Privacy and legal
Crestline Digital Labs ("Crestline", "we", "us") is a technology company based in Nairobi, Kenya. For personal information collected through this website and our enquiry channels, Crestline is the data controller.
Legal name: [COMPANY LEGAL NAME]. Registered office: [REGISTERED OFFICE ADDRESS]. Business registration number: [BRS REGISTRATION NUMBER]. Data protection registration with the Office of the Data Protection Commissioner: [ODPC REGISTRATION NUMBER].
Data protection contact: [DPO NAME], [DPO EMAIL].
This notice covers the Crestline website and any messages you send us through it. It does not cover products we build for clients. Those products, such as Msaada, are operated for the client organisation, which decides how the data is used. Where we handle data on a client's behalf, we act as a processor under a written agreement, and the client's privacy notice applies. Any product we run directly will have its own notice.
We collect only what we need.
- Enquiry details you choose to send: your name, organisation (optional), email address, the service you are interested in, and your message. These reach us only when you send the email from your own email application.
- Correspondence: the content of emails and other messages you exchange with us.
- Technical information: when you visit the website, our hosting provider records standard server information, such as your IP address, the page requested, the time, the browser type, and the page that referred you. We do not use this to identify you or combine it with other data about you.
- Accessibility preferences: text size, high contrast, and motion settings are saved in your browser's local storage on your device. They are not sent to us.
We use personal information to:
- reply to your enquiries and manage our correspondence with you;
- operate, maintain, and secure the website;
- keep records we are required to keep by law;
- protect the website and our systems against misuse, fraud, and attacks;
- improve the accessibility and reliability of the website.
We do not sell personal information, and we do not send marketing messages unless you ask us to.
We rely on the following lawful bases, as set out in the Kenya Data Protection Act, 2019:
- your consent, when you choose to contact us;
- our legitimate interests in running and securing the website and answering enquiries, balanced against your rights;
- steps taken at your request before entering into a contract, or performance of a contract;
- compliance with our legal obligations.
We share personal information only with:
- service providers who host our website and run our email, under contracts that require them to protect the information and use it only on our instructions;
- professional advisers, such as lawyers or accountants, where needed;
- public authorities, where the law requires it.
Our website is hosted by [HOSTING PROVIDER], which may process technical information on servers outside Kenya.
Some of our providers operate servers outside Kenya. Where personal information leaves Kenya, we take the steps the Act requires, such as making sure the recipient provides comparable protection under a written agreement, or relying on a lawful exception. We keep a record of the basis for each transfer.
We keep enquiry emails for as long as needed to answer you and keep a record of our dealings with you, normally no longer than [RETENTION PERIOD, for example two years] after the last contact, unless the law requires a longer period. Hosting logs are kept for the period set by our hosting provider and then deleted. Accessibility preferences remain on your device until you clear them.
We use encrypted connections (HTTPS) for this website, limit access to enquiry emails to the staff who need them, protect our accounts with strong authentication, and keep our software up to date. No system is completely secure, so please tell us promptly if you believe your information has been exposed.
Under the Kenya Data Protection Act, 2019, you have the right to:
- be informed about how we use your personal information;
- access the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information, where the law allows;
- object to our processing, and ask us to restrict it in certain cases;
- withdraw your consent at any time, without affecting processing that took place before you withdrew it;
- complain to the Office of the Data Protection Commissioner in Kenya.
To exercise any of these rights, email hello@crestline.example. We may ask you to confirm your identity before we act, and we will respond within the time the law requires.
Visitors from outside Kenya may have rights under their own laws, such as the EU or UK General Data Protection Regulation. We handle requests from anyone in the same way.
This website is not directed at children under 18, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.
This website links to other sites, including the websites of our projects. We are not responsible for the privacy practices or content of those sites. Please read their notices before you share information with them.
This website is not an emergency service, and it is not monitored for emergencies. In an emergency in Kenya, call 999 or 112 immediately. Do not use the contact form or email for emergencies.
We may update this page from time to time. When we make material changes, we will update the date at the foot of the page. Continued use of the website after a change means you accept the updated notice.
By using this website, you agree to the following terms.
Use of the website. You may use the website for lawful purposes only. You must not attempt to disrupt, overload, probe, or gain unauthorised access to the website, copy its content in bulk, or use it to send unsolicited messages.
Information on this website. We provide general information about our company and services. It is not an offer, a quotation, or technical, legal, or financial advice. Descriptions of products and their status may change without notice.
Intellectual property. The Crestline name, logo, design, and content belong to Crestline Digital Labs or are used with permission. Product names, including Msaada and Hekima 4.0, belong to their respective owners. You may view and print pages for personal or internal use. Any other use requires our written permission.
Third-party content. A link or reference to a third party does not mean that we endorse it.
No warranty. To the extent permitted by law, the website is provided as is and as available, without warranties of any kind. We do not guarantee that it will be free of errors or available at all times.
Limitation of liability. To the extent permitted by law, Crestline is not liable for any indirect, incidental, or consequential loss arising from your use of this website. Nothing in these terms limits any liability that cannot be limited under the laws of Kenya.
Accessibility. We aim to make this website conform to the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA. If you find a barrier, please tell us at hello@crestline.example and we will respond.
Products and services. Use of any product we build is governed by a separate agreement, service terms, or licence. These website terms do not grant any right to use a product.
Governing law and disputes. These terms and this notice are governed by the laws of the Republic of Kenya. We will first try to resolve any dispute in good faith. If it cannot be resolved, it will be subject to the jurisdiction of the courts of Kenya, without affecting any rights you have as a consumer in your own country.
For questions about this notice, or requests about your personal information, email hello@crestline.example or write to [REGISTERED OFFICE ADDRESS].
If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner in Kenya.
Last updated: [DATE]