Privacy policy

This policy explains how Sibasi Ltd ("Sibasi", "we") collects, uses and protects personal data submitted through edms.co.ke. It is written to meet our obligations under the Data Protection Act, 2019 of Kenya.

1. Who we are

Sibasi Ltd is the data controller for personal data collected through this website. Our postal address is P.O. Box 37602 - 00100, GPO, Nairobi, Kenya. You can reach us at [email protected] or +254 20 216 7093.

2. What we collect

• Enquiry details you give us. Name, work email, phone number, organisation, and the optional sector, user-count and records-volume answers, together with the message you write.
• Analytics data, only if you accept cookies. Pages viewed, approximate location derived from IP address, device and browser type, and how you arrived at the site.

We do not collect special categories of personal data through this site, and you should not include any in an enquiry message.

3. Why we use it, and on what basis

• To respond to your enquiry. Basis: your consent, given when you submit the form, and our legitimate interest in responding to a business enquiry.
• To prepare a proposal, demo or tender response. Basis: steps taken at your request prior to entering a contract.
• To understand how the site is used. Basis: your consent, given through the cookie banner. Declining does not affect any other part of the site.

We do not add enquiries to a marketing list, and we do not sell or rent personal data to anyone.

4. Who else sees it

Enquiries are transmitted to our own systems and handled by Sibasi staff. We use a small number of processors who act only on our instructions: our email and cloud infrastructure providers, and — where you have accepted cookies — Google Analytics. Where a processor holds data outside Kenya, appropriate safeguards are in place.

We disclose personal data to third parties otherwise only where the law requires it.

5. How long we keep it

• Enquiries that do not proceed: retained for 24 months, then deleted.
• Enquiries that become a client relationship: retained for the duration of the relationship and for the period required by law and by our own retention schedule afterwards.
• Analytics data: retained for 14 months.

6. How we protect it

Data in transit is encrypted using TLS. Access to enquiry records is restricted to staff who need it, controlled through Microsoft Entra ID with multi-factor authentication, and logged. We review these controls as part of our own information security programme.

7. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be informed of how your data is being used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• request deletion of your data;
• object to processing, including withdrawing consent at any time;
• request that your data be transferred to another organisation;
• lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of these, email [email protected]. We respond within the statutory period, and there is no charge for a reasonable request.

8. Cookies

Nothing beyond what is strictly necessary loads until you accept. Declining sets a preference and loads no analytics. You can change your choice at any time using the cookie settings link in the footer, or by clearing site data in your browser.

The cookies used are:

• cookie_consent — records your own choice. Strictly necessary, stored locally in your browser.
• Google Analytics (_ga, _ga_*) — measures site usage. Only set after you accept.

9. Changes to this policy

Material changes will be published on this page with a revised date. Continued use of the site after a change constitutes acceptance of the revised policy.

10. Contact

Questions about this policy or about how we handle your data: [email protected], or write to P.O. Box 37602 - 00100, GPO, Nairobi, Kenya.