Privacy Policy

CVWriting.co.ke (“CVWriting”, “we”, “us”, “our”) is a Kenya-based, online-first CV and career support service. We mainly operate through our website, email, and other digital channels, with little to no in-person engagement. For the purposes of the Kenya Data Protection Act, 2019, we are the data controller for personal data described in this Policy.

If you have questions about this Policy or how we handle your data, contact us at:

• a) Email: [INSERT PRIMARY PRIVACY / SUPPORT EMAIL, e.g. privacy@cvwriting.co.ke]
• b) Phone / WhatsApp: [INSERT BUSINESS PHONE / WHATSAPP NUMBER]
• c) Postal / Registered Address: [INSERT POSTAL OR REGISTERED ADDRESS]

This Privacy Policy applies to personal data we collect and process when you visit or use CVWriting.co.ke, submit an enquiry, place an order, communicate with us via email, phone, WhatsApp or other messaging channels, or subscribe to our marketing communications or resources.

It does not cover the privacy practices of third-party websites, platforms, or services that we do not control (for example, payment providers or job portals). If you follow a link to a third-party site, their privacy and cookie policies will apply.

The personal data we collect depends on how you interact with us and the services you request. We may collect the following categories:

3.1 Identity and contact information

• a) Full name
• b) Email address(es)
• c) Phone / WhatsApp number(s)
• d) Country / location and, where relevant, time zone

3.2 Professional, CV and job-related information

• a) Current and previous job titles, employers, responsibilities and achievements
• b) Employment history, education, qualifications, certifications and skills
• c) Career goals, target roles, industries and preferred locations
• d) Job descriptions or vacancies you share for CV or cover letter tailoring
• e) Any content you include in your CV, cover letter, LinkedIn profile or supporting documents

3.3 Transactional and billing information

• a) Records of services purchased or requested
• b) Invoices, billing information and payment confirmations
• c) Transaction references and basic payment metadata (such as payment date, method and amount)

We do not store full card or mobile money details where payments are processed via third-party providers. Those payment details are handled directly by the relevant provider under their own policies.

3.4 Technical and usage information

• a) IP address, browser type, device type and operating system
• b) Pages viewed, referring URLs and time spent on the website
• c) Cookie identifiers and similar online identifiers

3.5 Communication and preference information

• a) Records of communications between you and us (emails, messages, calls and notes)
• b) Your language and contact preferences
• c) Your marketing preferences and consents

We do not intentionally seek to collect sensitive personal data (such as health information, religious beliefs, political opinions, trade union membership, or information about children). We ask that you avoid including such information in your CV or supporting documents unless strictly necessary and clearly communicated. If we become aware that we hold unnecessary sensitive data, we aim to minimise or delete it where appropriate.

We collect personal data from the following main sources:

• a) Directly from you when you complete forms on our website, send us emails or messages, or upload documents.
• b) During service delivery, when you share additional background information, job descriptions or feedback.
• c) Automatically when you use our website, through cookies and similar technologies (see our Cookies & Preferences Policy).
• d) From payment providers when we receive payment confirmations or transaction references.

In most cases, the onboarding and service delivery process happens online via our website, email, and other digital channels.

We process personal data under one or more of the following legal bases:

• a) Performance of a contract: to provide our services or take steps at your request before entering into a contract (for example, assessing your CV and preparing a quotation).
• b) Consent: where we rely on your explicit consent, for example for certain marketing communications or non-essential cookies. You can withdraw your consent at any time.
• c) Legitimate interests: where processing is necessary for our legitimate interests or those of a third party and does not override your rights and freedoms. This includes improving our services, maintaining security, preventing fraud, managing our business and understanding how clients use our site.
• d) Legal obligations: where we must process data to comply with legal or regulatory duties, such as keeping accounting records or responding to lawful requests from authorities.

We use personal data for the following purposes:

6.1 Service delivery

• a) Assessing your needs and professional background to prepare or refine your CV, cover letter, LinkedIn profile and related documents.
• b) Providing interview coaching or other agreed services.

6.2 Client support and communication

• a) Responding to enquiries, providing updates, and managing requests or complaints.
• b) Communicating about drafts, revisions and delivery timelines.

6.3 Quotations, contracts and payments

• a) Preparing proposals and confirming orders.
• b) Issuing invoices, processing payments and maintaining financial records.

6.4 Service improvement and quality control

• a) Analysing feedback and usage data to improve our services and processes.
• b) Using anonymised or appropriately minimised client content for internal training, template development or quality assurance, where permitted.

6.5 Website operation and analytics

• a) Operating and securing our website.
• b) Understanding how the site is used and making improvements.

6.6 Marketing (where permitted)

• a) Sending career tips, updates about our services, offers or resources you may find useful.
• b) Using anonymised or aggregated data for reporting and analytics.

You may opt out of non-essential marketing at any time by using the unsubscribe link in our emails or by contacting us directly. We do not share your personal data with third parties for their own independent marketing purposes.

We do not sell your personal data. We may share it with trusted third parties, including:

• a) Service providers and subcontractors (for example, experienced CV writers or editors) who work under confidentiality obligations and only access data they need to perform their tasks.
• b) IT, hosting and support providers, including website hosting, email, cloud storage, project management and analytics tools.
• c) Payment processors, to process payments securely and provide payment confirmations and references.
• d) Professional advisers, such as accountants, auditors or legal advisers, where needed for our legitimate business needs.
• e) Regulators and law enforcement, where required by law or in response to valid legal processes or requests.

Where third parties act as data processors on our behalf, we seek to ensure appropriate contractual and security safeguards are in place.

Because we operate online and may use cloud-based tools, your personal data may be transferred to and processed in countries outside Kenya (for example, where hosting, email, backup, analytics or collaboration tools are located).

When we transfer personal data internationally, we aim to use providers that implement appropriate security measures and, where applicable, contractual safeguards. We also seek to minimise transfers where possible and rely on reputable services with strong privacy and security standards.

We retain personal data only for as long as reasonably necessary to fulfil the purposes described in this Policy, including to meet legal, accounting and reporting requirements.

In general, we apply the following retention practices:

• a) CV project files and related communication: typically up to three (3) years from the date of last active interaction with you, to support follow-up requests and continuity if you return for updates.
• b) Invoices, financial records and payment-related data: retained for up to seven (7) years or as required by applicable tax and accounting laws.
• c) Marketing contact details: retained until you unsubscribe or withdraw consent, after which we may keep a minimal suppression record to ensure we do not contact you again in error.

We may retain certain information for longer where we have a legal obligation to do so, where necessary for the establishment, exercise or defence of legal claims, or where we have a strong legitimate interest that is compatible with your rights and freedoms.

We take reasonable technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage. These measures include using reputable hosting and cloud service providers, restricting access to client data to those who need it for their role, and regularly reviewing access rights.

No method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect personal data, we cannot guarantee absolute security.

You are also responsible for keeping your devices, email accounts and logins secure, and for notifying us promptly if you suspect unauthorised access to your information in connection with our services.

Our services are aimed at adults and working professionals. We do not knowingly collect personal data from children under 18 years of age. If we discover that we have inadvertently collected personal data from a child, we will take reasonable steps to delete such data as soon as practicable or to regularise our handling of it in line with applicable law.

Under the Kenya Data Protection Act, 2019 and other applicable data protection laws, you may have rights in relation to your personal data, including:

• a) Right to be informed about how we collect and use your personal data.
• b) Right of access to certain personal data we hold about you.
• c) Right to rectification of inaccurate or incomplete data.
• d) Right to erasure in certain circumstances.
• e) Right to restriction of processing in certain circumstances.
• f) Right to object to certain types of processing, including direct marketing.
• g) Right to data portability, where technically feasible and applicable, for data you have provided to us.
• h) Right to withdraw consent at any time where processing is based on consent (for example, marketing or certain cookies).

To exercise these rights or ask questions about how we handle your personal data, contact us at [INSERT PRIMARY PRIVACY / SUPPORT EMAIL FOR RIGHTS REQUESTS]. We may need to request information to confirm your identity before responding. We aim to respond to verified requests within the timelines required by applicable law.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya or another competent supervisory authority, where applicable.

We use cookies and similar technologies on our website to support functionality, analyse usage and, where applicable, support marketing activities. For more detail about the types of cookies we use, the purposes for which we use them, and how you can manage your preferences, see our Cookies & Preferences Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or other factors. When we make changes, we will update the “Last updated” date at the top of this Policy and, where appropriate, provide additional notice (for example, on our website or via email).

We encourage you to review this Policy periodically to stay informed about how we handle your personal data.