Privacy Notice — PRHUT Africa

1. Who we are

PRHUT Africa Limited is a strategic communications and public relations firm headquartered in Nairobi, Kenya. For the purposes of the Kenya Data Protection Act, 2019 (the “DPA”), the EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK GDPR, PRHUT Africa is the data controller of the personal data described in this Notice.

Contact: Data Protection Office, PRHUT Africa, Nairobi, Kenya · privacy@prhutafrica.com

2. Personal data we collect

Identity & contact data — name, job title, organisation, email address, phone number, postal address.
Engagement data — messages you send us, consultation bookings, files you share, and correspondence.
Technical data — IP address, device and browser information, pages visited, referring URL, approximate location derived from IP.
Marketing preferences — your subscription status and how you interact with our emails.

We do not knowingly collect special categories of personal data (e.g. health, religion, biometric or genetic data) unless you voluntarily provide it in the course of a client engagement.

3. How we use personal data & lawful bases

To deliver our services (performance of a contract).
To respond to enquiries and schedule consultations (consent / pre-contract steps).
To administer, secure and improve the website (legitimate interests in running a safe and effective site).
To send editorial insights and marketing where you have opted in (consent), with the option to opt out at any time.
To comply with legal, tax, anti-money laundering and regulatory obligations (legal obligation).

4. Sharing personal data

We share personal data only with trusted parties, under contract, on a need-to-know basis: hosting and infrastructure providers (including Cloudflare and our managed cloud database), analytics and email delivery vendors, professional advisers (lawyers, auditors), and public authorities where required by law. We do not sell personal data.

5. International transfers

Some of our processors may store or process data outside Kenya, including in the European Union and the United States. Where we transfer personal data internationally we rely on lawful transfer mechanisms such as adequacy decisions, Standard Contractual Clauses, binding corporate rules, or your explicit consent, and we apply appropriate technical and organisational safeguards.

6. Retention

We keep personal data only for as long as necessary for the purposes set out above and to satisfy legal, accounting or reporting requirements. Contact enquiries are typically retained for up to 36 months; client engagement records for the duration of the retainer plus 7 years for statutory record-keeping.

7. Your rights

Under the DPA and GDPR you have the right to:

Access the personal data we hold about you;
Ask us to correct inaccurate or incomplete data;
Ask us to erase your personal data;
Object to or restrict certain processing;
Receive your data in a portable format;
Withdraw consent at any time, without affecting prior lawful processing;
Lodge a complaint with the Office of the Data Protection Commissioner of Kenya (www.odpc.go.ke) or your local supervisory authority.

To exercise any of these rights, email privacy@prhutafrica.com. We respond within 30 days.

8. Security

We apply appropriate technical and organisational measures — including TLS encryption in transit, encryption at rest for our managed databases, access controls, least-privilege permissions, activity logging and periodic security reviews — to protect personal data against unauthorised access, alteration, disclosure or loss.

9. Children

Our services are directed to businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this Notice

We may update this Notice from time to time. Material changes will be posted here with an updated “Last updated” date and, where appropriate, notified to you directly.

Your privacy matters