Privacy Policy

1. Who we are

Kenafric Industries Limited ("Kenafric", "we", "us", "our") is the data controller responsible for the personal data described in this policy. We manufacture confectionery, culinary and beverage products and are registered and operating in Kenya.

• Registered office: Kenafric Industries Limited, Baba Dogo Road, Ruaraka, P.O. Box 41833-00100, Nairobi, Kenya
• Privacy contact: info@kenafricind.com

This policy explains what personal data we collect through this website, why we collect it, the lawful basis on which we use it, how long we keep it, who we share it with, and the rights you have. It is written to meet the Kenya Data Protection Act, 2019 and its Regulations, and the EU and UK General Data Protection Regulation (GDPR) where these apply to visitors located in the European Economic Area or the United Kingdom.

2. The personal data we collect

2.1 Enquiries and contact forms

Your name, email address, telephone number, company or organisation, the department or subject you select, and the content of your message.

2.2 Chat assistant conversations

Our website offers an automated chat assistant. We store the messages you send and the replies given, together with a randomly generated session identifier, the date and time, and the language chosen. If you ask to be contacted or to speak to a person, we also store the name, email address and telephone number you provide in the chat. Please do not enter sensitive personal information, payment card details or passwords into the chat.

2.3 Careers applications

If you apply for a vacancy, we collect your name, email address, telephone number, the role applied for, your curriculum vitae, cover note and any other information you submit. Vacancy and application records are held in Airtable, our recruitment records provider.

2.4 Website usage, cookies and analytics

We collect device and usage data such as IP address, browser type, operating system, pages viewed, referring page and approximate location derived from IP. This is collected through cookies and similar technologies, including Google Analytics 4, Google Tag Manager, Google Ads conversion and remarketing tags, and the Meta (Facebook) Pixel. These are only set after you accept them in our cookie banner, except for cookies strictly necessary to run the site.

2.5 Administrator accounts

For staff who manage the website we hold a name, email address and role permissions.

We do not knowingly collect data from children under the age of 18, and we do not collect special categories of personal data through this website.

3. Why we use your data and our lawful basis

• Responding to your enquiry or contact request: steps taken at your request before or under a contract, and our legitimate interest in responding to enquiries.
• Operating the chat assistant and following up on chat enquiries: your consent when you start a conversation, and our legitimate interest in customer support.
• Assessing job applications and contacting candidates: steps taken at your request before entering an employment contract, and our legitimate interest in recruitment.
• Analytics, measuring website performance and improving content: your consent given through the cookie banner.
• Advertising, remarketing and measuring campaigns on Google and Meta: your consent given through the cookie banner.
• Website security, fraud prevention and abuse monitoring: our legitimate interest in protecting the site and its users.
• Meeting legal, tax and regulatory obligations: compliance with a legal obligation.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. Cookies and tracking technologies

• Strictly necessary: required for the website to function, including your cookie choice and your sign-in session. These cannot be switched off.
• Analytics: Google Analytics 4 and Google Tag Manager, used to understand how the site is used.
• Advertising: Google Ads and the Meta Pixel, used to measure campaigns and to show you relevant advertising on Google and Meta platforms, including remarketing to people who have visited this site.
• Functional: remembering preferences such as the language used in the chat assistant.

You control analytics and advertising cookies through the banner shown on your first visit, and you can change your decision at any time by clearing your browser storage for this site and reloading the page. You can also opt out directly through the providers:

• Google privacy policy: policies.google.com/privacy. Google Analytics opt-out: tools.google.com/dlpage/gaoptout. Google Ads settings: adssettings.google.com
• Meta privacy policy: facebook.com/privacy/policy. Meta ad preferences: facebook.com/adpreferences

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our instructions, and with authorities where the law requires it. Our providers include:

• Supabase, for database, authentication and file hosting
• Lovable, for website hosting and delivery
• Google (Analytics, Tag Manager, Ads), for measurement and advertising
• Meta Platforms, for advertising measurement through the Meta Pixel
• Airtable, for recruitment and vacancy records
• Our artificial intelligence provider, which generates chat assistant replies from the messages you send and our published website content
• Professional advisers, auditors and regulators where we are legally required to disclose

6. International transfers

Some of the providers listed above store or process data outside Kenya, including in the United States and the European Union. Where personal data leaves Kenya, we rely on the safeguards permitted by sections 48 and 49 of the Data Protection Act, 2019, namely contractual data protection terms with each provider that impose standards comparable to the Act, and transfers that are necessary for the performance of a contract with you or for our legitimate business purposes. For transfers out of the EEA or the UK we rely on the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum. You may request a copy of the relevant safeguards by writing to us.

7. How long we keep your data

• Contact and enquiry records: 24 months from your last contact with us
• Chat assistant conversations: 12 months, unless they form part of an ongoing enquiry
• Careers applications: 12 months after the recruitment decision, unless you ask us to keep your details longer for future roles
• Analytics and advertising data: as configured with the provider, up to 14 months
• Administrator accounts: for as long as the person holds an active role, then 12 months
• Records we must keep by law, such as tax records: for the period the law requires

When a retention period ends we delete the data or anonymise it so that it can no longer identify you.

8. How we protect your data

We use encrypted connections (HTTPS) across the site, encryption of credentials at rest, row-level access rules on our database so records are only visible to those entitled to see them, role-based access for staff, and sanitisation of all content published through our content management system. Access to personal data is limited to staff who need it for their role.

9. Your rights

Under the Data Protection Act, 2019 and, where it applies, the GDPR, you have the right to:

• be informed of how your data is used
• access the personal data we hold about you
• have inaccurate or incomplete data corrected
• have your data deleted where it is no longer needed or where you withdraw consent
• object to processing based on our legitimate interests, and to object to direct marketing at any time
• request that we restrict processing while a concern is resolved
• receive your data in a portable, machine-readable format and have it transmitted to another controller
• withdraw consent at any time where processing is based on consent
• not be subject to a decision based solely on automated processing that produces legal effects for you. We do not make such decisions. Our chat assistant generates replies automatically but does not make decisions about you.

To exercise any right, write to info@kenafricind.com. We will respond within the timelines set by the Act. We may ask you to confirm your identity before we act on a request. There is no fee unless a request is manifestly unfounded or excessive.

10. Complaints

If you are not satisfied with how we have handled your data, you may lodge a complaint with the Office of the Data Protection Commissioner, Kenya, at www.odpc.go.ke or by email to info@odpc.go.ke. If you are in the EEA or the UK, you may also complain to your local supervisory authority or the UK Information Commissioner's Office.

11. Data breaches

If a personal data breach occurs that presents a real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the Act or the GDPR requires it.

12. Third-party links

Our website links to retailer, distributor and social media sites that we do not control. This policy does not apply to those sites, and we encourage you to read their privacy notices.

13. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The date shown above indicates when it was last revised. Material changes will be highlighted on this page.

14. Contact us

Kenafric Industries Limited, Baba Dogo Road, Ruaraka, P.O. Box 41833-00100, Nairobi, Kenya. Email info@kenafricind.com.