We build business systems for a living, so we hold ourselves to the standard we set for our clients: collect what the job needs, tell you why, keep it properly, and give it back or delete it when you ask. This policy covers this website, the Digital Marketplace, our enquiry and newsletter forms, the discussion under our project, insight and career pages, the Mr Lao assistant and the dashboard at /admin. It does not cover a project network or business system we build for you, which is governed by the agreement for that work.
✦The short version
- We never sell your information
There is no data broker, no ad network and no analytics tracker on this site. Nothing you give us is traded, rented or sold.
- Forms collect only what they need
Your name, email and message on the enquiry form; your name and email when you buy a download. No passwords by email, no copies of your ID.
- Card numbers never touch our server
Payments finish on your bank’s or the card network’s own page. We keep the amount, the reference and the result, never the card.
- One cookie, plus a session
We set a single strictly necessary session cookie and, once you answer the banner, one cookie holding your consent choice.
- A person reads every comment
Your words on a project, insight or career page are checked by a human in our Control Centre before they appear. Your name is published; your email address is not.
- You can ask for anything
See, correct, export, restrict, object to, or delete your information — by email, at no charge.
01Who is responsible for your information
KendTech SOLUTIONS is the organisation that decides how and why information is collected through this website. We are a technology services business founded in 2022, operating in the Independent State of Papua New Guinea, working from the University of Papua New Guinea Main Campus in Port Moresby.
| Channel | Detail |
|---|---|
| Email (privacy queries) | info@kendtech.com — put Privacy in the subject line |
| Telephone | +675 7877 8574 |
| Post | KendTech SOLUTIONS, UPNG Main Campus, Telikom Road, Konedobu, National Capital District, Papua New Guinea |
| In person | Any business weekday during our working hours — ask for the website administrator |
We are a small company and do not meet any threshold that requires a designated Data Protection Officer. Accountability sits with the owner of the business, and day-to-day handling sits with the website administrator, who is the only person able to see every record in the dashboard.
Papua New Guinea does not yet have a single comprehensive data protection Act in force. We are guided by the National Data Governance and Data Protection Policy 2024 issued by the Department of Information and Communications Technology (DICT), we plan against the Data Governance and Data Protection Bill 2026 while it is being finalised, and we voluntarily apply the better-known international standards (the EU GDPR and the Australian Privacy Principles) to the handling described in this policy. Where we say "lawful basis" or "your rights", we mean those standards as our own minimum — not a claim that a PNG statute compels it today.
02The information we collect
Three sources only: what you type to us, what our servers necessarily record to serve you a page, and what a third party tells us about a payment you made.
| Category | What we hold | How it arrives |
|---|---|---|
| Enquiry information | Name, email address, optional phone number, subject, your message, and the date we received it | The Contact form, or email and phone calls you send us directly |
| Newsletter information | The email address you type, and the date you subscribed | The subscribe panel and footer form |
| Order information | Your chosen name and email, the file you bought, amount and currency, order reference, payment method, the provider’s transaction reference, and dates of payment, refund or dispute | The Digital Marketplace checkout, and the confirmation sent by your payment provider |
| Application information | Your name, email, phone number, CV, portfolio and anything else you choose to write | Your own email to info@kendtech.com — the Careers pages prepare the subject line and do not host an upload form |
| Discussion information | The name and email address you type when you comment, the words you posted, a one-way fingerprint of your email address (used to draw the picture beside your name), the page it belongs to, whether it answers someone else, the approval status, and the IP address and browser recorded at the moment you posted | The comment form at the foot of a project story, an insight or a career page. Nothing is collected unless you choose to post |
| Chat questions | The text you type into the Mr Lao window, for the length of that conversation | Your browser, passed straight to our AI provider — we do not store the transcript |
| Technical records | IP address, browser and device type, the page requested, timestamp, and the size of the response | Our web server and application logs, which exist so a site can be debugged at all |
| Search terms | The word or words you typed into the search box, the number of results we returned, and the date — counted on our own server. No name, no email address, no IP address, no cookie and nothing else about you is attached to it | The search box in the header, and only when you run a search (not on every keystroke) |
| Dashboard account | Name, sign-in email, a one-way password hash, your role, whether the account is enabled, your last sign-in time and your profile photo | Created by an Administrator on the Users desk |
| Uploaded media | The images and documents that our team uploads through the dashboard for pages, projects and products | Our own staff, not visitors |
We do not ask for, and you should not send: card numbers or CVV codes, passwords to other services, national ID or passport images, bank statement PDFs, or anything about health, religion, political opinion, sexual orientation or criminal history. Those are special categories of data that this website has no business holding. If an enquiry needs them, it is handled offline on a signed engagement — not through this form.
03Why we use it, and the lawful basis
Every use below maps to a purpose a reasonable person would expect from the interaction that created it.
| We do this | Using this | Our basis |
|---|---|---|
| Answer your enquiry, quote you, or take a project forward | Enquiry information | Legitimate interest — you contacted us expecting an answer |
| Deliver a file you bought and prove the sale | Order information, email address | Performance of a contract |
| Send your PDF receipt and re-send it if you lose it | Name and email address | Performance of a contract, and our record-keeping duty |
| Send the briefing newsletter, and only that | Newsletter email address | Consent, given when you subscribed |
| Reply inside the chat window | Your question text | Consent, via the AI assistant cookie choice |
| Assess a job application and keep in touch about the role | Application information | Steps taken at your request before a contract, and legitimate interest in recruiting |
| Read your comment, publish it when we approve it, and tell the team it arrived | Discussion information | Consent — you chose to post — and legitimate interest in moderating what appears under our name |
| Email you when your comment goes on the page | The email address on your comment | Your own action in posting; whether we send it is a setting on our Comments desk |
| Keep the site working, spot abuse, diagnose faults | Technical records | Legitimate interest in a secure, available service |
| See what readers search for, and where we have nothing to show them | Search terms, counted in aggregate | Legitimate interest in improving what we publish — run on our own server, holding no personal data, attaching nothing to you, and switchable off by an Administrator at any time |
| Control who can change the website or see money records | Dashboard account information | Legitimate interest, and a duty of care over our systems |
| Meet tax, audit and company record obligations | Order information and receipts | Legal obligation where PNG or client accounting requires it |
Consent given through the cookie banner is what allows anything optional — the map panel and the AI assistant — to load. Refusing it changes nothing else about your visit.
04Cookies and browser storage we use
The Cookie Policy lists every cookie by name, how long it lives and how to change your mind. In summary: this site sets one session cookie so the server can recognise you between page loads and so the checkout does not lose your order; one consent cookie that records your answer to the banner; and, only if you subscribe to the briefing, one small cookie that remembers you did so the newsletter panel stops appearing. Nothing else of its own.
We use no advertising cookies, no cross-site tracking, no fingerprinting, no re-marketing pixels, and no third-party analytics platform — no script from another company is ever loaded on your screen, and there is no consent option for advertising analytics because there is none to consent to.
One thing we do count, on our own server: when you run a search we record the words you typed and how many results we returned, so we can see what readers look for and where the site has nothing to show them. It is not attached to you — no IP address, no cookie, no session and no identity — a search term on its own is not personal data, and an Administrator can switch the counting off at any time. If we ever add anything that is a tracker, or that sets a cookie, it appears in this policy and in the banner before it goes live.
The newsletter panel remembers two things and nothing else. If you subscribe, a first-party cookie (kt_subscribed) marks that you did, so the panel never appears for you again — it is the direct result of an action you took, holds no personal data, and is not used to follow you. If you merely close the panel, a four-minute pause is kept in a short cookie (ktModalDismissed, only when you have allowed Preferences) so it does not pounce on the very next page; it then reappears, and it clears on its own within four minutes. Anyone who has not allowed Preferences keeps that pause in ordinary session storage for the current tab only.
05Payment information in the Digital Marketplace
When you choose a payment method you are sent to infrastructure your provider controls — a bank portal, a card network’s hosted checkout, or a PNG payment facilitator. Card details are typed into their page, under their security regime. KendTech never receives, sees, transmits or stores a primary card number, expiry date or security code.
To finish the order we pass your name, email address, the amount, the currency and our order reference to the provider, and the provider passes the result back to us. What lands in our ledger is therefore: the amount, currency, method, provider transaction reference, status, timestamps, and the provider’s own response text — which can repeat the name and email you gave them. Nothing more.
What we keep after a payment is made:
- Bank deposit in Kina — you transfer to our account quoting your order reference; we record the date, amount and who confirmed it in our account.
- Hosted card or wallet checkout — we record the provider’s session or order identifier so a refund or dispute can be traced years later.
- Receipt — a PDF holding your name, email, item, amount, reference and date, generated on request and emailed when email delivery is switched on.
- Webhook records — each server-to-server notification from a provider is kept once, with its event identifier, so a replayed message cannot release a download twice.
The thank-you page, receipt and download for an order sit behind a random order reference such as KT-6f2a9c13 rather than a login. That reference is not guessable, but it is the only thing guarding the file — so keep your order email private and do not post the link publicly.
06The Mr Lao assistant
The chat window answers questions by sending the text you type to an external artificial-intelligence service. Nothing is sent until you have allowed the AI assistant choice in the banner, and the window will not let you submit a question before then.
Do not type anything into it that you would not want read by a third party: no passwords, no account numbers, no client-confidential material, no personal information about another person. If you need to discuss something sensitive, email us or call, and we will sign a confidentiality agreement first.
Mr Lao’s replies are generated automatically and can be wrong. They are guidance, not a quotation, and they are not legal, financial, tax or engineering advice. Prices and scope only ever become firm in a written KendTech quotation.
07Comments and the discussion
Project stories, Insights and Career pages carry a discussion underneath. Anyone can write into it — you do not need an account, and nothing is collected from you if you only read.
What appears on the page for a published comment is deliberately small:
- The name you typed when you posted, exactly as you typed it.
- A picture this website draws from your email address — a coloured square with your initials, generated on our own server.
- Your words and the date you posted them, plus a KendTech team badge on a reply written by our own staff.
What never appears on a page: your email address, your IP address, your browser details, and whether your comment was still waiting for approval. Those live only in the Control Centre, where the Administrator, the Content Editor and any role they have granted can read them for moderation. Comment records are exported as a CSV only from that same authenticated desk — they are not sold, shared or handed to any third party.
Every comment is read by a person before it is published. Moderation is switched on in the code that ships, so a fresh deployment never leaks an unread comment onto a page; turning it off is a deliberate choice an Administrator makes on the Comments desk. An approved comment can be pulled back to unpublished at any time, and a comment that a filter marks as advertising is kept hidden rather than deleted, so the author can still ask us about it.
The picture is drawn locally on purpose. Gravatar, the optional external avatar service, is off by default; if an Administrator turns it on, the request that leaves your browser carries only a one-way fingerprint of the commenter’s email address, and a person without a Gravatar account still gets the picture this site drew. Your consent choice in the banner does not gate that request, because it is not tracking — it is the same class of image we would otherwise render ourselves — so we disclose it here and on the Comments desk instead.
Ask for a comment to go, and it goes. Email info@kendtech.com with Comment in the subject and, if you can, the page it sits on or the reference beginning CMT- that our own team can find for you. We delete the comment and its replies, and confirm to you when it is gone. Deleting a project story, an insight or a career page deletes the discussion under it automatically.
We record the IP address and browser of a posting for abuse control only — to stop a machine filling the form or a person hammering a page after being refused. It is not used to build a profile and it is not shown to anyone but the staff who moderate.
08Email you receive from us
Transactional email — receipts and download confirmations — is part of the sale you started, so it needs no separate consent. The KendTech Briefing newsletter does need it, and it is only sent to addresses that were typed into the subscribe panel.
There is no automatic unsubscribe link and no open-tracking pixel in our email today. To come off the list, reply to any message or email info@kendtech.com with the word Unsubscribe; we remove the address from the dashboard and confirm to you. We may still email a person who is a current client about their own project.
09Who we share information with
We share with the fewest parties possible, only for the job each one does, and never with anyone who wants to buy a list.
| Party | Why they are involved | What they receive |
|---|---|---|
| Payment providers and banks | To take your money and tell us you paid | Name, email, amount, currency, order reference — card details go to them only |
| Our web host and its network | To serve this website to you | The page you requested, plus your IP address |
| Our email provider (SMTP) | To deliver receipts and reply to you | The recipient address and the message, including receipt data |
| Our AI provider | Only if you allow the assistant and ask a question | The question text you typed |
| Fonts for the design; the map panel once you accept it | Your IP address and the page being viewed | |
| Gravatar, run by Automattic (WordPress) | Only on the picture beside a comment, and only if an Administrator switches the Gravatar option on on the Comments desk — it is off by default | The one-way fingerprint of the email address on the comment. Never the address itself, never your words, and never the page it was posted on |
| Our own staff and contractors | Support, bookkeeping and the occasional repair | Only the records their role needs — money views are limited to Administrators |
| Your supplier, bank or auditor | Only when a project deliverable requires it | Nothing from this website without your instruction |
| Police, courts or a regulator | If a valid legal demand requires it | The minimum the demand specifies, with the request kept on file |
No party above is permitted to use your information for their own marketing. Our payment providers process data under their own policies, which are worth reading: they are the ones holding the card relationship.
10Where your information is held
Website records — enquiries, subscribers, orders, pages, accounts — live in our own application database on the server that hosts kendtech.com. Backups are copies of that database, stored under the same controls and not shared outside the business.
Some of the services named above operate data centres outside Papua New Guinea, and the DICT’s draft framework would call that a cross-border transfer. We accept that where the alternative is a worse service — a payment provider that cannot settle in Kina, or a font service nobody uses — and we limit each one to the smallest set of data, in transit over HTTPS. Ask us who holds what, and where, at any time.
11How we protect it
Controls are proportionate to a small business holding contact details and sales records — not a bank. What is actually in place on this site:
- Passwords are salted and one-way hashed with the scrypt algorithm. Nobody, including an Administrator, can read a stored password; the only way to change one is to set a new one.
- Sign-in sessions use cookies marked HttpOnly and SameSite=Lax, and Secure where the site is served over HTTPS.
- Every form is CSRF-protected, so a third-party page cannot submit an enquiry or a dashboard change as you.
- Role-based access in the dashboard: a Viewer cannot edit, an Editor cannot see money, and only an Administrator can confirm a payment, issue a refund or add a user.
- Uploads are restricted by file type and size, and filenames are sanitised before they are written to disk.
- Sensitive operations are logged — every payment confirmation, refund and account change carries the timestamp and the account that made it.
- A minimum password length is enforced for staff accounts.
- The comment form is protected the same way every other form on this site is (a CSRF token), plus a hidden field that only a machine would fill, a short pause between posts from the same person, a cap on how many comments one address may send in an hour, and a length and link limit that stops a wall of advertising.
One honest limitation: files uploaded through the dashboard are served from a predictable web directory. Anything genuinely confidential — a client’s financial statements, a passport scan, a bank login — must not be uploaded as website media. Ask us for a private channel instead.
12How long we keep your information
We are not able to promise automatic deletion on a date for the records below, because this site has no general scheduled purge; what we can promise is the review below, and a delete-on-request that we honour in writing. The single exception is the aggregate search-term count, which removes its own oldest rows on a fixed window (see the search-terms row below).
| Information | Our retention rule |
|---|---|
| Enquiries that became a project | Life of the engagement, then at least the period our accounting and client records require |
| Enquiries that went nowhere | Up to 24 months, so we can honour a quote we sent, then deleted on our annual review |
| Newsletter subscribers | Until you unsubscribe or we close the list |
| Job applications | Up to 12 months after we answer you, so a later opening can be offered to you; deleted on request before that |
| Comments on a page | Until the page is retired (which deletes its discussion with it) or you ask us to take a comment down. A comment we marked as advertising is cleared on our own review rather than kept forever |
| Orders, receipts and payment records | Accounting and tax retention — the payment history is not deleted while it could still be audited or disputed |
| Chat conversations | Not stored by us; the AI provider’s own retention applies to what you typed |
| Server logs | Roughly 30 to 90 days, depending on the hosting plan, then rotated away |
| Search terms (aggregate count) | Up to 180 days by default, oldest rows removed automatically when an Administrator opens the insights desk; the window and the counting itself are both switchable, and the record holds no personal data either way |
| Dashboard accounts | Until the person leaves the team, when an Administrator disables the account |
| Uploaded media | Until the page it belongs to is retired |
Deletion request, in practice: email us, we confirm the record we found, remove it from the live database, and tell you in writing when it is gone. Backups age out on their own cycle, so a deleted record disappears from them at the next rotation.
13Your rights, and how to use them
These mirror the rights set out in PNG’s draft national framework and in the GDPR. They cost you nothing, and you do not need a lawyer or a form to use them. Email info@kendtech.com with Privacy in the subject.
| Right | What it means here |
|---|---|
| Access | A copy of everything we hold about you, in a readable file |
| Information | A plain answer to what we hold, why, who sees it and for how long — this policy is that answer; ask for yours specifically |
| Correction | Fix a wrong name, email or order detail |
| Erasure | Delete your enquiry, subscription, comment or account, subject to the records we must legally keep |
| Restriction | Pause use of your data while a dispute about it is settled |
| Objection | Say no to a use based on legitimate interest; we stop unless we can show a compelling reason |
| Portability | Your enquiry or order history as structured data — CSV or JSON — that you can hand to someone else |
| Withdraw consent | Re-open the banner at any time and turn the map or the assistant off |
| Human review | Ask a person, not a system, to look again at a decision we made about you |
| Complain | Escalate to us, and then to the authority that applies — see the next clause |
We reply within 10 working days. If a request is genuinely complex we will tell you the same week. We may need to confirm the email address we hold for you before releasing anything — we will never accept a request that could hand a stranger someone else’s order history.
14Children
This website is a business service and is not aimed at children. We do not knowingly collect information from a person under 16. A young entrepreneur or student may email us through a parent, guardian or teacher. If you believe a child has given us information, tell us and we will delete it promptly and confirm the removal.
15Visitors outside Papua New Guinea
Our clients are mainly in PNG. When someone in the European Economic Area, the United Kingdom or Australia uses this site, we still handle their data as this policy describes, and in addition: for EU or UK visitors you may lodge a complaint with your national data protection authority or with the European Data Protection Board; for Australians, with the Office of the Australian Information Commissioner. Nothing above needs you to give us a different basis — we are simply telling you the door exists.
We do not target advertising at any country, run price discrimination by location, or transfer data internationally beyond the services named in this policy.
16Complaints, and how we escalate
Start with us. Most privacy problems are a stale record or a form that asked for too much, and we would rather fix it than have you carry it. Email info@kendtech.com with Privacy in the subject; we acknowledge within 2 working days and answer substantively within 10.
If you are not satisfied with our answer, your options in Papua New Guinea include the Department of Information and Communications Technology (DICT) — the national ICT authority, PO Box 784, Vision City, National Capital District — which administers the National Data Governance and Data Protection Policy and is expected to administer the Data Governance and Data Protection Bill when it commences. Depending on the nature of the complaint you may also use the Office of the Ombudsman Commission, the Consumer and Competition Authority, or your own country’s regulator if you are outside PNG.
Reported security incidents matter more than comfort. If a breach exposes your personal information, we will contain it, tell you what happened and what we are doing, and notify the relevant authority where the law or the national policy requires it — without waiting for you to ask.
17Changes to this policy
We review this policy every six months (next review 1 May 2027) and whenever we add a script, a form, a processor or a payment method. The version and effective date sit at the top of the page, the document number is KT-LEG-001, and material changes to how we use personal information are announced on the website before they take effect — not buried afterwards.
Using the site after a change means the new policy applies to visits from that date. Old versions are available on request.
We will explain it in plain language.
Privacy Policy — version 1.4, effective 3 November 2026, next review 1 May 2027. Email, call or walk in and we will tell you exactly what we hold, what a clause means for you, or how to change your cookie choice.
This policy is published by KendTech SOLUTIONS and states what this website actually does. It is provided for information and is not legal advice; for a project engagement, our signed quotation and agreement govern the work. Have a Papua New Guinea practitioner review these documents before you rely on them commercially.