Privacy Policy

Effective date: 29 October 2026 Last updated: 29 October 2026

1. Who we are

This privacy policy explains how Ian Dullu Jillo, trading as Dullu Group Enterprises (a sole proprietor), of Kilifi, Kenya ("DDi", "we", "us"), collects, uses, stores, shares, and protects your personal data. It is our duty to notify you of these matters before we collect your personal data (Data Protection Act, 2019, s. 29).

Contact for privacy matters: hello@dullugroup.co.ke. Data Protection Officer: none appointed. Privacy matters go to the contact above (DPA s. 24). You have the right to be informed of the use to which your personal data is put, and the other rights in section 9 below (DPA s. 26(a)).

2. What this policy covers

This policy applies to personal data we process about people who use this website, send us an enquiry, or become our clients. It does not cover anonymised data that no longer identifies you.

3. What personal data we collect

We collect only what is adequate, relevant, and necessary for the purposes in section 4 (DPA s. 25(d)):

Where information relating to your family or private affairs is required, we provide a valid explanation for requiring it (DPA s. 25(e)).

4. Why we collect and use your data

We process personal data for these specific purposes, and on these lawful bases (DPA ss. 25(c), 30):

We collect personal data directly from you wherever possible (DPA s. 28(1)). Where we collect from another source (for example a public record or with your consent), the exceptions in DPA s. 28(2) apply.

5. What we tell you before collecting (DPA s. 29 summary)

In short, before or when we collect your data we tell you: that we are collecting it; the purpose; the third parties it will go to and the safeguards used; our contacts and anyone else who may receive it; the security measures we take; whether collection is voluntary or mandatory under any law; and what happens if you do not provide the data. This policy, plus any collection notice shown to you, is that notification.

6. Marketing communications (DPA s. 37; General Regulations Part III)

We use your details to reply to your enquiry. We do not use your personal data for commercial marketing unless we have your express consent, or the law authorises it and we informed you at collection time (DPA s. 37(1)).

Every marketing message we send carries a clear, easy opt-out (reply STOP, click the unsubscribe link, or tell us verbally on a call). Opting out is free and takes minimal effort (General Regulations regs. 16–17). Once you opt out of a channel, we stop using your data for that purpose; you can also ask us to stop sharing your data with third parties for their direct marketing, and we act on that within seven days, free of charge (General Regulations reg. 18).

We do not measure visits where your browser sends a Do Not Track or Global Privacy Control signal. We do not use advertising or social media trackers.

7. Who we share your data with

We share personal data only as needed for the purposes in section 4, with:

• payment providers (M-Pesa, our bank) needed to take payment;
• cloud hosting (Cloudflare), email delivery (Resend) and similar providers acting on our instructions under written contracts (General Regulations reg. 24);
• our professional advisers and auditors under confidentiality duties;
• regulators and courts where the law requires it;
• Google, which serves the fonts used on this website and therefore receives your network address when a page loads;
• your own accountant or adviser, only if you ask us to share records with them.

Where we transfer your data to a processor, the contract covers the matters required by General Regulations reg. 24 (instructions, confidentiality, security, deletion or return on termination, audit rights).

8. Transfers outside Kenya (DPA ss. 48–49)

Some providers process data on servers outside Kenya (for example the United States and other countries where Cloudflare, Resend and Google run their servers). We transfer personal data out of Kenya only where the conditions of DPA s. 48 are met and appropriate safeguards are in place under DPA s. 49, such as written contracts with essentially equivalent protection, binding corporate rules, or your consent where required. Ask us for a summary of the safeguards used for a specific transfer.

9. Your rights (DPA ss. 26, 36, 38, 40)

You have the right to:

1. be informed of the use of your personal data;
2. access your personal data in our custody;
3. object to processing of all or part of your personal data;
4. correction of false or misleading data about you;
5. deletion of false or misleading data about you;
6. data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically possible (DPA s. 38). We answer portability requests within 30 days at reasonable cost;
7. rectification and erasure as provided in DPA s. 40;
8. restrict processing in the circumstances set out in DPA s. 34.

To exercise any right, contact hello@dullugroup.co.ke. We do not charge a fee for first requests; repeated or excessive requests may attract a reasonable administrative fee as allowed by law. If a right does not apply to you (for example, deletion where we must keep data by law), we tell you why.

Rights of children and people under guardianship may be exercised by a parent, guardian, or authorised person (DPA s. 27). We do not knowingly process children's personal data for profiling or direct marketing (DPA s. 33).

10. Retention (DPA s. 39; General Regulations reg. 19)

We keep personal data only as long as reasonably necessary for the purpose it was collected, unless the law requires or authorises longer retention, or you consent to longer retention. Our retention schedule sets the periods, a periodic audit, and what happens at the end of each period:

When the purpose is spent or the period ends, we delete, erase, anonymise, or pseudonymise the data.

11. Security and breaches (DPA ss. 41–43)

We apply technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), restricted administrator access, hashed network addresses for abuse prevention, and written contracts with the processors we use (DPA ss. 41–42; General Regulations reg. 27). If a personal data breach creates a real risk of harm to you, we notify the Data Commissioner without delay and within 72 hours of becoming aware of it, and communicate with you in writing within a reasonably practical period, unless your identity cannot be established (DPA s. 43(1)). Our processors must tell us within 48 hours where reasonably practicable (DPA s. 43(3)).

12. Registration with the Office of the Data Protection Commissioner

We are a small data controller/processor below the mandatory registration threshold (annual turnover or revenue under KES 5,000,000 and fewer than 10 employees) and are exempt from mandatory registration under Registration Regulations, 2021, reg. 13(2). We still comply with the obligations and breach-notification duties of the Data Protection Act (reg. 13(3)), and we will register if our size changes or we begin processing data in the categories of the Third Schedule to those Regulations.

13. Complaints

First contact us at hello@dullugroup.co.ke. You may also lodge a complaint with the Office of the Data Protection Commissioner under DPA s. 56 (see odpc.go.ke for complaint channels). Nothing in this policy limits your right to approach a court.

14. Changes to this policy

We update this policy when our processing changes. The "last updated" date at the top tells you when it last changed. Where changes materially affect you, we notify you through this website or by email before they take effect.

15. Definitions used here

• Personal data: information relating to an identifiable natural person.
• Process / processing: collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.
• Data controller / data processor / data subject: as defined in the Data Protection Act, 2019.