Who this is about
Genmars Tech Limited (registration BN-93S95J2J) of Nairobi, Kenya, operates the website at genmars.co.ke, the client portal at app.genmars.co.ke, and the interface behind it at api.genmars.co.ke.
For everything described here, we are the data controller — with one exception, set out in section 15: where a client puts personal data about their own customers or staff into a system we built or run, they are the controller and we are only processing it for them.
Part one
This website
Short, because there is very little to say.
1. What the website collects
One thing. When you request a page, our server records the request in its log:
- Your IP address
- The date and time
- The page you asked for, and the response we gave
- Your browser’s user-agent string, and the referring page if your browser sent one
We use this to keep the site running, to diagnose faults, and to investigate abuse. Nothing else. It is kept for 30 days and then deleted automatically.
2. What it does not collect
This list is longer than the one above, and that is the point.
- No cookies. This site sets none. That is why there is no consent banner — there is nothing to consent to.
- No analytics. No Google Analytics, no Plausible, no Matomo, no equivalent.
- No tracking pixels, embeds, or advertising.
- No third-party requests. Fonts are served from our own server, so your browser does not contact anyone else while loading this site.
- No accounts, and no forms. Not a contact form, not a newsletter box, not a search field. There is nowhere on genmars.co.ke to type anything.
3. The link to the portal
Ordering a service is a link, not a submission. It opens app.genmars.co.ke and carries which service and tier you clicked in the address, so the portal can show it back to you. That is the only thing that travels, it goes to us and to nobody else, and it is a fact about a button rather than about you.
This website is told nothing about what happens next — not whether you signed up, not whether you finished, not whether you came back.
4. What your browser stores
This site writes three values to your browser’s local storage. All three stay on your device, are never transmitted to us, and we cannot read them. Clearing your browser’s storage for this site removes all of them.
gm-theme— your light or dark theme choice, if you made one.gm-request-draft— whatever you have typed into the request form, so that it survives a reload or the trip to the portal and back. Written as you type. You can delete it at any time with the “Start again” link on that page.gm-portal-account— a single yes/no flag recording that you came back from the portal, so the request page does not send you there again. It holds nothing about you: not your name, not your email address, not a session or a token.
Part two
The client portal
app.genmars.co.ke runs on different software, on a different server, from the website. It is where accounts, agreements, invoices and the record of work live. If you have never signed in to it, nothing in this part applies to you.
5. What we hold, and why
| What | Why we have it |
|---|---|
| Your name and email address, and the organisation you belong to | To give you an account, to know which work is yours, and to write to you about it |
| Your password | Stored only as an Argon2 hash. We cannot read it, recover it, or tell you what it is |
| Sign-in records — when you joined, when you verified your address, failed attempts, whether the account is locked | To stop someone guessing their way into your account, and to tell you what happened if they try |
| What you told us you need — the enquiry, the problem you described, what it is costing you today | To decide whether we can help, and to scope the work honestly |
| The work itself — orders, scope, statements of work, progress notes, milestones, change requests, support threads | It is the record of what was agreed and what was done. It is also the thing that protects you when memories differ |
| Invoices, payments and payment references | To bill you, to know what is settled, and because Kenyan tax law requires the records |
| The phone number used for an M-Pesa prompt, the amount, and what Safaricom told us happened | To reconcile payments, and to answer “it took the money and said it failed” months later |
| Your preferred contact person, their phone number, and how they prefer to be reached | So that reaching you does not depend on one of us remembering |
| Domains and hosting we hold or manage for you, and their renewal dates | So that nothing you depend on expires unnoticed |
| An activity log — who did what, and when, on your account and your work | So that a change to an invoice, an agreement or an access permission can always be traced to a person and a time |
We do not use any of it for advertising, we do not sell it, and we do not use it to train machine-learning models.
6. The internal record we keep about working with you
We keep notes you do not see, and you can ask for them.
When we speak to you — a call, a WhatsApp message, a meeting — we write down what was said, along with any photographs or files that came out of it. That record is internal. It exists so that an agreement made on a Saturday phone call is not lost, and it is written frankly, which includes impressions and opinions.
We are telling you it exists because it is about you, which means the rights in section 16 reach it: you can ask for a copy of what it says about you, and you can ask us to correct anything factually wrong.
What we tell you about the work is a progress note, which is published, dated and written for you. The internal log is a different record with a different purpose, and neither pretends to be the other.
7. Cookies in the portal
The portal sets two, and only two. Both are strictly necessary to sign you in and keep you signed in; there are no analytics or advertising cookies, and so there is no consent banner here either.
gm_session— identifies your signed-in session. It cannot be read by JavaScript, is sent only over HTTPS, and lasts up to 14 days or until you sign out.gm_csrftoken— protects against another site submitting a form to us as you.
8. Email we send you
We send service email about your own work: verification and password codes, invitations, invoices, and progress notes. It is not marketing, and we do not run a mailing list.
Where more than one person at your organisation has an account, each of them can turn off progress-note emails without losing access to anything — the second and third person at a client usually do not want every note, and having no way to stop it is how service email turns into marketing in the recipient’s mind.
9. Files you upload
Files attached to a conversation are stored on the server outside the area the web server can reach, and are served only to signed-in staff through the application. There is no public link to any of them, and no address you could guess.
10. How long we keep it
| What | How long |
|---|---|
| Server logs | 30 days, then deleted automatically |
| Verification and password codes | 15 minutes, single use, stored hashed |
| Spam and deleted email | 30 days |
| An enquiry that does not become work | 12 months |
| A closed account’s sign-in details, once access is withdrawn | The account is deactivated rather than deleted, so that authorship of notes and approvals is not destroyed; the details go when the organisation’s record does |
| Correspondence and the record of work, after the work ends | 7 years |
| Invoices, payment records and signed agreements | Kept as company records. These are accounting and legal records and are not deleted on request |
| Encrypted backups | Rolled on a schedule; a deletion works through into backups as they roll rather than immediately |
The seven-year figure is not us being reluctant to let go: Kenyan tax law requires business records to be kept for five years, and the period during which a contract claim can be brought is six.
11. How it is protected
We list only measures that are in place today, and then we list what is not.
- Passwords are hashed with Argon2 — not stored, and not recoverable by us
- All traffic is encrypted in transit; plain HTTP is redirected to HTTPS and browsers are instructed to refuse it thereafter
- Session cookies are HTTP-only, HTTPS-only, and same-site; cross-site form submission is blocked by token
- Repeated failed sign-ins lock the account, and sign-in and request rates are limited
- One organisation cannot read another’s data. This is enforced in one place in the code, and there are automated tests that fail the build if it stops being true
- A reference that is not yours returns “not found” rather than “not allowed”, so the system cannot be used to confirm that another client exists
- Sensitive actions — issuing an invoice, signing an agreement, changing who has access — are written to an append-only log that nothing in the software can edit or delete
- Backups are encrypted on the server, with a key we hold and the hosting provider does not
- The application runs as an unprivileged user in isolated containers, reachable only through our own proxy; the database is not exposed to the internet
What we do not claim, because it is not true today: the database is not encrypted at rest on the server’s disk (the backups are, the live database is not); there is no multi-factor authentication yet; we do not run formal periodic access reviews; and we publish no support response time. We would rather you knew that than read a policy that sounded better than the system.
12. Where your data is, and when it leaves Kenya
Your data is stored in Germany, not in Kenya.
The portal, its database and its backups run on a server in Falkenstein, Germany, rented from Hetzner Online GmbH. Some of the services listed in section 13 also operate outside Kenya. Sections 48 to 50 of the Data Protection Act, 2019 govern transferring personal data out of the country, and we are telling you plainly rather than leaving you to work it out from a provider list.
Germany is subject to the EU General Data Protection Regulation and our contract with the provider carries the data-protection terms that regime requires. If your work has a requirement that data remain in Kenya, tell us before we start — it is a question about where we build, and it is far cheaper to answer at the beginning.
13. Who else is involved
Every organisation that can see any part of your data, what they do, and where they are. There are no others.
| Who | What they do | What they can see | Where |
|---|---|---|---|
| Hetzner | Hosts the servers | The infrastructure everything runs on, including the disk the database sits on | Germany |
| Cloudflare | Provides DNS for our domains | Which domain was looked up. Not the pages you visit or anything you send | Global |
| Let’s Encrypt | Issues our security certificates | Our domain names only | United States |
| Resend | Delivers the email the portal sends | Your email address and the content of messages we send you | United States |
| Zoho | Hosts our own mailboxes | Email correspondence between us and you | Outside Kenya |
| Safaricom | Processes M-Pesa payments | The phone number prompted, the amount, and the transaction | Kenya |
We will not add anyone to this table without updating this page. If a new provider would see personal data belonging to a client, we will tell that client before it happens.
14. Automated decisions
There are none. Nothing here decides anything about you on its own — not whether to take on your work, not what to charge, not whether to extend credit. A person makes those calls, and the activity log records which person.
15. Data you give us about other people
Where we build or run a system for you and it holds personal data about your customers, patients, pupils or staff, that data is yours and not ours. You are the data controller; we are a processor acting on your instructions. What we may do with it, how we protect it, who else touches it, and what happens to it when we part company are set out in a separate Data Processing Agreement that forms part of your engagement.
We do not use client data to improve our own products, and we do not move it between clients.
Both
Your rights, and reaching us
16. Your rights
Under the Data Protection Act, 2019 you have the right to be told how your data is used, to ask for a copy of it, to have it corrected, to have it deleted, to object to how it is being processed, and to receive it in a portable form.
In practice, what that means depends on which part of this document you are in:
- If you only read the website, the only thing we hold is a server log entry keyed to an IP address, for 30 days. To exercise any right over it, tell us the approximate date and time of your visit and the IP address you used — without those we genuinely cannot find your entries.
- If you have a portal account, write to us and we will give you everything we hold about you, including the internal record described in section 6. We will not charge you for it, and we will respond within 30 days.
Two honest limits on deletion. Records we are legally obliged to keep — issued invoices, signed agreements, payment records — we keep. And a deletion works through into encrypted backups as those backups roll, rather than the moment you ask.
17. If something goes wrong
If personal data is lost, exposed or taken, we will tell the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, as the Act requires, and we will tell affected people directly where the breach is likely to harm them. We will say what happened, what it means for you, and what we are doing — not a notice that avoids saying anything.
18. How to reach us
| About | Write to |
|---|---|
| Your data, or anything on this page | privacy@genmars.co.ke |
| A security flaw | security@genmars.co.ke |
| Anything else | info@genmars.co.ke |
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner of Kenya. You do not have to come to us first, though we would rather you did.
19. Changes
If we change what we collect, who we share it with, where it is stored, or how long we keep it, we change this page and the date and version at the top. Where a change materially affects people with portal accounts, we email them. We do not make changes quietly.