Who this policy covers
GraphiqLab Studios Limited (“GraphiqLab”, “we” or “us”) is based in Kenya. This policy covers personal data we handle for our own website, enquiries, proposals, client relationships, billing and studio operations. It applies to visitors, prospective and current clients, suppliers and other people who communicate with us.
For those activities, GraphiqLab determines why and how the data is used. Where we develop, host or support a system on a client’s instructions, the client may instead determine those purposes and act as the data controller, while GraphiqLab acts as a processor or service provider. The client’s own privacy notice and our project agreement govern that system’s end-user data; this page does not replace them.
Data we collect
- Enquiry and contact details: name, organisation, email address, phone number, messages and preferred contact method.
- Project details: service interests, goals, budget, timelines, files, feedback and correspondence you choose to share.
- Business records: contracts, invoices, payment status and information needed for accounting and delivery. We do not ask for full payment-card details through our project forms.
- Technical information: basic request, device or browser information that a hosting provider or security service may log when you access the site.
Please do not send health records, identity documents, passwords or other sensitive information through a general enquiry form unless we have agreed on an appropriate secure channel.
Some details are optional. If essential contact or project information is missing, we may not be able to answer your request or prepare a meaningful proposal.
Why we use it
| Purpose | Typical information | Lawful ground, where applicable |
|---|---|---|
| Respond to enquiries and prepare proposals | Contact and project details | Steps before a contract or our legitimate business interest in responding |
| Deliver work and provide support | Project materials and correspondence | Performance of a contract |
| Manage invoices, records and compliance | Billing and transaction records | Contractual or legal obligations |
| Protect the website and resolve disputes | Relevant technical logs and communications | Legitimate interests or legal obligations |
| Send optional promotional updates | Contact details and preferences | Consent or another ground permitted by law, with an opt-out |
We use data only for specified purposes compatible with why it was collected. We do not treat a visit to our website as blanket consent to unrelated uses.
Who may receive data
We do not sell personal data. We may share only what is needed with people and service providers involved in our operations, including authorised team members or contractors, hosting and email providers, professional advisers, and authorities where disclosure is legally required.
Our contact and project forms use Web3Forms to transmit submissions to us. If you choose to contact us through WhatsApp, your communication is handled through WhatsApp’s service and its own privacy terms. We may use email or other agreed channels to reply. Third-party services may process information under their own policies and in other countries.
Before giving a supplier access to client or personal data, we should assess the access needed and put suitable confidentiality, security and processing terms in place.
Systems we build for clients
Websites, portals, automation workflows and software we build for clients may collect data from their own users. Responsibility depends on who decides the purposes and means of that processing, the service agreement and applicable law. Clients should provide their users with an appropriate privacy notice, identify a lawful basis, manage access and retention, and assess any industry-specific requirements.
Where GraphiqLab handles end-user data on a client’s behalf, we should do so under documented instructions and an appropriate data-processing agreement. Requests about a client-operated system should normally be directed first to that client; we will assist as required by our agreement and law.
AI and automation
We may use software, automation and AI-assisted tools in design, development and administrative workflows. We aim to minimise personal data submitted to these tools, apply access controls and review outputs before they are relied upon. Client confidential or sensitive data should not be entered into third-party AI services unless the project terms, provider safeguards and applicable law permit it.
If a particular project involves materially different automated processing of personal data, the relevant project notice or agreement should explain that processing separately.
Cookies and external links
Our website or its hosting services may use technical storage or logs required to display pages, maintain security and operate forms. Some external content or links may take you to services with their own privacy practices. If we add non-essential analytics, advertising pixels or similar tracking, we will describe them and provide any choice or consent required by law. You can also manage browser cookies in your browser settings.
Processing outside Kenya
Some hosting, email, form, messaging or project tools may process data outside Kenya. Where Kenyan law requires a basis or safeguards for an international transfer, we will assess and apply the relevant requirements, which may include appropriate contractual or other safeguards or valid consent where applicable. We do not assume that using a global service by itself satisfies those requirements.
Retention and security
We retain personal data only as long as needed for the purpose collected, agreed project support, legal or financial recordkeeping, or a legitimate dispute or security need. The period depends on the data type, the relevant contract and applicable law. When no longer needed, we delete, anonymise or securely archive it as appropriate.
We use reasonable organisational and technical measures proportionate to the data and service, including limiting access and choosing suitable service providers. No online service can be guaranteed completely secure. If an incident occurs, we will assess it, contain it where possible and make notifications required by law or contract.
Your privacy rights
Under Kenya’s Data Protection Act, you may request information about how your data is used, access data held about you, object to processing, and ask for false or misleading data to be corrected or deleted. Other rights or remedies may apply depending on the circumstances and applicable law. Where processing relies on consent, you may withdraw it; this will not affect processing already lawful before withdrawal.
To make a request, email us using the contact below and describe the data or processing concerned. We may need to verify your identity and may be unable to fulfil a request where a lawful exception applies. You may also file a complaint with Kenya’s Office of the Data Protection Commissioner.
Children’s information
Our own website and studio services are intended for business enquiries, not for children to use independently. If we learn that a child’s personal data was submitted to us without an appropriate lawful basis or authorisation, we will assess it and take appropriate action. A client system designed for children requires its own specific privacy and safeguarding assessment.
Questions or requests?
We may update this policy when our services, suppliers or legal requirements change. A revised version will show a new update date here. Material changes may also be communicated by another appropriate method.
For privacy questions, requests or concerns, contact GraphiqLab Studios Limited, Kenya, at graphiqlabcompany.ke@gmail.com or +254 759 902 888. Please do not include sensitive documents in your first message; we can arrange a suitable channel if needed.