Data Privacy

This policy explains how Hellobooks Ltd ("Hellobooks", "we", "us", or "our") collects, uses, stores, and protects your personal data when you use hellobooks.co.ke or contact us. We handle personal data in line with the Data Protection Act, 2019 of Kenya.

1. Data controller

Hellobooks is the data controller responsible for the personal data described in this policy. We are based in Nairobi, Kenya. For any privacy matter, contact us at hi@hellobooks.co.ke.

2. Scope

This policy applies to personal data we collect through our website and enquiry form. Personal data processed as part of a specific client engagement is governed by the data-processing terms of that engagement's written agreement, under which we typically act as a data processor on the client's behalf.

3. Personal data we collect

When you submit our contact form, we collect the information you provide, which may include:

• Your name, so we can address you correctly;
• Your email address, so we can reply;
• Your organisation (optional), to understand your context;
• The module or area of interest you select;
• The message and any details you choose to include.

We also collect limited technical data automatically when you visit the website, such as your IP address, browser type, device information, and pages viewed. This is processed by our hosting provider to deliver and secure the site.

4. How we use your data and our lawful basis

We process your personal data to:

• Respond to your enquiry and communicate with you — on the basis of your consent and our steps to enter into a contract at your request;
• Provide, secure, and improve the website — on the basis of our legitimate interest in operating a safe, functional service;
• Comply with legal obligations where applicable — on the basis of legal compliance.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

5. Cookies and analytics

The website uses only the minimal storage required to function, such as remembering your light or dark theme preference, which is stored locally in your browser and is not shared with us. We do not use advertising cookies or cross-site trackers.

6. Who we share data with

We share personal data only with service providers who help us operate the website and respond to enquiries, and only to the extent necessary. These currently include:

• Cloudflare — website hosting, content delivery, and security;
• Resend — delivery of the enquiry email generated by the contact form.

These providers process data under their own terms and privacy commitments and are not permitted to use it for their own purposes. We may also disclose data where required by law or to protect our legal rights.

7. International transfers

Some of our service providers process data on infrastructure located outside Kenya. Where personal data is transferred across borders, we take reasonable steps to ensure it remains protected to a standard consistent with the Data Protection Act, 2019, including relying on providers that offer appropriate safeguards.

8. Data retention

We keep enquiry data only for as long as needed to respond to you and maintain a reasonable record of our correspondence, after which it is deleted or anonymised. Technical logs are retained for a limited period for security and diagnostics.

9. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure, including encryption in transit, access controls, and trusted infrastructure providers. No method of transmission over the internet is completely secure, but we work to protect your data and respond promptly to any incident.

10. Your rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of how your personal data is used;
• Access the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data where there is no lawful reason to keep it;
• Object to or restrict certain processing;
• Withdraw consent at any time, without affecting prior lawful processing;
• Lodge a complaint with the supervisory authority.

To exercise any of these rights, email hi@hellobooks.co.ke. We will respond within the timeframes required by law.

11. Children's data

The website and our services are intended for organisations and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our practices or legal obligations change. The current version is always published on this page with the effective date shown above.

13. Contact and complaints

For any privacy question or request, contact hi@hellobooks.co.ke, Hellobooks Ltd, Nairobi, Kenya. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.

This policy describes how we handle data collected through our website. Data we process on behalf of clients under a specific engagement is governed by that engagement's data-processing agreement.