Privacy Policy

01. Introduction & Scope

This Policy applies to all visitors, prospective clients, registered client portal users, and administrators who interact with Flochild Engineering's website and digital services, regardless of the device used to access them. It does not apply to third-party websites that may be linked from our platform, which are governed by their own privacy policies.

By using our Services, you acknowledge that you have read and understood this Policy. If you do not agree with our practices, please do not use our Services or submit personal information to us.

02. Information We Collect

When you use our platform, we collect the following categories of information to provide and continuously improve our services to you:

• Account & Profile Details: Full name, email address, corporate entity/company name, physical or site address, and telephone numbers.
• Transaction & Business Records: Quotations, service line items, invoices, project specifications, payment status, and financial amounts associated with your bookings and projects.
• Project & Communication Content: Messages, appointment details, uploaded documents, drawings, photographs, or other attachments submitted through the client portal.
• Account Credentials: Login identifiers and encrypted authentication data used to secure access to the client and admin portals.
• Technical Log Data: Browser type, IP address, device identifiers, pages visited, time and date of visits, referring URLs, and diagnostic information collected automatically as you use our website.

03. How We Use Your Information

We process collected data for legitimate business, operational, and legal purposes, including:

• Operating, maintaining, and securing user dashboards and administrative tools.
• Generating, processing, and dispatching commercial quotations, estimates, and invoices.
• Scheduling and coordinating site visits, service bookings, and project appointments.
• Communicating important service updates, security alerts, and administrative notifications.
• Evaluating and responding to job applications submitted through our careers page.
• Analyzing usage patterns to improve the performance, security, and usability of our platform.
• Complying with applicable legal obligations, tax documentation requirements, and dispute resolution processes.

04. Legal Basis for Processing

In line with the Kenya Data Protection Act, 2019, we process your personal data where it is necessary to perform a contract with you (e.g. delivering a quoted service), where you have given consent (e.g. optional marketing communications), where we have a legitimate business interest that does not override your rights (e.g. platform security and fraud prevention), or where processing is required to comply with a legal obligation.

05. Cookies & Tracking Technologies

We use essential cookies and similar technologies to keep you signed in to the client portal, remember basic preferences, and maintain the security of your session. We do not use cookies to sell your data or build advertising profiles about you. You can control or disable cookies through your browser settings, though doing so may limit certain portal features.

06. Sharing of Information & Third-Party Providers

We do not sell, trade, or rent your personal identification information to third parties. We may share information in the following limited circumstances:

• Service providers: Trusted vendors that support our operations, such as database hosting, email delivery, and payment processing providers, bound by confidentiality and data protection obligations.
• Subcontractors or delivery partners: Where directly necessary to deliver a specific project you have engaged us for, limited to what is required to complete the work.
• Aggregated data: Generic, anonymized demographic or usage statistics that cannot reasonably identify you, which we may share with business partners for reporting purposes.
• Legal & regulatory disclosures: Where required by Kenyan law, court order, or a valid request from a public authority.

07. International Data Transfers

Some of our service providers (such as cloud hosting and infrastructure partners) may process data on servers located outside Kenya. Where this occurs, we take reasonable steps to ensure such providers maintain data protection standards consistent with the Kenya Data Protection Act, 2019, including contractual safeguards where applicable.

08. Data Security & Storage

We implement industry-standard security protocols, including Row-Level Security (RLS) policies, encrypted database connections, role-based access permissions, and restricted administrative privileges. Access to client and project data within the admin portal is limited to authorized personnel on a need-to-know basis. While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

09. Data Retention

We retain personal data for as long as necessary to provide the Services, maintain project and financial records required under Kenyan tax and commercial law, and resolve disputes. Inactive client portal accounts and associated records may be archived or anonymized after an extended period of inactivity. You may request earlier deletion of your data, subject to our legal retention obligations, as described in Section 10.

10. Your Data Protection Rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access, update, or correct your personal profile data at any time.
• Request the deletion or anonymization of inactive or obsolete records, subject to our legal and contractual retention requirements.
• Object to or request restriction of certain types of processing.
• Request a copy of your personal data in a portable format, where feasible.
• Opt out of non-essential communications or promotional bulletins.
• Lodge a complaint with the Office of the Data Protection Commissioner of Kenya if you believe your data protection rights have been violated.

To exercise any of these rights, contact us using the details provided at the end of this Policy. We will respond within a reasonable timeframe and in accordance with applicable law.

11. Children's Privacy

Our Services are intended for businesses and individuals aged 18 and above. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child, we will take reasonable steps to delete it promptly.

12. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you without human review. Where any automated tools assist in generating quotations or scheduling, final decisions affecting pricing or service delivery involve human oversight.

13. Data Breach Notification

In the event of a data breach that poses a real risk of harm to you, we will notify the Office of the Data Protection Commissioner and affected individuals within the timeframes required under the Kenya Data Protection Act, 2019, and take reasonable steps to contain and remediate the incident.

14. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the revised Policy on this page and updating the effective date at the top. Continued use of our Services after changes take effect constitutes acceptance of the updated Policy. You are advised to review this Privacy Policy periodically.