Privacy Policy

1. Who we are

Grid047 is a web studio in Nairobi, Kenya, run by Vincent Muchoki Wambui. For the data described here, Grid047 is the data controller. You can reach us at vincentmuchoki@outlook.com or on WhatsApp on +254 797 241 266.

2. What we collect, and when

Please do not put ID numbers, bank or card details, health details or other sensitive information in the form or in a message.

• If you send the contact form: your name, email address, subject and message, your phone number if you add it, the address of the page you came from, and the date and time. We also keep a short scrambled code made from your IP address. We do not store your IP address itself with your message. We use the code only to spot repeated or abusive submissions.
• If you message us on WhatsApp: opening the chat link on this site sends us nothing until you send a message. Once you do, we receive your number, your name on WhatsApp and your message. WhatsApp is run by Meta, which handles them under its own terms.
• If you email us: we receive your email address and what you write.
• When you open any page: our web server records standard technical details, including your IP address, browser type, the page requested and the time. We use these logs only to keep the site secure and to find faults.
• While you use the contact form: our server holds your IP address in memory for a short time, not on disk, to stop the form being flooded.

3. Cookies and trackers

This site sets no cookies. It has no analytics, advertising pixels or social media trackers. Fonts and images come from our own server. The only link that carries anything to an outside service is the WhatsApp button, and only if you tap it.

The page measures its own size and your connection type in your browser, to show the page receipt and to switch to a lighter version on slow connections. That stays on your device.

4. Why we use your data, and the lawful basis

We do not sell your data. We do not use it for marketing, and the form does not add you to any mailing list.

• To reply to your enquiry and, if you ask for one, to prepare a quote. Basis: steps taken at your request before a contract (section 30 of the Act).
• To deliver a project if you go ahead, and to keep project records. Basis: contract, and legal duties such as tax records.
• To keep the site secure and stop abuse, through form limits and server logs. Basis: our legitimate interest in running a safe site.

5. Who handles your data for us

These providers handle data only to provide their service to us:

• Brevo, a company based in France: sends us an email notification when you submit the form. The email contains what you wrote in the form.
• Microsoft (Outlook): hosts the mailbox where those notifications and your emails arrive.
• Our server host: stores the website and the messages saved from the form.
• WhatsApp (Meta): only if you choose to message us there.

We may also disclose data if the law or a court requires it.

6. Data processed outside Kenya

Brevo, Microsoft and WhatsApp process data in other countries. Part VI of the Act sets conditions for that. We limit what we send them to what the service needs.

7. How long we keep it

• Messages from the form are deleted automatically from our server 12 months after you send them. We delete the notification email in our mailbox within the same period.
• If you become a client, we keep project and payment records for as long as the work needs and the law requires.
• Server logs are kept for a limited period for security and fault-finding, then removed.

8. How we protect it

The site is served over HTTPS. Saved messages can be read only with our server login or our private access token. The form has spam and rate limits, and your IP address is kept out of the saved message. No system is perfectly secure.

If a breach of personal data creates a real risk of harm to you, we will tell the Data Commissioner within 72 hours of becoming aware of it (section 43 of the Act), and we will tell you without unnecessary delay.

9. Your rights

Under section 26 of the Act you can ask us to:

• tell you what personal data we hold about you, and give you a copy in a usable format
• correct data that is wrong
• delete data we no longer need
• stop using your data, or object to how we use it

Send your request to vincentmuchoki@outlook.com. We may ask you to confirm who you are. We reply within the time the law sets, and we do not charge for it.

10. Children

This site is for businesses and adults. We do not knowingly collect data from anyone under 18. If you think a child has sent us their details, email us and we will delete them.

11. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner: file a complaint on the ODPC website (section 56 of the Act).

12. Changes to this policy

We will update this page when what we do with your data changes. The date at the top shows the latest version.