Skip to main content
Global Sites Ltd
SearchTalk to us

Privacy Policy

This policy explains what personal data Global Sites Ltd collects through this website, why we collect it, how long we keep it, who we share it with and the rights you have. It applies to globalsitesltd.com and its pages about Global Wakili. The Global Wakili application itself has its own privacy notice.

Last updated:

Global Sites Ltd ("Global Sites", "we", "us") is a technology company based in Nairobi, Kenya. For personal data collected through this website we are the data controller under the Data Protection Act, 2019.

Questions about this policy or your personal data can be sent to hello@globalsitesltd.com, marked "Data protection", or raised by phone on +254 (0)724 178 878.

We handle personal data in line with the principles in section 25 of the Data Protection Act. In practice this means we:

  • collect only what we need for a stated purpose, and nothing for purposes you would not expect;
  • tell you at the point of collection what we will do with the data;
  • keep it accurate, secure and no longer than necessary;
  • do not sell personal data or use it for automated decisions about you.

The table below sets out each kind of data, why we use it and the legal basis we rely on.

  • Contact form: first and last name, work email, organisation, organisation size, phone number (optional), topic and message. Purpose: to reply to your enquiry. Legal basis: your consent, given by ticking the consent box, and steps you ask us to take before a possible contract.
  • Global Wakili demo request: first and last name, work email, firm name, firm size, phone number (optional), area of interest and message. Purpose: to arrange and hold a demonstration and, if you ask, prepare a quotation. Legal basis: your consent and pre-contractual steps.
  • Email acknowledgement: your email address and first name are used to send one confirmation that we received your message. Legal basis: the same as the form you used.
  • Security and abuse prevention: your IP address and the time of your request, used briefly to limit repeated form submissions and to protect the site. Legal basis: our legitimate interest in keeping the service secure.
  • Server and error logs: technical records kept by our hosting provider (such as requested page, time, browser type and IP address). Purpose: operating, securing and troubleshooting the website. Legal basis: legitimate interest.
  • Cookie choice: whether you accepted or declined analytics cookies. Legal basis: necessary to respect your choice.
  • Analytics, only if you accept: pages viewed, approximate location derived from your IP address, device and browser type, and how you reached the site. Purpose: understanding which content is useful. Legal basis: your consent.

The "Chat with us" button offers links to WhatsApp, email and phone. Nothing is collected by this website when you use them. If you choose WhatsApp, your conversation is handled by WhatsApp under its own terms and privacy policy, and we use your messages only to respond to you. If a live-chat service is added in future, this policy will be updated before it is switched on.

We share personal data only where needed for the purposes above, and only with organisations that process it on our instructions under written terms:

  • our web hosting provider, which runs the website and our email system;
  • analytics providers (such as Google or LinkedIn), only if you accept analytics cookies;
  • professional advisers, regulators, courts or law enforcement where the law requires it or to establish, exercise or defend legal claims.

Some service providers, particularly analytics providers, may process data outside Kenya. Where this happens we rely on the safeguards allowed under sections 48 to 50 of the Data Protection Act and the Regulations, such as appropriate contractual safeguards, or your consent where required. You can ask us for details of the safeguards that apply.

  • Enquiries and demo requests that do not lead to a business relationship: deleted within 24 months of our last contact with you.
  • Where an enquiry leads to a contract: kept for the duration of the relationship and for up to 7 years afterwards, to meet accounting, tax and legal obligations.
  • Rate-limiting data (IP address and time): held in memory for about 10 minutes and not stored.
  • Server logs: kept by our hosting provider according to its standard log rotation, normally a few months.
  • Cookie choice: 12 months, after which we ask again.

The website is served only over encrypted connections (HTTPS with HSTS). Form input is validated on our servers, protected against automated abuse and never shown back to other visitors. Messages are delivered directly to our own mail system. Access to enquiry mailboxes is limited to staff who need it, and we review that access regularly.

If a personal data breach is likely to create a real risk to you, we will notify the Data Commissioner within 72 hours of becoming aware of it, and tell you without undue delay where the law requires, as set out in section 43 of the Act.

Under the Data Protection Act you have the right to:

  • be informed about how your personal data is used;
  • access the personal data we hold about you;
  • object to processing of all or part of your personal data;
  • have false or misleading data corrected;
  • have personal data deleted where we no longer have a lawful reason to keep it;
  • ask us to restrict processing in certain circumstances;
  • receive your data in a structured, commonly used, machine-readable format (data portability);
  • withdraw consent at any time, without affecting processing that happened before you withdrew it.

Email hello@globalsitesltd.com with the subject "Data protection request" and tell us what you would like us to do. We may ask you to confirm your identity before acting. We will respond within the time limits set by the Act and Regulations and, in any case, without undue delay. There is no charge for a reasonable request.

If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner (ODPC), Kenya.

This website is intended for organisations and professionals. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

We review this policy at least once a year and whenever we change how the website handles personal data. The date at the top shows when it last changed. Significant changes will also be highlighted on the website.

Cookies on this website

We would like to use analytics cookies to understand how the site is used. They are only set if you accept. You can change your mind at any time from “Cookie settings” in the footer. Read the cookie policy.