Privacy Policy

CostEdge Consulting Ltd ("CostEdge", "we", "us" or "our") is a professional quantity surveying, project management, contract management and arbitration consultancy registered and operating in Kenya, with offices in Nairobi.

This Privacy Policy explains how we collect, use, store, share, transfer and protect personal data when you visit our website, contact us, book an appointment, or engage us to provide professional services.

For the purposes of the Data Protection Act, 2019 (the "Act"), CostEdge Consulting Ltd is the data controller in respect of the personal data described in this Policy. We are committed to processing personal data lawfully, fairly and transparently, and in a manner that respects your right to privacy under Article 31 of the Constitution of Kenya, 2010.

This Policy should be read together with the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021 and any guidance issued by the Office of the Data Protection Commissioner ("ODPC").

This Policy applies to all personal data that we collect through this website and in the course of our professional engagements, including data submitted through our contact forms, appointment booking forms, email, telephone and messaging channels.

It does not apply to the practices of third-party websites or services that we do not control, even where we link to them. We encourage you to review the privacy notices of any third party before providing your personal data.

We only collect personal data that is adequate, relevant and limited to what is necessary for the purposes described in this Policy. The categories of personal data we may collect include:

• Identity data your full name, title, job role and the organisation you represent.
• Contact data your email address, telephone number, WhatsApp number and postal or physical address.
• Enquiry and project data the information you provide when you contact us or book an appointment, including project details, service requirements, budget indications and any correspondence exchanged with us.
• Technical data internet protocol (IP) address, browser type and version, device type, operating system, time zone, referral source and pages visited.
• Usage data information about how you use our website and interact with our content.
• Marketing data your preferences in receiving communications from us and your engagement with our updates.

We collect personal data in the following ways:

• Directly from you when you complete a form on our website, send us an email, call us, message us on WhatsApp, book an appointment or engage us in person.
• Automatically when you browse our website, certain technical and usage data is collected through cookies and similar technologies.
• From third parties where lawful, we may receive personal data from referral partners, professional advisers or publicly available sources.

Under section 30 of the Act, we must have a lawful basis for processing your personal data. Depending on the circumstances, we rely on the following bases:

• Consent where you have given us clear, informed consent to process your personal data for a specific purpose, such as receiving marketing communications. You may withdraw your consent at any time.
• Performance of a contract where processing is necessary to enter into or perform a contract with you or the organisation you represent.
• Compliance with a legal obligation where processing is necessary for compliance with a legal obligation to which we are subject.
• Protection of vital interests where processing is necessary to protect your vital interests or those of another person.
• Legitimate interests where processing is necessary for our legitimate interests or those of a third party, such as operating and improving our business and services, provided your rights and freedoms are not overridden.
• Public interest where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

We process your personal data only for the purposes for which it was collected or for compatible purposes. These purposes include:

• Responding to your enquiries, requests for proposals and requests for quotations.
• Providing quantity surveying, project management, contract management and arbitration services.
• Preparing, administering and managing contractual engagements and appointments.
• Processing and confirming appointment bookings.
• Communicating with you about projects, engagements and service updates.
• Improving our website, services and client experience.
• Sending you marketing and industry communications where you have consented or where we are otherwise permitted to do so.
• Complying with applicable legal, regulatory, tax and professional obligations, and enforcing or defending legal claims.

Our website uses cookies and similar technologies to operate effectively, remember your preferences and understand how visitors use the site. The types of cookies we may use include strictly necessary cookies, performance and analytics cookies, and functionality or preference cookies.

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of our website. Where required by law, we will seek your consent before placing non-essential cookies on your device.

We do not sell, rent or trade your personal data. We may share your personal data only where necessary and with appropriate safeguards in place, including with:

• Our employees, directors and professional staff who need access to deliver our services, subject to duties of confidentiality.
• Professional advisers, consultants, contractors and subcontractors engaged in delivering a project or service.
• IT, hosting, cloud storage, communications and analytics service providers that support our operations.
• Payment processors and financial institutions where payments are involved.
• Legal, regulatory, tax or government authorities, courts and tribunals, where required by law or necessary to establish, exercise or defend legal claims.
• Marketing and communication platforms used to send you updates, where you have consented.

Where it becomes necessary to transfer your personal data outside Kenya, we will do so only in accordance with section 48 of the Act and the Data Protection (General) Regulations, 2021. This means we will ensure that an adequate level of protection is afforded to the data, or that appropriate safeguards are in place, such as contractual data protection clauses, or that you have given your explicit consent to the transfer.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, to comply with our legal and professional obligations, and to resolve disputes. Indicative retention periods include:

• Enquiry and general correspondence records are retained for up to 24 months where no engagement follows.
• Client and project records are retained for the duration of the engagement and for the statutory and limitation periods thereafter, typically up to seven (7) years from the end of the engagement or as required by applicable law.
• Website analytics data is retained for up to 26 months in aggregated or pseudonymised form.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful access, loss, destruction, alteration or disclosure. These measures include, among others:

• Secure encryption of data in transit through HTTPS/TLS.
• Access controls and role-based permissions limiting access to personal data to authorised personnel only.
• Staff confidentiality obligations and internal data protection policies.
• Secure hosting, backups and periodic review of our security safeguards.
• Procedures for detecting, responding to and where required notifying the ODPC and affected data subjects of personal data breaches, in accordance with the Act.

Subject to the limitations set out in the Act, you have the following rights in relation to your personal data:

• Right to be informed the right to know how and why your personal data is being processed.
• Right of access the right to request confirmation of whether we process your personal data and to receive a copy of it.
• Right to rectification the right to request correction of inaccurate, incomplete or misleading personal data.
• Right to erasure the right to request deletion of your personal data where there is no lawful reason for us to continue processing it.
• Right to restriction of processing the right to request that we limit the processing of your personal data in certain circumstances.
• Right to object the right to object to the processing of your personal data, including processing for direct marketing.
• Right to data portability the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right not to be subject to automated decision-making the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects.
• Right to withdraw consent where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint the right to lodge a complaint with the Office of the Data Protection Commissioner.

To exercise any of the rights described above, please contact us using the details provided in the "How to Contact Us" section below. We may ask you to provide proof of identity in order to verify your request and to protect your personal data.

We will respond to your request within a reasonable time and in any event within the timelines prescribed by the Act and its Regulations. There is normally no charge for exercising your rights. However, where a request is manifestly unfounded, repetitive or excessive, we may refuse to act on it or may charge a reasonable administrative fee, as permitted by law.

Our website and services are directed at adults and organisations. We do not knowingly collect or process the personal data of children without the consent of a parent or guardian. Where we process the personal data of a child, we do so in accordance with section 33 of the Act and only with appropriate consent and safeguards. If you believe that a child has provided us with personal data without the required consent, please contact us so that we can take appropriate action.

With your consent, or where we are otherwise permitted to do so, we may send you updates about our services, industry insights and company news. You can opt out of receiving marketing communications at any time by contacting us using the details below. Opting out of marketing will not affect communications that are necessary for the performance of a contract or that we are legally required to send.

Our website may contain links to third-party websites, platforms and booking or scheduling services. We are not responsible for the privacy practices or content of those third parties. We encourage you to read the privacy notices of any third-party website or service before providing your personal data.

We are committed to resolving any concerns you may have about how we handle your personal data. Please contact us first using the details below so that we can address your concern.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the supervisory authority established under the Data Protection Act, 2019. The ODPC can be contacted through the following channels:

• Website: https://www.odpc.go.ke
• Email: info@odpc.go.ke
• Phone: +254 20 439 0000
• Physical address: Britam Tower, 14th Floor, Hospital Road, Upper Hill, Nairobi, Kenya

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or regulatory guidance. When we make material changes, we will post the revised Policy on this page and update the "Last Updated" date at the top.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. Your continued use of our website or services after any changes take effect constitutes your acceptance of the revised Policy.

If you have any questions, requests or concerns about this Privacy Policy or about how we process your personal data, please contact our data protection contact point:

• Organisation: CostEdge Consulting Ltd
• Email: info@costedgeconsulting.com
• Phone: +254 799 573 568
• Address: Nairobi, Kenya