Privacy policy
Last updated 10 October 2026
This policy explains what personal data Kichele Group ("we", "us") collects through kichelegroup.com, why, how long we keep it, and the rights you have under the Data Protection Act, 2019 of Kenya and its regulations.
Who is responsible for your data
Kichele Group is the data controller for personal data collected on this website. For any privacy question or request, email [email protected] with "Privacy request" in the subject line.
What we collect and why
| When you | We collect | We use it to | Lawful basis |
|---|---|---|---|
| Send the contact form | Name, email, phone (optional), team chosen, your message, IP address | Reply to you and prepare a proposal | Steps you asked us to take before a contract |
| Leave a message in the chat | Name, email or phone, your message, the chat questions and answers shown on screen, IP address | Reply to your question | Steps you asked us to take before a contract |
| Request a call back | Name, phone number, topic, preferred time, IP address | Phone you at the time you chose | Steps you asked us to take before a contract |
| Subscribe to updates | Email address, where you subscribed, date of confirmation or unsubscription, IP address | Send occasional updates and deadline reminders | Your consent, confirmed by clicking the link we email you |
| Visit any page | IP address, browser type, pages requested, date and time (server logs) | Keep the site secure, stop abuse and fix errors | Our legitimate interest in running a secure website |
The chat assistant's ready-made answers run in your browser. Nothing you type in the chat is sent to us unless you press "Send to the team".
We do not use advertising trackers, sell personal data or use it for automated decisions that affect you.
Who we share it with
- Our hosting and email servers, which store website data and deliver email notifications to our team.
- Cloudflare, which delivers and protects this website and processes your IP address and request details to do so.
- Cloudflare Turnstile, which checks that forms are sent by a person and not an automated bot. When you use a form it processes your IP address and technical browser signals, and does not use them for advertising.
- Google Fonts and Unsplash, which deliver the typeface and photos on this site and receive your IP address when your browser loads them.
- WhatsApp (Meta), only if you choose to contact us on WhatsApp. Your conversation is then also subject to WhatsApp's privacy policy.
- Authorities, where Kenyan law requires us to disclose information.
Transfers outside Kenya
Some of the providers above, including our hosting provider, process data on servers outside Kenya. Where that happens we rely on the safeguards permitted by Part VI of the Data Protection Act, 2019, including the provider's contractual data protection commitments.
How long we keep it
- Enquiries, chat messages and call-back requests: 24 months after our last contact with you, unless they become part of a contract, in which case we keep them for the period the law requires for business records.
- Subscription records: until you unsubscribe. We then keep your email address and unsubscribe date only so that we do not email you again.
- Server logs: rotated and deleted after about 14 days. Aggregated, non-identifying visit statistics may be kept longer.
How we protect it
The site is served only over HTTPS. Data is stored in a password-protected database that only authorised staff can reach, and forms are protected against automated abuse with Cloudflare Turnstile, rate limits and anti-spam checks.
Your rights
Under sections 26 and 40 of the Data Protection Act, 2019 you can ask us to:
- tell you whether we hold data about you and give you a copy;
- correct data that is wrong or out of date;
- delete data that we no longer have a lawful reason to keep;
- stop using your data for a purpose you object to, including updates by email;
- give you your data in a format you can move to another provider.
Email [email protected] to make a request. We reply within the time the law sets, normally 7 days, and may ask you to confirm your identity first. Every update email also has a one-click unsubscribe link.
If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner at www.odpc.go.ke.
Children
This website is meant for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a child has sent us their details, contact us and we will delete them.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change affects how we use data you already gave us, we will tell you by email before it takes effect.