Privacy policy

Effective 28 September 2026

This policy explains how Justdoit Inc ("Justdoit", "we", "us"), trading as Justdoit SmartAds and based in Nairobi, Kenya, collects, uses, shares and protects personal data. It covers our website at justdoit.co.ke, the enquiries people send us, and the lead management and advertising services we provide to our business clients.

Who is responsible for your data

For enquiries sent to Justdoit through this website, Justdoit is the data controller.

When we run advertising and lead handling for a client business, that business decides why and how its customers' data is used. In that case the client is the data controller and Justdoit processes the data on the client's behalf and on its instructions. If you submitted your details to one of our clients, please contact that business first; we will help them respond to your request.

What we collect

• Details you give us: your name, phone or WhatsApp number, email address, business name and any message you write in our forms or in lead forms we manage for clients.
• Where you came from: the ad, campaign or page that brought you (for example UTM tags and ad click identifiers such as gclid, fbclid or ttclid), the page you landed on and the referring website.
• Technical data: IP address and browser user agent, used to prevent spam and to measure advertising results.
• What happened next: whether a lead was contacted, became a customer or was not relevant, who responded and how quickly.
• Messages: WhatsApp messages exchanged with a client's business number, where the client has enabled WhatsApp replies.

We do not intentionally collect sensitive personal data, and we ask that you do not include it in forms or messages.

How we use it

• To respond to your enquiry and deliver it to the right team quickly.
• To filter out spam, duplicates and invalid contact details.
• To measure which ads produce enquiries and customers, and to report this to the client concerned.
• To send conversion results to advertising platforms (Meta, Google and TikTok) so their systems can optimise ads. Email addresses and phone numbers are converted into one-way SHA-256 hashes before they are sent.
• To meet our legal obligations and protect our services against misuse.

Our legal bases are your consent where you submit a form, the performance of a contract with our clients, and our legitimate interest in running secure and effective services, as permitted under the Kenya Data Protection Act, 2019 and, where applicable, the EU and UK GDPR.

Data we receive from Google APIs

Our application uses Google OAuth only so that an authorised Justdoit administrator can connect our system to the Google Data Manager API. We request the scope https://www.googleapis.com/auth/datamanager, which is used solely to send offline conversion data (for example "lead contacted" or "lead won", with hashed contact details and ad click identifiers) to Google Ads accounts that we manage for our clients with their permission.

• We do not use Google user data for any other purpose, and we do not sell it.
• We do not use it to serve or personalise advertising outside the client's own Google Ads account, and we do not use it to build profiles or train generalised models.
• We do not transfer it to others except as needed to provide this feature, to comply with law, or as part of a merger or acquisition with appropriate protections.
• People at Justdoit do not read this data unless you ask us to, it is needed for security, or it is required by law.
• Access tokens are stored encrypted by our automation platform and can be revoked at any time from your Google Account's security settings.

Who we share it with

We share personal data only with the client business the enquiry was meant for, and with service providers that help us run our services under contract:

• Cloudflare, for website hosting, security and data storage.
• Telegram, to deliver lead alerts to our clients' teams.
• Meta (including WhatsApp), Google and TikTok, for advertising, WhatsApp messaging and conversion measurement.
• Our hosting provider, for the servers that run our automation.

Some of these providers process data outside Kenya. Where they do, we rely on the safeguards required by the Kenya Data Protection Act, 2019, such as contractual commitments to protect the data.

How long we keep it

• Leads and their outcomes: for as long as our agreement with the relevant client lasts, then deleted or returned within 90 days unless the law requires us to keep them longer.
• Rejected or spam submissions: 30 days.
• Technical delivery records: 14 days.
• Enquiries sent to Justdoit: up to 24 months after our last contact with you.

How we protect it

Data is encrypted in transit, stored with access limited to authorised staff, and secured with per-client access keys. Contact details are hashed before they are shared with advertising platforms. No system is completely secure; if a breach affects your data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

Your rights

You can ask to access, correct or delete your personal data, object to or restrict how it is used, withdraw your consent, and ask for a copy of your data in a portable format. Email musab.sheikh@justdoit.co.ke and we will respond within the time the law requires. If you are not satisfied, you can complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

Cookies

This website does not set advertising cookies of its own. If an advertising platform's tag is added to a page, it may set its own cookies (for example Meta's _fbp), and we may read those identifiers to measure ad results. You can block cookies in your browser settings.

Children

Our services are for businesses and adults. We do not knowingly collect data from children under 18.

Changes to this policy

If we change this policy, we will update the date at the top of this page. Significant changes will also be communicated to our clients directly.

Contact

Justdoit Inc, Nairobi, Kenya. Email: musab.sheikh@justdoit.co.ke