Privacy Policy

Octa Architects Ltd is an architectural and interior design firm serving clients in Nairobi, across Kenya and the wider East African region. We are the entity that decides how and why your personal data is processed.

Our details and data protection contact are:

• Data controller: Octa Architects Ltd
• Registered office: 3rd Floor, Design Centre, Tausi Road, Off Muthithi Road, Westlands, Nairobi, Kenya
• Postal address: P.O. Box 16270-00100, Nairobi, Kenya
• Email: info@octaarchitects.co.ke
• Telephone: +254 727 468827

If you have any questions about this policy or wish to exercise any of your rights, please contact us using the details above and mention "Data Protection" in your message so that it reaches the right person promptly.

This policy applies to personal data we collect through our website, by email, telephone, WhatsApp, in person or during the course of our professional engagements. It covers:

• Visitors to our website, including anyone who completes our enquiry, contact or appointment forms.
• Prospective clients requesting quotations, consultations or design proposals.
• Existing clients whose projects we are designing, managing or advising on.
• Contractors, consultants, suppliers and other professional contacts we work with.
• Job applicants and people who send us their curriculum vitae or portfolio.

It does not apply to third-party websites or services that we link to, which are governed by their own privacy policies (see section 14).

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and contact data: your name, email address, telephone number, postal or physical address and, where relevant, your company or organisation.
• Enquiry and project data: the content of your messages, project briefs, site and plot details, drawings, specifications, budget information and any preferences or requirements you share with us.
• Recruitment data: the curriculum vitae, portfolio, references, qualifications and cover letters of people applying to work with us.
• Technical and usage data: your IP address, browser and device type, approximate location derived from your IP address, the pages you view, the referring page and cookie or similar identifiers when you use our website.
• Communication records: notes and records of our calls, emails, WhatsApp messages and meetings with you.

We do not intentionally collect your sensitive or special category personal data (such as health data, religious beliefs or political opinions). Please do not include such information in messages to us unless it is genuinely necessary for your project.

• Directly from you: when you complete a form on our website, email, call or message us, or meet with us in person.
• Automatically: when you browse our website, our web server and any cookies or similar technologies record limited technical and usage data.
• From third parties: for example where a client, partner or colleague refers you to us, or from publicly available sources used to verify a professional contact.

Under the Data Protection Act, 2019 we must have a lawful basis for processing your personal data. We use your data only for the purposes described below, and we rely on the corresponding lawful basis:

• Responding to your enquiry and preparing quotations or proposals — because it is necessary to take steps at your request before entering into a contract, and for our legitimate interest in running our practice.
• Delivering design, project management and other professional services — because it is necessary to perform our contract with you.
• Managing and administering our client relationships, records and billing — for the performance of our contract and our legitimate interests.
• Complying with legal, tax, regulatory and professional obligations (for example, records required by the Kenya Revenue Authority or our professional bodies) — because we have a legal obligation to do so.
• Sending you information about our services, insights or updates — where you have given your consent, or where we have a legitimate interest in keeping you informed and you have not objected. You can ask us to stop at any time.
• Assessing job applications — on the basis of your consent and our legitimate interest in recruiting suitable staff.
• Operating, securing and improving our website — for our legitimate interests in protecting our site, understanding how it is used and making it better.
• Establishing, exercising or defending legal claims — for our legitimate interests and the establishment, exercise or defence of legal claims.

Where we rely on your consent, you may withdraw it at any time (see section 11). Withdrawing consent does not affect processing carried out before you withdrew it.

Our website uses a small number of cookies and similar technologies that are necessary for the site to function and to help us understand how it is used. We do not use cookies for third-party advertising.

• Strictly necessary: these are required for basic site functionality and security and cannot be switched off through our site.
• Analytics and performance: these help us understand which pages are visited and how visitors move around the site so that we can improve it.

You can control or delete cookies through your browser settings. If you disable cookies, some parts of the website may not work as intended.

Our contact form submissions are processed on our behalf by Formcarry, a third-party form-handling service that acts as our data processor. Information you enter into a form is transmitted to and stored by that provider only so that we can receive and respond to your message.

We do not sell or rent your personal data. We share it only where necessary, and only with parties bound to protect it, as follows:

• Professional teams: consultants, contractors, engineers, quantity surveyors and specialists engaged on your project, where sharing is required to deliver our services.
• Service providers: trusted suppliers such as our website host, email provider, IT and form-handling providers (for example Formcarry), who process data on our instructions.
• Professional advisers: our lawyers, accountants, insurers and other advisers, where needed to run our practice.
• Authorities and regulators: government, tax, county, professional and other bodies where we are required to disclose data by law, or where it is necessary to protect our legal rights.
• Business successors: in the event of a merger, restructuring or sale of our business, personal data may be transferred as part of that transaction, subject to this policy.

Every processor we engage is required by contract to keep your data confidential and secure and to process it only on our documented instructions.

Some of our service providers may store or process data on servers located outside Kenya (for example, cloud hosting and email providers). Where personal data is transferred out of Kenya, we take steps to ensure an adequate level of protection as required by the Data Protection Act, 2019 — for example by relying on an approved transfer mechanism or putting appropriate contractual safeguards in place.

We keep personal data only for as long as is necessary to fulfil the purposes for which it was collected, and to meet our legal, professional and operational requirements. In practice:

• Enquiries that do not result in an engagement are kept for a reasonable period so that we can follow up, and are then securely deleted.
• Project and client records are kept for the duration of the engagement and afterwards for the period required by our professional indemnity, contractual and limitation obligations.
• Financial and tax records are kept for the period required by Kenyan law.
• Website usage data is retained only for as long as needed for the analytics and security purposes described above.

When data is no longer needed, we securely delete it or anonymise it so that it can no longer be linked to you.

We use appropriate technical and organisational measures to protect your personal data against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure. These include access controls and confidentiality obligations for our staff and contractors, encryption of data in transit, secure hosting and backups, and collecting only the data we actually need.

No method of transmitting or storing data over the internet is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where required, you, without undue delay as the law requires.

Under the Data Protection Act, 2019 you have the following rights in relation to your personal data:

• The right to be informed — to know how we use your personal data, as set out in this policy.
• The right of access — to request confirmation of whether we hold your data and to receive a copy of it, together with information about how it is processed.
• The right to rectification — to have inaccurate or incomplete personal data corrected.
• The right to erasure — to request deletion of your personal data where there is no lawful reason for us to keep it.
• The right to restriction of processing — to ask us to limit how we use your data in certain circumstances.
• The right to object — to object to processing based on our legitimate interests, and at any time to the use of your data for direct marketing.
• The right to data portability — to receive personal data you provided to us in a structured, commonly used and machine-readable format, and to ask us to transmit it to another provider where technically feasible.
• The right to withdraw consent — where we rely on your consent, to withdraw it at any time.
• The right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not carry out such automated decision-making.

To exercise any of the rights above, contact us at info@octaarchitects.co.ke or write to us at our registered office. Please provide enough information for us to understand your request and to verify your identity, so that we do not disclose data to the wrong person.

We will respond to your request within the timeframe set by the Data Protection Act, 2019 (in general, within thirty (30) days). Exercising your rights is free of charge, although we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act on them as the law permits.

Our website and services are directed at adults and are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take reasonable steps to delete it.

Our website may contain links to third-party websites and social media pages. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any website you visit through a link from ours.

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we do, we will revise the "Last updated" date at the top of this page. Where changes are material, we will take reasonable steps to bring them to your attention. We encourage you to review this page periodically.

We would appreciate the chance to address any concern you have about how we handle your personal data, so please contact us first at info@octaarchitects.co.ke.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the supervisory authority established under the Data Protection Act, 2019:

• Office of the Data Protection Commissioner (ODPC)
• Address: Britam Tower, 12th & 13th Floor, Hospital Road, Upper Hill, Nairobi
• Postal address: P.O. Box 30920-00100, G.P.O Nairobi, Kenya
• Email: info@odpc.go.ke
• Telephone: 020 7801800
• Website: https://www.odpc.go.ke