Privacy Policy.

Kertale Limited ("Kertale", "we", "us", "our") is a construction cost and project management consultancy registered in Kenya. Our registered address is P.O Box 30846, G.P.O, Nairobi, Kenya.

We are committed to protecting your personal data and handling it responsibly in accordance with Kenya's Data Protection Act 2019 (DPA 2019), the regulations made thereunder, and applicable international standards including the EU General Data Protection Regulation (GDPR) where it applies to our European contacts.

For data protection enquiries, contact us at: info@kertale.com

We may collect the following categories of personal data:

• Contact form data: Your name, email address, phone number, project type and message when you submit the contact form on this website.
• Email correspondence: When you email us directly, we retain that correspondence.
• Technical data: Your IP address, browser type, device type and pages visited, collected automatically by our hosting infrastructure (Cloudflare) for security and performance.
• Cookie data: A single localStorage preference key storing your cookie consent choice. We do not use advertising, tracking or analytics cookies.

We do not collect sensitive personal data (race, health, biometric, financial account details).

We use your personal data for the following purposes and legal bases:

We do not use your data for automated decision-making or profiling.

We do not sell your personal data. We share it only with:

• Cloudflare, Inc. — Our website hosting provider and email routing service. Your form submissions are processed through Cloudflare's infrastructure. Cloudflare is certified under the EU–US Data Privacy Framework.
• Google (Gmail): Enquiry emails are delivered to our Gmail inbox. Google is subject to their own privacy policy and applicable data protection laws.
• Professional advisers: Lawyers or accountants where necessary for legal or compliance obligations, bound by confidentiality duties.
• Regulatory authorities: Where required by law, such as the Office of the Data Protection Commissioner (ODPC) in Kenya.

As a Kenya-based business, your data is primarily processed in Kenya. Our hosting provider (Cloudflare) may process data on servers globally. Where data is transferred outside Kenya, we ensure appropriate safeguards are in place consistent with DPA 2019 Section 48.

• Contact form enquiries: Up to 3 years from last contact, or as required for any resulting contract.
• Technical / server logs: Up to 90 days, as managed by Cloudflare.
• Cookie consent preference: Until you clear your browser's local storage.

Under the Kenya Data Protection Act 2019 (and GDPR where applicable), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your data where there is no overriding legal reason to retain it.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any right, email us at info@kertale.com. We will respond within 21 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.

This website uses browser localStorage (not traditional cookies) to store only your consent preference. We do not use tracking pixels, advertising cookies, or third-party analytics scripts. No personal data is stored in localStorage.

To clear your preference, open your browser's developer tools and clear localStorage for this domain, or clear your browser's site data.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction, including HTTPS encryption (TLS 1.3) on all connections and access controls on our email systems.

Our website may contain links to third-party websites (e.g. Google Maps, social media). We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. The "last updated" date at the top of this page will reflect any changes. Material changes will be communicated where we hold your contact details.

Kertale Limited
P.O Box 30846, G.P.O
Nairobi, Kenya
Email: info@kertale.com
Tel: +254 722 751 880