Privacy Policy & Data Protection Framework

*Last Updated: January 1, 2026 | Effective Date: Immediately*

Elqon Limited ("Elqon", "we", "our", or "us") is dedicated to protecting your privacy and ensuring the highest standards of data protection. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit elqon.com, use our digital applications, or engage our artificial intelligence and engineering services.

This policy is formulated in full compliance with the Data Protection Act, 2019 (Laws of Kenya) and conforms to international data governance frameworks including the General Data Protection Regulation (GDPR).

1. Information We Collect

We collect information directly from you and automatically through your interaction with our platforms:

A. Information You Voluntarily Provide

B. Automatically Collected Technical Data

2. Legal Basis & How We Use Your Data

We process personal and corporate data strictly for legitimate business purposes:

1. Service Delivery & Execution: Designing, developing, testing, deploying, and maintaining custom software architectures and digital solutions. 2. AI Model Optimization & Processing: Providing natural language inference, automated workflow orchestration, and data analysis as requested by the Client under explicit contractual authorization. 3. Billing & KRA Compliance: Generating compliant tax invoices, tracking milestone payments, and issuing official receipts. 4. Client Communication: Responding to quote inquiries, sharing project status reports, scheduling technical audits, and providing ongoing SLA maintenance. 5. System Security & Threat Mitigation: Protecting our infrastructure, APIs, and client data against malicious access, DDoS attacks, and unauthorized intrusions.

3. Artificial Intelligence & Client Data Security

3.1. Zero Model Training on Client Data: Elqon does not use proprietary client codebases, confidential business records, or sensitive personal data to train public foundation AI models.

3.2. Private Inference: AI features implemented for clients are isolated within secure enterprise tenant environments with strict role-based access control (RBAC) and end-to-end data encryption in transit (TLS 1.3) and at rest (AES-256).

4. Data Sharing & Third-Party Processors

Elqon will never sell, lease, or monetize your personal or business data. We only share information with trusted third-party service providers essential for platform operations:

5. Cookies & Tracking Technologies

We use essential cookies and lightweight performance analytics to:

You can manage or disable cookies through your web browser settings; however, disabling essential session cookies may restrict access to client portal features.

6. Your Rights Under the Kenya Data Protection Act 2019

Under the Kenya Data Protection Act 2019 and global privacy standards, you hold the following rights:

7. Data Retention & Security Safeguards

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy or comply with statutory tax and accounting retention requirements (typically up to seven years for fiscal records under Kenyan revenue law).

We enforce multi-layered security controls including:

8. Contact Our Data Protection Officer

If you have questions about this Privacy Policy, wish to exercise your data rights, or have inquiries regarding data protection at Elqon, please reach out to our Data Protection Officer:

Data Protection & Compliance Office — Elqon Limited