Privacy Policy

Last updated: 03/09/2026

This Privacy Policy explains how Frostwood Limited trading as Frostwood (“Frostwood”, “we”, “us”, “our”), collects, uses, stores, shares and protects personal data when individuals use Frostwood CRM, our websites and related services.

We are committed to handling personal data in accordance with applicable privacy and data-protection laws, including Kenya's Data Protection Act, 2019.

1. Our Role

Frostwood may process personal data in different capacities.

When Frostwood is a controller

We may act as a data controller for information used to operate our own business, such as:

• Frostwood account information;
• subscription and billing information;
• security records;
• support communications;
• website information;
• product communications; and
• information required for legal or regulatory compliance.

When Frostwood is a processor

Businesses using Frostwood may upload information about their own customers, suppliers, employees, leads and other contacts.

For that Customer Data, the Frostwood customer generally determines why and how the information is used. Frostwood processes the information on the customer's behalf to provide the Service.

The ODPC's guidance expressly uses CRM/ERP providers with access to personal data as an example of data processors.

2. Information We Collect

Depending on how Frostwood is used, we may process:

Account information

• name;
• business/company name;
• email address;
• telephone number;
• job title;
• account credentials;
• user role;
• authentication information; and
• account preferences.

Business information

• company registration information;
• business address;
• tax information;
• business contacts;
• billing information;
• subscription plan; and
• business configuration.

CRM information

Tenants may store:

• customer names;
• contact persons;
• email addresses;
• telephone numbers;
• addresses;
• leads;
• notes;
• communications;
• quotations;
• proposals;
• contracts;
• support requests; and
• other customer relationship information.

Financial and accounting information

Depending on enabled features:

• invoices;
• quotations;
• payments;
• expenses;
• bills;
• credit notes;
• transaction references;
• accounting entries;
• tax information;
• payment-method information; and
• financial reports.

Technical and security information

We may process:

• IP address;
• browser information;
• device information;
• timestamps;
• login history;
• failed-login attempts;
• audit logs;
• security events; and
• application activity reasonably required for security and operation.

3. How We Use Personal Data

We may process personal data to:

• provide Frostwood CRM;
• create and administer accounts;
• authenticate users;
• secure accounts and detect abuse;
• process subscriptions;
• provide customer support;
• generate business documents;
• deliver emails and notifications;
• facilitate payment integrations;
• maintain audit trails;
• diagnose errors;
• maintain and improve the Service;
• comply with applicable laws;
• enforce contractual terms; and
• protect Frostwood, our customers and users.

Processing should occur only where an appropriate lawful basis exists. Kenya's Data Protection Act recognises bases including consent, contractual necessity, compliance with legal obligations and legitimate interests subject to the applicable safeguards.

4. Customer-Controlled Data

A Tenant determines what personal data it enters into Frostwood and how its authorised users use that information.

Tenants are responsible for ensuring that they have an appropriate lawful basis for collecting and processing information they place in Frostwood.

Frostwood does not sell a Tenant's CRM/customer database merely because it hosts that information.

5. Payments

Where Frostwood supports payments through M-Pesa or another payment provider, information required to initiate, identify, reconcile or confirm the transaction may be exchanged with the applicable payment provider.

Frostwood should store only payment information reasonably necessary for the relevant service, accounting, reconciliation, fraud prevention and legal obligations.

6. Cookies and Similar Technologies

Our website and application may use cookies or similar technologies necessary for:

• authentication;
• session management;
• security;
• user preferences; and
• essential application functionality.

If Frostwood later introduces non-essential analytics or advertising technologies, this policy and any required consent mechanism should be updated accordingly.

7. How We Share Personal Data

We may disclose personal data to service providers that help us operate Frostwood, such as:

• cloud and hosting providers;
• email-delivery providers;
• payment providers;
• monitoring and security providers;
• backup/storage providers; and
• professional advisers.

Such providers should receive only information reasonably necessary to perform their functions and should be subject to appropriate contractual and security obligations.

We may also disclose information where required by law, court order or lawful regulatory process.

8. International Data Transfers

If personal data is stored or processed outside Kenya, Frostwood will implement safeguards required by applicable law.

Kenya's Data Protection Act includes requirements concerning transfers of personal data outside Kenya, including appropriate safeguards or applicable consent requirements.

Our final production Privacy Policy should identify relevant international hosting/subprocessor locations once Frostwood's production infrastructure has been selected.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable contractual, accounting, tax, security and legal requirements.

Retention periods may differ between:

• active account data;
• accounting records;
• audit logs;
• security records;
• backups;
• support records; and
• deleted accounts.

We will establish documented retention periods for production before launch.

10. Security

Frostwood uses administrative, technical and organisational measures designed to protect personal data.

Depending on the relevant system, these may include:

• authentication controls;
• multi-factor authentication;
• role and permission controls;
• tenant isolation;
• rate limiting;
• encrypted communications;
• audit logging;
• access restrictions;
• backups;
• monitoring; and
• security testing.

No internet-connected service can guarantee absolute security.

11. Data Breaches

Where a personal-data breach occurs, Frostwood will investigate and respond in accordance with applicable legal and contractual obligations.

Where required, we will notify the appropriate parties and/or regulatory authority within the period required by applicable law.

12. Your Privacy Rights

Subject to applicable law and the circumstances of the processing, individuals may have rights concerning their personal data.

Under Kenya's Data Protection Act, these include rights to be informed about use of personal data, access personal data, object to certain processing, correct false or misleading information, and seek deletion of false or misleading data.

Requests concerning data controlled by one of our business customers may need to be directed to that customer. Where Frostwood acts only as its processor, we will reasonably assist the relevant Tenant in responding to requests as required.

You may also lodge a complaint with the Office of the Data Protection Commissioner (odpc.go.ke).

13. Marketing Communications

Where permitted, Frostwood may send product updates, educational information or marketing communications.

Recipients may unsubscribe from non-essential marketing communications using the unsubscribe mechanism provided.

Transactional and security communications, such as password resets, billing notices and critical security alerts, may still be sent where necessary to operate the Service.

14. Children's Data

Frostwood CRM is intended primarily for businesses and professional users and is not designed as a consumer service for children.

Customers should not intentionally use Frostwood to process children's personal data unless they have an appropriate lawful basis and comply with applicable legal requirements.

15. Subprocessors

Frostwood may use third-party subprocessors to provide infrastructure and operational services.

16. Account Closure and Data Deletion

When an organisation closes its Frostwood account, Customer Data may remain available for a limited period to permit export, recovery or fulfilment of legal obligations.

After the applicable retention period, data will be deleted or anonymised in accordance with Frostwood's retention procedures, subject to legal obligations and technically necessary backup retention.

The exact post-termination retention period should be finalised before launch.

17. Changes to this Privacy Policy

We may update this Privacy Policy when our products, processing activities or legal obligations change.

If a change materially affects how personal data is handled, we will provide appropriate notice.

18. Complaints

If you have concerns about how Frostwood processes your personal data, contact us first so that we can investigate.

19. Contact Us

For privacy questions, requests or complaints:

Frostwood Limited
Trading as Frostwood CRM
General Email: info@frostwood.co.ke
Nairobi, Kenya