when you submit a form, and your choices are stored with our email provider so they are respected across every list.

Consent is always opt-in, never pre-ticked. When you score your pipeline or sign up to our newsletter, two separate toggles ask: (1) content — field notes, guides and market research, and (2) marketing — occasional offers and news about DDi services. You can change either at any time by emailing us or using the unsubscribe link in any email. Withdrawing consent never affects transactional or service emails.

We use PostHog (a privacy-focused analytics tool) to understand what works on our site. PostHog stores anonymous events in localStorage and a small first-party cookie. You can opt out anytime via the cookie banner or by emailing us. We do NOT use Google Analytics, Facebook Pixel, or any ad-tech tracker.

Under the Kenya Data Protection Act 2019 and the EU GDPR, we process your data on the basis of (a) your explicit consent (forms, cookies) and (b) legitimate interest (responding to enquiries and delivering contracted services). You have the right to access, correct, delete, or port your data at any time.

Client and lead records are kept for 36 months unless you ask us to delete them sooner. Anonymous analytics events are retained for 12 months. Once deleted, data is permanently removed from our active systems (backups are purged within 30 days).

Our systems run on Cloudflare (Workers and D1 database) with encryption in transit and at rest. Access to the client and prospect database is restricted to the delivery team and requires authentication. We follow OWASP guidelines for our website code.

Email [email protected] with subject 'Data request' and one of: ACCESS, CORRECT, DELETE, EXPORT. We respond within 7 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (https://www.odpc.go.ke).

We will post any material change here with at least 14 days notice and notify you by email if we have one on file. Last updated: August 2026.