Privacy Policy

1. Who we are

M-Grand Inspection Agency provides independent garment quality inspection, factory audit and production monitoring services from Nairobi, Kenya.

The data controller for personal data collected through this website is:

• Registered name: [REGISTERED COMPANY NAME]
• Registered address: [REGISTERED ADDRESS, NAIROBI, KENYA]
• Data protection contact: [email protected]

Company registration is in progress. This policy will be updated with the registered name and address once registration is complete.

2. What this policy covers

This policy explains what personal data we collect through mgrandinspectionagency.com, why we collect it, who helps us process it, how long we keep it, and what rights you have. It is written for the Kenya Data Protection Act, 2019.

It does not cover personal data we hold about you under a signed inspection contract. That data is governed by the contract between us.

3. What we collect

We collect only what you type into the enquiry form. The fields are:

• Your name
• Your company name
• Your work email address
• Your country
• The service or subscription plan you are enquiring about
• The number of factories involved
• The countries your factories are in
• The order details you choose to share, such as factory location, order quantity, product type and timeline

Name, work email, service or plan, and your consent are required. The other fields are optional.

We also receive aggregated, cookieless visit statistics from our analytics provider. These show page views and button clicks in total. They do not identify you.

We do not collect card details, account credentials or any sensitive personal data. We do not ask for the personal data of third parties, and you should not include it in the order details field.

4. Why we collect it, and our lawful basis

We use the information you submit to:

• Read and understand your enquiry
• Prepare a scope and quotation for the work you are asking about
• Reply to you and answer follow-up questions
• Keep a record of the enquiry while it is live

Our lawful basis under section 30 of the Kenya Data Protection Act, 2019 is twofold. You give consent by ticking the consent box on the form. Processing is also necessary to take steps at your request before entering into a contract.

We do not use your details for marketing unless you ask us to. We do not sell or rent personal data, and we do not use it for automated decision-making or profiling.

5. Who processes your data on our behalf

We use a small number of third-party services to run the website and deliver enquiries. Each acts as a data processor on our instructions.

These providers store and process data on servers outside Kenya. By submitting the form you accept that your details will be transferred outside Kenya for this purpose. We choose providers that publish their own security and data protection terms, and we keep the number of processors to a minimum.

For legal review
Legal review of whether a cross-border transfer assessment or additional safeguards are required under the Act’s cross-border transfer provisions.

6. How long we keep your data

Enquiries that do not lead to an engagement are deleted from our mailbox and from the form service after 30 days, at the next monthly deletion run.

We run this deletion as a documented monthly routine. The privacy@ mailbox owner is responsible for it.

If your enquiry becomes an engagement, your details move into our customer records and are kept under the contract between us, for as long as the law requires us to keep business and tax records.

Retention at the form service is set to the minimum the provider allows, or disabled where the provider allows that. Our mailbox is the system of record.

7. Cookies and tracking

This website sets no cookies. It uses no advertising pixels, no social media trackers and no cross-site tracking of any kind.

Our analytics are cookieless and aggregated, which is why you see no cookie consent banner. We cannot follow you between sites or across sessions.

8. Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

• Be informed of the use to which your personal data is put
• Access the personal data we hold about you
• Object to the processing of all or part of your personal data
• Have false or misleading data about you corrected
• Have false or misleading data about you deleted

You may withdraw your consent at any time. Withdrawing consent does not affect processing that already took place while consent was in force.

To exercise any of these rights, write to [email protected]. Please tell us which right you are exercising and give us enough detail to find your enquiry. We may ask you to confirm your identity before we act.

We respond within the period required by the Act.

For legal review
Legal review of the rights list above against the current text of the Act and any regulations made under it.

9. Complaints

If you are not satisfied with how we have handled your personal data, please write to [email protected] first so that we can put it right.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner in Kenya.

For legal review
Confirm whether registration with the Office of the Data Protection Commissioner is required for this business, and update this section accordingly.

10. How we protect your data

The website is served over HTTPS. There is no database, no login area and no server application to attack, because the site is published as static files.

Access to the mailboxes and to the form service account is limited to the founders and the agency’s website engineer as a delegated user, and is protected by two-factor authentication.

No transmission over the internet is completely secure. We take reasonable technical and organisational measures, but we cannot guarantee absolute security.

11. Changes to this policy

We may update this policy as the business changes or as our legal adviser recommends. The date at the top shows when it was last changed. Material changes will be noted on this page.

12. Contact

For anything in this policy, including access, correction and deletion requests, write to [email protected].

For general enquiries about our services, write to [email protected].