1. Introduction

SW Consultants' Kenya ("we," "us," "our," or "the Company") is committed to protecting your personal data and respecting your right to privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you:

• Visit our website or interact with us online

• Submit a contact or quotation request form

• Communicate with us via phone, email, or WhatsApp

• Engage us for any electrical or renewable energy services

• Subscribe to any communications from us

This Privacy Policy is prepared in compliance with the Data Protection Act, 2019 (No. 24 of 2019) of Kenya and the regulations issued thereunder by the Office of the Data Protection Commissioner (ODPC).

Please read this policy carefully. By engaging with SW Consultants' Kenya in any capacity, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

SW Consultants' Kenya is a Nairobi-based electrical and renewable energy consultancy operating in Kenya. For the purposes of the Data Protection Act, 2019, SW Consultants' Kenya is the Data Controller of personal data collected through our services and digital platforms.

3. What Personal Data We Collect

We may collect the following categories of personal data:

3.1 Information You Provide Directly

• Identity data: Full name

• Contact data: Phone number, email address, physical address or location

• Project data: Property type, location, energy usage information, site details you share with us for the purpose of quotation or installation

• Communication data: Messages, enquiries, and correspondence you send us via any channel (website form, email, WhatsApp, phone)

• Financial data: M-Pesa transaction references, bank account details provided for payment or refund purposes

3.2 Information We Collect Automatically

When you visit our website, we may collect:

• Technical data: IP address, browser type and version, device type, operating system

• Usage data: Pages visited, time spent on pages, links clicked, referring website

• Cookie data: As described in Section 9 of this Policy

3.3 Information We Collect from Third Parties

We may receive information about you from:

• Referral sources (individuals or organizations who refer you to us)

• Publicly available sources for verification purposes

3.4 Special Category Data

We do not intentionally collect any special category data (such as racial or ethnic origin, health data, biometric data, or political opinions). Please do not provide such information to us unless specifically requested and necessary for a lawful purpose.

4. How We Use Your Personal Data

We process your personal data only for lawful purposes. We use your information to:

We will never use your personal data for purposes incompatible with those listed above without first notifying you and, where required, obtaining your consent.

5. Legal Basis for Processing

Under the Data Protection Act, 2019, we are required to have a lawful basis for processing your personal data. We rely on the following legal bases:

5.1 Performance of a Contract: Where processing is necessary to enter into or perform a contract with you (e.g. carrying out an installation you have engaged us for).

5.2 Legal Obligation: Where we are required to process data to comply with a legal obligation under Kenyan law (e.g. tax records, regulatory compliance with EPRA).

5.3 Legitimate Interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. We always assess this balance before relying on this basis.

5.4 Consent: Where we rely on your explicit consent, such as for direct marketing communications. You have the right to withdraw consent at any time.

6. Data Sharing and Disclosure

We respect your privacy. We do not sell, rent, or trade your personal data to any third party.

We may share your data in the following limited circumstances:

6.1 Service Providers: We may share data with trusted third-party contractors or suppliers who assist us in delivering our services (e.g. equipment suppliers, certified sub-contractors). These parties are required to handle your data securely and only for the specified purpose.

6.2 Payment Processors: Where payments are made via M-Pesa or bank transfer, relevant transaction data is processed by the relevant financial institution in accordance with their own privacy policies.

6.3 Professional Advisors: We may share data with our lawyers, accountants, or insurers where necessary for professional advice.

6.4 Regulatory and Legal Authorities: We may disclose data to EPRA, Kenya Revenue Authority, law enforcement agencies, or courts where required by applicable law or in response to a lawful request.

6.5 Business Transfers: In the unlikely event that SW Consultants' Kenya undergoes a merger, acquisition, or transfer of assets, your data may be transferred as part of that transaction, subject to equivalent privacy protections.

7. Cross-Border Data Transfers

SW Consultants' Kenya primarily operates in Kenya and stores data within Kenya. However, certain digital tools we use (such as email platforms, cloud storage, or WhatsApp Business) may process or store data on servers located outside Kenya.

Where data is transferred outside Kenya, we ensure such transfers are made in accordance with the Data Protection Act, 2019 and only to countries or organzations that provide adequate levels of data protection.

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, subject to the following:

After the applicable retention period, data is securely deleted or anonymized so it can no longer be linked to any individual.

9. Cookies

Our website may use cookies — small text files placed on your device — to enhance your browsing experience and analyze website usage.

Types of cookies we may use:

• Essential cookies: Required for the website to function properly. These cannot be disabled.

• Analytics cookies: Help us understand how visitors use our site (e.g. pages visited, time spent). Data collected is aggregated and anonymized.

• Preference cookies: Remember your settings and preferences for a better experience.

You can control cookies through your browser settings at any time. Note that disabling certain cookies may affect how our website functions.

10. Your Rights Under the Data Protection Act, 2019

As a data subject under Kenya's Data Protection Act, 2019, you have the following rights regarding your personal data:

10.1 Right of Access: You have the right to request a copy of the personal data we hold about you.

10.2 Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data.

10.3 Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data where there is no compelling legal reason for us to continue processing it.

10.4 Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances.

10.5 Right to Object: You may object to processing of your data where we rely on legitimate interests, or where your data is used for direct marketing purposes.

10.6 Right to Data Portability: Where technically feasible, you may request that we provide your data in a structured, commonly used, machine-readable format.

10.7 Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us in writing: 📧 swconsultants8@gmail.com 📞 0701071654

We will respond to verified requests within twenty-one (21) days as required under the Data Protection Act, 2019. We may ask for proof of identity before processing your request.

11. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organizational measures to protect your data against:

• Unauthorized access, disclosure, or misuse

• Accidental loss, destruction, or damage

• Unlawful processing

These measures include restricted access to personal data, secure communication channels, and regular review of our data handling practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to harm your rights or freedoms, we will notify you and the Office of the Data Protection Commissioner (ODPC) as required by law.

12. Children's Privacy

Our services are not directed at children under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that personal data has been collected from a child without appropriate consent from a parent or guardian, we will take steps to delete such data promptly.

13. Third-Party Links

Our website may contain links to third-party websites or platforms. We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. WhatsApp and Direct Communication Channels

Where you contact us via WhatsApp Business, phone calls, or SMS, please be aware that:

• WhatsApp communications are subject to Meta's own privacy policy and terms of service.

• We only use information shared through these channels for the purpose of responding to your enquiry and providing services.

• We do not share WhatsApp or direct communication data with third parties except as described in Section 6 of this Policy.

15. Changes to This Privacy Policy

SW Consultants' Kenya reserves the right to update this Privacy Policy from time to time to reflect changes in our business practices, legal requirements, or data protection standards. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy

• Notify existing clients by email where the changes are significant

We encourage you to review this Policy periodically. Your continued engagement with SW Consultants' Kenya after any changes constitutes your acknowledgement of the updated Policy.

16. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya:

Office of the Data Protection Commissioner Website: www.odpc.go.ke Email: info@odpc.go.ke

We would, however, appreciate the opportunity to address your concerns directly before you approach the ODPC. Please contact us first at:

📧 swconsultants8@gmail.com 📞 0701071654 SW Consultants' Kenya, Donholm Road, Caltex, Nairobi, Kenya