Privacy
Privacy notice
This notice explains how CEACM Consultants Limited handles personal data collected through this website, in line with the Data Protection Act, 2019 of Kenya.
Last updated: 1 October 2026
1. Who is responsible for your data
CEACM Consultants Limited (“CEACM”, “we”) is the data controller.
Registered office: Uchumi Building, Jogoo Road, Makadara, Nairobi.
Postal address: P.O. Box 16679-00100, G.P.O Nairobi.
Email for privacy matters: info@ceacm.co.ke.
2. What we collect
- Enquiry form: your name, organisation, email address, telephone number (optional), role, project location (optional), contract form (optional), the type of help you need (optional) and your message.
- Email and WhatsApp: if you write or message us, we receive the details you send and your contact details.
- Website visits: aggregated, anonymous statistics: pages viewed, referring page, approximate country, browser and device type, and time of visit. These are not linked to you personally.
If you arrive through a campaign link or another website, the campaign tags and the referring website are kept in your browser for the visit only (session storage, not a cookie) and are sent to us only if you submit the form.
Giving us your details in the form is voluntary. If you do not, we cannot reply to your enquiry.
3. Why we use it, and the lawful basis
| Purpose | Lawful basis (Data Protection Act, 2019) |
|---|---|
| Reading and replying to your enquiry; recording it in our client-relationship system | Your consent (section 30(1)(a)); and, where you ask us to take steps before entering into an agreement, the taking of those steps at your request (section 30(1)(b)(i)) |
| Keeping a record of the enquiry and consent | Our legitimate interests in managing enquiries and demonstrating consent, where this does not override your rights (section 30(1)(b)(vii)) |
| Understanding how the website is used, using aggregated statistics | Our legitimate interests in improving the website; no personal profile is created |
| Meeting legal or professional obligations | Compliance with a legal obligation (section 30(1)(b)(ii)) |
We do not use your data for automated decision-making, and we do not sell it.
4. Who processes data for us
| Provider | What it does | Data involved |
|---|---|---|
| FormSubmit | Relays the contact form to our email | The form content |
| Odoo | Our client-relationship system (CRM), where enquiries are recorded | Enquiry details and our notes |
| Vercel | Hosts this website and provides cookieless web analytics | Server logs; aggregated visit statistics |
If you contact us on WhatsApp, WhatsApp's own terms and privacy policy apply to that message. We do not share enquiry data with anyone else, unless the law requires it or you ask us to.
5. Transfers outside Kenya
These providers may store or process data outside Kenya. We transfer personal data only as the Data Protection Act, 2019 allows (Part VI), relying on safeguards such as the provider's contractual and security commitments and, where applicable, your consent.
6. Cookies
This website does not use cookies. Visit statistics are collected without cookies: visitors are counted from a short-lived, anonymous identifier that is not stored in your browser and is discarded after 24 hours.
7. How long we keep data
- Enquiries that do not lead to an engagement: deleted 24 months after the last contact.
- Enquiries that lead to an engagement: kept with the engagement records, for as long as the engagement lasts and afterwards for the period needed for legal and professional record-keeping.
- Aggregated website statistics: kept in aggregated form only.
8. Your rights
Under the Data Protection Act, 2019 you have the right to be informed of the use to which your personal data is put; to access your personal data; to object to its processing; to have false or misleading data corrected; and to have it deleted. Where the Act provides, you may also ask us to restrict processing or to provide your data in a portable form. You can withdraw consent at any time; this does not affect processing already done.
To exercise a right, write to info@ceacm.co.ke. We may ask you to confirm your identity, and we will respond within the period the law requires.
9. Security
We use HTTPS on this website and limit access to enquiry records to the people at CEACM who need them.
10. Children
This website is for businesses and professionals and is not directed at children.
11. Complaints
If you are not satisfied with how we have handled your data, please write to us first at info@ceacm.co.ke. You may also complain to the Office of the Data Protection Commissioner (ODPC), Kenya:
- Website: https://www.odpc.go.ke
- Complaints email: complaint@odpc.go.ke
- General email: info@odpc.go.ke
- Address: Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi
12. Changes to this notice
We may update this notice. The date at the top shows when it was last changed. Questions are welcome through the contact page.