Privacy Policy

This Privacy Policy describes how personal information is handled through abutosystems.com, including the contact and AskanPharma demo request forms. Abuto Systems is a technology brand through which digital products and technology services are offered. It operates from Kenya. For privacy questions or requests, contact abutosystems@gmail.com.

The website presents AskanPharma, a pharmacy management system. Abuto Systems is not a healthcare provider and this website does not provide clinical care or medical advice. This policy covers this website; a separate notice or agreement may apply to other products or services.

If you submit a website form, the fields depend on the form and what you choose to provide:

• Contact and demo requests: name, email address, phone number, business or organization name, and your message or enquiry type.
• AskanPharma demo requests: those details, plus optional town/location and branch count, preferred contact method, and requested demo date and time.
• Submission records: a generated reference identifier and submission timestamp.

The demo dates and times are requests only. They do not reserve or confirm an appointment. Do not submit patient or health information, prescriptions, passwords, payment credentials, or other sensitive information in a form.

When a form is submitted, the browser sends the entered fields and a Cloudflare Turnstile token to our website. The website sends the token to Cloudflare for server-side verification and may include the connecting IP address supplied by Cloudflare for that check. Turnstile is used to help prevent automated form submissions; Cloudflare says the widget processes data needed for that security function and does not access or transmit form entries.

Cloudflare processes technical request information to deliver and protect the website. This may include network address, requested URL, time, browser and device information, and security events. We do not use this information in the application to build advertising profiles.

We use form information to respond to your enquiry, consider and arrange a requested discussion or demo, contact you using your stated preference, maintain the submission record for follow-up, and protect the forms from abuse. We use request and security information to deliver, troubleshoot, and protect the website.

Under Kenya's Data Protection Act, 2019, processing must have a lawful basis. Depending on the purpose and circumstances, our basis may include taking steps you request before entering a service agreement, consent where we specifically ask for and rely on it, and legitimate interests in responding to business enquiries and protecting the website, balanced against your rights. We do not use enquiry details for unsolicited marketing through this website.

Accepted form submissions are stored in Cloudflare D1 in Western Europe for manual follow-up. The record includes the fields described above and is not publicly accessible through the website. The site does not provide a lead dashboard. Authorized operators can access records through the Cloudflare account. The application does not store the Turnstile token or the IP address used for its verification in the lead record.

After a record is stored, the site makes a best-effort request to Resend to send a plain-text notification to Abuto Systems at abutosystems@gmail.com. The notification can contain the submitted contact and business details, requested date/time, message, reference identifier, and submission time. Resend may process message content and delivery metadata to provide email delivery. Resend states that stored data is held in the United States; its published retention periods depend on the account plan and terms. See Resend's Data Processing Addendum and current subprocessor list for its current terms and providers. The site does not store Resend delivery identifiers or status. A Resend failure does not remove a request already stored in the database.

Cloudflare provides website hosting, Worker execution, D1 database, and Turnstile services. These providers process information as needed to provide their services and under their applicable terms. We may also disclose information where required by law or to protect rights and security.

Google Calendar and Google Meet are not currently integrated with this website's demo form. The site does not currently request Google account data for appointment scheduling. If that changes, we will update this notice and explain the specific calendar information, permissions, and sharing before the feature is used.

Some personal information is processed or stored outside Kenya. Lead records are stored in Cloudflare D1 in Western Europe. Resend states that stored email data is held in the United States. Cloudflare also operates a global network and may process technical request information in other locations.

Kenya's Data Protection Act, 2019 and Data Protection (General) Regulations, 2021 set conditions for transfers outside Kenya, including appropriate safeguards, an adequacy decision, necessity, or consent. A provider's location or its terms for other jurisdictions do not, on their own, establish that a transfer meets Kenyan requirements. The transfer basis and safeguards depend on the particular provider and processing. For questions, contact abutosystems@gmail.com.

Form records are kept while they are needed to respond to and follow up on an enquiry, manage the resulting business discussion, meet applicable legal requirements, or address disputes and security matters. The current application has no automatic deletion schedule; authorized operators are instructed to remove lead records when they are no longer needed. Email copies and provider logs are subject to Resend's applicable account terms and retention practices.

The website validates submitted fields on the server, verifies Turnstile tokens server-side, uses parameterized database inserts, and limits notification error logs to safe categories rather than lead contents. These measures reduce certain risks but cannot guarantee that every transmission or system will be free from risk.

We request only information used to respond to an enquiry or arrange a requested conversation. Do not include sensitive information in free-text fields.

Subject to the Data Protection Act, 2019 and applicable exceptions, you may ask to be informed about the use of your personal data, access data held about you, object to all or part of its processing, request correction of false or misleading data, and request deletion of false or misleading data. Other rights may apply in particular circumstances, including rights relating to consent and data portability.

To make a request, email abutosystems@gmail.com with “Privacy request” in the subject and enough information for us to locate the relevant enquiry. We may ask for reasonable information to verify your identity. You may also raise a complaint with the Office of the Data Protection Commissioner in Kenya.

This business website and its enquiry forms are intended for business contacts, not children. Please do not submit a child's personal data or sensitive personal information, including health or patient information, prescriptions, passwords, payment credentials, or account secrets. If you believe such information has been sent to us, contact us so we can assess and handle it appropriately.

The application does not intentionally use analytics, advertising pixels, or app-managed browser storage. Cloudflare Turnstile loads a third-party script on forms and may use browser signals needed for security. Pre-clearance is off for the production Turnstile widget. See our Cookie Policy for details. Links to WhatsApp and other third-party sites are governed by those providers' own privacy practices.

We may update this policy when our processing or legal requirements change. The updated date will appear at the top of this page.

For privacy questions or requests, contact abutosystems@gmail.com.