Privacy Policy
How we collect, use, store and protect your personal data.
Last updated: 13 June 2025
1. About this Policy
This Privacy Policy applies to Migradia Ltd ("Migradia", "we", "us" or "our"), a company incorporated in Kenya. It describes how we collect and process personal data when you use our website at migradia.com, engage our enterprise technology services, or interact with our branded product suite (Vid-it, Mygra, Gagamba, Onemum, Migra) (collectively, the "Services").
We are committed to protecting your privacy in accordance with the Kenya Data Protection Act 2019 (KDPA) and, where applicable, the EU General Data Protection Regulation (GDPR). By using the Services you acknowledge this Policy.
2. Data Controller
The data controller for your personal data is:
3. Data We Collect
3.1 Information you provide directly
- Name, work email, company name, country — via contact or enquiry forms
- Account credentials when accessing the Enterprise Hub or client portals
- Communications you send us by email, WhatsApp Business, SMS or USSD
- Support tickets and responses
3.2 Information collected automatically
- IP address, browser type, operating system, referring URL
- Pages viewed, time on site and click-path (via first-party analytics only, with your consent)
- Cookies and similar technologies (see our Cookie Policy)
3.3 Information from third parties
- Business contact details lawfully obtained from professional networks or licensed data providers
- Partner referrals and event registrations
4. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and delivering Services | Contract / legitimate interests |
| Account management and client portal access | Contract |
| Sending service updates, maintenance alerts and invoices | Contract |
| Marketing communications (opt-in only) | Consent |
| Site analytics and performance improvement | Consent (cookies) |
| Fraud prevention and security monitoring | Legitimate interests |
| Legal obligations and regulatory compliance | Legal obligation |
| Providing equipment warranties and support (CCTV, servers, AV) | Contract |
5. Communication Channels
Migradia may contact you via email, telephone, WhatsApp Business, SMS and USSD short codes for service notifications, support and, with your prior consent, marketing. You can opt out of marketing communications at any time by replying STOP to an SMS, following the opt-out link in an email, or contacting us directly.
6. Equipment, Warranties and Partner Services
Migradia supplies physical equipment — including CCTV surveillance systems, servers and rack infrastructure, and audio-visual (AV) and unified-communications equipment — sourced from licensed technology partners. These partners hold their own applicable licences, warranties and certifications. When we process personal data in connection with equipment installation, maintenance or warranty claims (such as site survey reports, engineer visit records or CCTV footage access logs), we do so under contract and applicable data-protection law. Retention periods for such records are set out in Section 8.
7. Data Sharing
We do not sell your personal data. We may share it with:
- Service providers — cloud hosting, email delivery, CRM and analytics partners who are contractually bound to process data only on our behalf
- Technology and reseller partners — when required to fulfil a service or equipment warranty, under a data-processing agreement
- Group companies — Migradia group entities for internal administrative purposes
- Regulators and law enforcement — when required by applicable Kenyan, EU or other applicable law
- Professional advisers — lawyers, auditors and insurers under confidentiality obligations
8. Data Retention
| Data type | Retention period |
|---|---|
| Enquiry and contact-form submissions | 3 years |
| Client account and contract records | 7 years after contract end |
| Marketing consent records | Until consent withdrawn + 1 year |
| Equipment warranty and installation records | Duration of warranty + 3 years |
| CCTV access logs (not footage) | 1 year |
| Server/network monitoring logs | 90 days rolling |
| Financial and invoice records | 7 years (Kenya tax law) |
| Support tickets | 3 years after resolution |
9. International Transfers
Migradia is headquartered in Kenya. When we transfer personal data to our service providers or partners located in the European Economic Area or other jurisdictions, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards recognised under applicable data-protection law.
10. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your personal data (a Subject Access Request)
- Correct inaccurate data
- Delete your data ("right to erasure") where no legal basis for retention exists
- Restrict or object to processing
- Data portability (receive your data in a machine-readable format)
- Withdraw consent at any time without affecting prior processing
- Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local supervisory authority
To exercise any right, email privacy@migradia.com. We will respond within 30 days.
11. Security
We implement appropriate technical and organisational measures — including TLS encryption in transit, AES-256 encryption at rest, role-based access controls, multi-factor authentication and regular penetration testing — to protect your personal data. See our Security Statement for more detail.
12. Minors
Our Services are directed at businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe we hold data relating to a minor, please contact us immediately.
13. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or a prominent notice on this site at least 14 days before they take effect. The "Last updated" date above reflects the current version.
14. Contact
For all privacy enquiries, contact our Data Protection team: