Privacy Policy

We collect almost nothing. If you fill in the enquiry form we keep what you typed so we can reply. If you accepted cookies we count page views. We do not sell anything to anyone, we do not advertise, and you can have any of it deleted by emailing hello@napilistudios.co.

The rest of this page is the detail that the Kenya Data Protection Act 2019 and the GDPR require us to spell out.

Napili Studios is a design studio based in Nairobi, Kenya. For the purposes of the Data Protection Act 2019 (Kenya) and the UK and EU General Data Protection Regulation, we are the data controller for the personal data described here.

• Napili Studios, Nairobi, Kenya
• Data protection contact: hello@napilistudios.co

When you send an enquiry. Your name, email address, organisation, your role if you give it, the stage your organisation is at, any links you share, the services you are interested in, your timeline, your budget range, and anything you write in the message field.

When you browse, and only if you accepted cookies. Which pages you visited, roughly where in the world you were, what kind of device and browser you used, and how you arrived. This comes from Google Analytics and your IP address is truncated before it is stored.

Automatically, in server logs. Our host records request logs containing IP addresses for a short period, for security and to keep the site up.

We do not knowingly collect anything from children, and we do not collect sensitive categories of data such as health, religion, ethnicity, or political views.

• To reply to your enquiry and scope work. Basis: taking steps at your request before entering a contract, and our legitimate interest in running a studio. DPA 2019 s.30(1)(b); GDPR Art. 6(1)(b) and 6(1)(f).
• To understand which work people read. Basis: your consent, given through the cookie banner and withdrawable at any time. DPA 2019 s.30(1)(a); GDPR Art. 6(1)(a).
• To keep the site secure and working. Basis: legitimate interest.

We do not use your data to make automated decisions that have legal or similarly significant effects on you. A person reads every enquiry.

We use a small number of services to run the studio. Each one only gets what it needs.

• Brevo (France) — delivers enquiry emails to us and the acknowledgement to you, and stores your contact details so we can follow up.
• Google Analytics (Ireland and the United States) — page statistics, only if you accepted cookies.
• Cloudflare (United States) — hosts and serves this site.
• Sanity (Norway and the United States) — stores the site’s own content. It holds no visitor data.

We do not sell personal data, we do not share it for advertising, and we do not disclose it to anyone else unless the law requires it.

The services above are based outside Kenya, so your data is transferred abroad. Under section 48 of the Data Protection Act 2019 we only do this where there are appropriate safeguards. In practice each of these providers commits to the European Commission’s Standard Contractual Clauses and, where relevant, participates in the EU–US Data Privacy Framework.

• Enquiries that become projects: for the life of the project and seven years afterwards, which is what Kenyan tax and company record-keeping expects.
• Enquiries that go nowhere: two years, then deleted. Briefs often come back around.
• Analytics: 14 months.
• Server logs: 30 days or less.

Under the Data Protection Act 2019 you have the right to be told what we hold, to get a copy, to have mistakes corrected, to object to processing, to ask us to delete things, to receive your data in a portable format, and to withdraw consent.

We answer access requests within seven days and correction requests within fourteen, which is what the Act requires. There is no charge.

If you are in the EU, the UK, or Switzerland, the GDPR gives you the same rights plus the right to restrict processing, and we will respond within one month.

If you are a California resident, you have the right to know what we collect, to delete it, and not to be discriminated against for asking. We do not sell or share personal information as the CCPA defines those terms.

To use any of these rights, email hello@napilistudios.co. We may ask you to confirm who you are before we hand over data.

If we get it wrong, tell us first and we will try to fix it. If you are still not satisfied you can complain to the Office of the Data Protection Commissioner in Kenya. Visitors in the EU or UK may instead complain to their own national supervisory authority.

If personal data is breached in a way that presents a real risk to you, we will notify the Data Commissioner within 72 hours of becoming aware of it, as section 43 of the Act requires, and tell you directly without undue delay.

This site sets no cookies at all unless you accept them. There is no advertising, no tracking pixel, and no third-party profiling.

If you accept, Google Analytics sets one cookie to tell repeat visits apart. If you decline, nothing is set and the analytics script is never loaded — not loaded and blocked, simply never requested.

Turning analytics off does not just stop us looking at the numbers: it deletes the Google Analytics cookie from this browser and blocks the tag from sending anything further. If you had previously accepted, the identifier is removed.

If we change how we handle data we will update this page and move the date at the top. Material changes will be flagged on the site.

See also our Terms of Use.