Your trust matters. Here's how we protect your personal data under Kenya's Data Protection Act and applicable data protection standards.
In terms of Kenya's Data Protection Act, 2019, the data controller responsible for processing your personal data is:
Eral Construction
Registration Number: [Company Registration Number]
Nairobi, Kenya
Data Protection Officer: privacy@eralconstruction.com
At Eral Construction, we are committed to protecting your privacy and the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your data in compliance with Kenya's Data Protection Act, 2019 and applicable international data protection standards.
You, the individual whose personal data is being processed.
Any information relating to an identifiable person, including name, ID number, contact details, and online identifiers.
Data including health, biometrics, religious or political affiliation, and other categories requiring extra protection.
Any operation performed on personal data, including collection, storage, use, modification, or destruction.
Eral Construction Ltd, who determines the purpose and means of processing.
A third party who processes data on our behalf under contract.
Voluntary, specific, and informed expression of will by you agreeing to the processing of your data.
The person responsible for ensuring Data Protection Act compliance within our organization.
We generally do not collect sensitive personal data. If required for a specific purpose (e.g., site access clearance), we will:
We process your personal data only when we have a lawful basis:
You have given clear consent for us to process your personal data for a specific purpose.
Processing is necessary to perform or enter into a contract with you (e.g., delivering a construction project).
Processing is necessary to comply with Kenyan law or other applicable legal requirements.
Processing is necessary for our legitimate business interests, provided your rights are not overridden.
To respond to quote requests, manage your project portal, and coordinate site work.
To plan site visits, coordinate crews and suppliers, and keep your project on schedule.
To send you site progress updates, important notices, and respond to your inquiries.
To verify your identity and property ownership when required before starting work.
To analyze usage patterns and improve our website, portal, and user experience.
To protect your account, detect suspicious activity, and prevent fraud or abuse.
To comply with applicable laws, regulations, and legal processes.
We never sell your personal data.
We only share information when necessary to deliver your project, with your consent, or when required by law.
Subcontractors and suppliers working on your project may see relevant project and site details. You control what is shared beyond what's needed for the work.
Trusted third parties who help us operate (cloud hosting, analytics, email services). They are bound by strict data processing agreements and can only use your data as we instruct.
Identity or land ownership verification providers when you consent to verification before we start work.
Law enforcement, courts, or regulators when required by law, court order, or to protect safety, rights, or property.
In the event of a merger, acquisition, or sale of assets, your data may be transferred. You will be notified of any changes.
We may use service providers based outside Kenya (for example, cloud hosting). When we transfer your data outside Kenya, we ensure, in line with the Data Protection Act, 2019:
The recipient country has adequate data protection laws
Contractual clauses or binding corporate rules are in place
You have given explicit consent for the transfer
Transfer is necessary for legal proceedings or to protect vital interests
We implement appropriate technical and organizational measures to protect your data:
Data encrypted in transit (TLS 1.3) and at rest (AES-256)
Role-based access with multi-factor authentication
Security assessments and penetration testing
Monitoring with breach notification procedures
We retain your data only as long as necessary:
Request a copy of the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data in certain circumstances
Object to processing for direct marketing
Withdraw consent at any time where processing is based on consent
Lodge a complaint with the Office of the Data Protection Commissioner
Our services are not intended for children under 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a child, please contact us immediately and we will delete it.
If you are not satisfied with our response to a privacy concern, you may lodge a complaint with:
Office of the Data Protection Commissioner (ODPC), Kenya
Britam Centre, Ragati Road, Upper Hill, Nairobi
Email: info@odpc.go.ke
Website: odpc.go.ke
For questions about this Privacy Policy or to exercise your rights:
