Privacy Policy

1. Introduction

2. Personal Data We Collect

• Identity & Contact Data — full name, email address, phone number, physical address, and company name.
• Enquiry & Project Data — details you provide when submitting a contact form, requesting a quote, or describing a project.
• Communication Data — records of correspondence including emails, phone call logs, and meeting notes.
• Technical Data — IP address, browser type, device identifiers, pages visited, and time spent on our website (collected automatically via cookies and analytics tools).
• Recruitment Data — CV, qualifications, and employment history if you apply to join our team.

We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has submitted data to us, please contact us immediately.

3. How We Collect Your Data

• Directly from you — when you fill in our contact or enquiry forms, call or email us, or engage us for a project.
• Automatically — through cookies and tracking technologies when you browse our website.
• From third parties — such as referral partners, public tenders, or professional directories.

4. How We Use Your Data

• To respond to enquiries and provide information about our construction, renovation, civil works, and PPE supply services.
• To prepare and deliver project proposals, quotations, and contractual agreements.
• To manage ongoing projects and communicate project updates.
• To comply with legal, regulatory, and contractual obligations — including those under the National Construction Authority (NCA) Act, OSHA 2007, and NEMA regulations.
• To process supplier or partner onboarding.
• To send relevant service updates, newsletters, or industry news where you have consented.
• To improve our website and services through analytics and user feedback.
• To respond to legal claims or enforce our contractual rights.

5. Legal Basis for Processing

• Consent — where you have explicitly agreed to receive marketing communications or have submitted a contact form.
• Contract — where processing is necessary to fulfil a project engagement or supplier agreement.
• Legal obligation — where we are required to process data to comply with Kenyan law or regulatory requirements.
• Legitimate interests — where we have a genuine business reason to process your data, provided your rights and interests are not overridden (e.g. improving our services, fraud prevention).

6. How We Share Your Data

• Service providers — trusted third parties who assist us in operating our business (e.g. cloud storage, email services, accounting software), bound by confidentiality agreements.
• Professional advisors — lawyers, auditors, or consultants where necessary for legal or compliance purposes.
• Regulatory authorities — the Office of the Data Protection Commissioner (ODPC), National Construction Authority, National Environment Management Authority (NEMA), or other government bodies where required by law.
• Business transfers — in the event of a merger, acquisition, or sale of company assets, your data may be transferred to the successor entity.

Any third party we share data with is required to handle it in accordance with applicable data protection laws.

7. Data Retention

• Client and project records — retained for a minimum of 7 years after project completion, in line with standard contractual and tax obligations.
• Enquiry and marketing data — retained for up to 2 years from last contact, unless consent is withdrawn sooner.
• Recruitment data — retained for up to 6 months if you are unsuccessful, unless you consent to be considered for future roles.
• Technical/website data — retained for up to 12 months.

When data is no longer needed, it is securely deleted or anonymised.

8. Your Rights

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct any inaccurate or incomplete data.
• Right to erasure — you may request deletion of your personal data where there is no longer a lawful reason for us to hold it.
• Right to restrict processing — you may ask us to limit how we use your data in certain circumstances.
• Right to data portability — you may request your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@creekohme.com. We will respond within 21 days as required by the DPA 2019. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

9. Cookies & Tracking

• Essential cookies — necessary for the website to function correctly.
• Analytics cookies — help us understand site traffic and user behaviour (e.g. Google Analytics). Data is aggregated and anonymised.
• Preference cookies — remember your settings and choices to improve your experience.

You may control or disable cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website.

10. Data Security

11. Third-Party Links

12. Changes to This Policy

13. Contact Us

We are committed to working with you to resolve any concerns regarding your privacy. If you remain unsatisfied, you may contact the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke.