1. INTRODUCTION AND SCOPE
CADMUS Cyber Solutions Limited ("CADMUS") is committed to the highest standards of data privacy. This policy explains how we collect and process "Account Data" (personal data related to you as an individual user of our portal) in compliance with the Kenya Data Protection Act (KDPA) 2019 and the GDPR.
Note: For the processing of "Email Traffic Data" (the content of emails filtered by our gateway on behalf of your organization), please refer to the Data Processing Agreement (DPA).
2. DATA WE COLLECT
We collect only the data necessary to provide and secure the MailShield service:
- Identity Data: Your full name, corporate email address, and company name.
- Technical & Security Data: IP addresses, browser types, and device identifiers used to access the portal. We process this through security partners to prevent fraudulent registration.
- Authentication Data: Handled securely via Auth0, including your unique user ID and login history.
- Billing Data: Corporate billing address, KRA PIN (for Kenyan entities), and transaction history. We do not store full credit card or bank details; these are handled by Paystack or similar PCI-compliant processors.
- Usage Data: Metadata related to your interactions with the dashboard (e.g., policy changes made, quarantine items released) for audit logging.
3. PURPOSE OF PROCESSING
We process your data based on the following legal grounds:
- Contractual Necessity: To create and manage your account and provide the services you have subscribed to.
- Legal Obligation: To maintain tax records and immutable audit logs of legal consents.
- Legitimate Interests: To protect our platform from cyber threats, fraud, and unauthorized access.
4. DATA SHARING AND TRANSFERS
We share your data with vetted sub-processors only when necessary. These include:
- Infrastructure: Microsoft Azure (Cloud hosting and WORM vaulting).
- Identity: Auth0 (Secure authentication management).
- Security: Partners providing domain and IP reputation scoring.
- Cross-Border Transfers: Some data may be stored on servers located outside of Kenya. We ensure all such transfers comply with the KDPA by implementing Standard Contractual Clauses or ensuring the destination provides an adequate level of protection.
5. DATA RETENTION
Account Data is retained for as long as your organization remains an active client. Upon termination:
- Active Account Data: Deleted or anonymized within 30 days.
- Archived Email Metadata: Retained for up to 7 years on the Compliance and Enterprise tiers to comply with regulatory and legal requirements.
- Audit Logs: Purged according to the retention schedule of your specific Subscription Plan (30, 90, or 365 + 730 days on the Standard, Strict, and Compliance/Enterprise tiers respectively).
6. YOUR RIGHTS (DATA SUBJECT RIGHTS)
As a data subject in Kenya, you have the following rights under the KDPA:
- Right to Access: Request a copy of the data we hold about you.
- Right to Rectification: Request correction of inaccurate information.
- Right to Erasure: Request the deletion of your account (subject to legal retention).
- Right to Portability: Request that your data be transferred to another provider in a machine-readable format.
- Right to Restriction: Request that we limit how we process and use your data.
- Right to Objection: Request that we do not process or use your data for specific purposes.
To exercise these rights, please use the Privacy Rights Centre accessible via your dashboard or https://mailshield.cadmuscyber.com/privacy/dsr, or email privacy@cadmuscyber.com.
7. SECURITY MEASURES
We implement enterprise-grade security, including 256-bit encryption for data at rest and in transit, strict role-based access control, and periodic third-party security audits.
8. CONTACT US
For any privacy-related inquiries, please contact our Data Protection Officer at:
CADMUS Cyber Solutions Limited
Email: privacy@cadmuscyber.com
Nairobi, Kenya