Privacy Policy
Last updated: [PLACEHOLDER: Policy date]
About this policy
This policy explains how [PLACEHOLDER: Registered entity name] (“Calder”, “we”, “us”) collects, uses, stores, shares and protects personal data when you visit this website, contact us, request an assessment or demonstration, enquire about a partnership or subscribe to our commercial insights.
We are based in Kenya and use the Data Protection Act, 2019 and the regulations made under it as our primary framework for handling personal data.
This policy does not cover personal data we process on behalf of our clients when we build or operate systems for them. That processing is governed by our agreements with those clients, including any data processing agreement.
Who is responsible for your personal data
The organisation responsible for the personal data described in this policy is:
- Organisation: [PLACEHOLDER: Registered entity name]
- Address: [PLACEHOLDER: Registered or postal address]
- Privacy enquiries: [PLACEHOLDER: Privacy enquiries email]
The personal data we collect
Information you give us
When you complete a form on this website, we collect the information you choose to provide. Depending on the form, this may include:
- your name, job title or position and the organisation you work for;
- your work email address and telephone number;
- your organisation’s industry and location;
- a description of your organisation and the opportunity, challenge or partnership you want to discuss;
- the demonstration you are interested in;
- your preferred contact method;
- your consent choices, including the date and time you gave them.
Our forms are designed for business enquiries. Please do not send us confidential contracts, identity documents or sensitive personal, legal or financial information through them. If we need documents later, we will arrange a secure route.
Information collected automatically
When you use this website, our systems process limited technical information needed to deliver the site and keep it secure, such as your IP address, browser type and the pages requested. To protect our forms from abuse, we record a one-way scrambled (hashed) version of your IP address, which we use to limit repeated submissions. We do not store your IP address in readable form with your enquiry.
If we use analytics or other non-essential cookies, we do so only with your consent. Our Cookie Policy explains this in detail.
Information from correspondence
If you email or call us, we keep a record of that correspondence so that we can respond and maintain an accurate history of our discussions.
Demonstrations
Our interactive demonstrations run in your browser using fictional data. Anything you type into a demonstration is not sent to us or stored by us.
How we use your personal data and why
We use personal data only for specific purposes and only where we have a lawful basis to do so.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Responding to your enquiry, assessment, demonstration or partnership request | Contact and organisation details, enquiry content, preferred contact method | Our legitimate interest in responding to business enquiries, or taking steps at your request before entering into a contract |
| Sending you an acknowledgement of your submission | Name, email address, enquiry reference | Our legitimate interest in confirming that we received your enquiry |
| Sending commercial insights | Email address and, if provided, name and industry of interest | Your consent, which you can withdraw at any time |
| Protecting our website and forms from spam and abuse | Hashed IP address, submission timing, form content | Our legitimate interest in keeping our website secure |
| Understanding how our website is used, where enabled | Analytics cookie data | Your consent |
| Managing an agreed business relationship | Contact details, correspondence, project information | Performance of a contract |
| Meeting legal, tax and regulatory obligations | Records required by law | Compliance with a legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are balanced against your rights. You can object to processing based on legitimate interests at any time.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
Consent and withdrawing it
Where we rely on your consent, it is requested separately and is never pre-selected. You can withdraw consent at any time by using the unsubscribe link in any insights email, by changing your cookie preferences or by contacting us at [PLACEHOLDER: Privacy enquiries email]. Withdrawing consent does not affect processing that took place before you withdrew it.
Direct marketing
We send marketing communications only to people who have asked to receive them. Our commercial insights subscription uses a confirmation step, so that you are subscribed only after confirming your email address. Every message includes a way to unsubscribe.
Who we share personal data with
We do not sell personal data.
We share personal data only where necessary, with:
- members of our team who need it to respond to you or manage our relationship;
- service providers who support our website and operations, such as hosting, email delivery, analytics and customer relationship management providers, acting on our instructions and under appropriate contractual terms;
- professional advisers, such as lawyers and accountants, where needed;
- authorities, regulators or courts where we are required to by law.
[PLACEHOLDER: List the service providers used for hosting, email delivery, analytics and any CRM, with their location, before launch.]
Transfers outside Kenya
Some of our service providers may store or process personal data outside Kenya. Where this happens, we transfer personal data only in accordance with the Data Protection Act, 2019 and its regulations, for example where appropriate safeguards are in place for the security and protection of the data, or where another lawful condition for transfer applies.
[PLACEHOLDER: Confirm whether any provider processes data outside Kenya, where, and the safeguard relied on.]
How we protect personal data
We use technical and organisational measures appropriate to the risk, including encrypted connections to this website, restricted access to enquiry records for authorised staff, server-side validation of form submissions, protection against automated abuse and hashing of IP addresses used for security purposes. Access to enquiry records is limited to people who need it for their role.
No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to you, we will act in accordance with our obligations under the Data Protection Act, 2019, including notifying the Office of the Data Protection Commissioner and affected individuals where required.
How long we keep personal data
We keep personal data only for as long as necessary for the purpose it was collected for, including any legal, accounting or reporting requirements.
- Enquiries that do not lead to a business relationship: [PLACEHOLDER: retention period to be confirmed]
- Commercial insights subscriptions: until you unsubscribe, after which we keep a minimal record of your unsubscribe request so that we do not contact you again.
- Client and contract records: [PLACEHOLDER: retention period to be confirmed]
When personal data is no longer required, we delete it securely or anonymise it.
Your rights
Under the Data Protection Act, 2019, you have the right to:
- be informed of the use to which your personal data is to be put;
- access your personal data held by us;
- object to the processing of all or part of your personal data;
- have false or misleading data corrected;
- have false or misleading data deleted, and request deletion where the law allows;
- request that we restrict processing in certain circumstances;
- receive personal data you provided to us in a structured, commonly used and machine-readable format, where the law provides for this;
- withdraw your consent where we rely on it;
- not be subject to a decision based solely on automated processing that significantly affects you, subject to the exceptions in the law.
How to exercise your rights
To exercise any of these rights, contact us at [PLACEHOLDER: Privacy enquiries email]. We may need to verify your identity before acting on a request. We will respond within the time required by law. Exercising your rights is free of charge, except where the law allows us to charge a fee.
How to make a complaint
If you are concerned about how we handle your personal data, please contact us first at [PLACEHOLDER: Privacy enquiries email] so that we can try to resolve it.
You also have the right to lodge a complaint with the Office of the Data Protection Commissioner. Details are available at www.odpc.go.ke.
Children
This website and our services are intended for businesses and organisations. We do not knowingly collect personal data from children.
Links to other websites
This website may link to other websites. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Where changes are significant, we will take reasonable steps to bring them to your attention.
Contact
For any question about this policy or our handling of personal data, contact [PLACEHOLDER: Privacy enquiries email].