01Who we are

Mshale Enterprises Limited (“Mshale”, “we”, “us”, “our”) is an international procurement and supply partner based in Nairobi, Kenya. For the purposes of the Data Protection Act, 2019 (the “Act”), we are the data controller of the personal data described in this policy.

We are registered with the Office of the Data Protection Commissioner (ODPC) as a data controller under registration number [ODPC registration number].

Company: Mshale Enterprises Limited, [company registration number]
Address: 5 Palm Court, Off Waiyaki Way, Westlands, Nairobi, Kenya
Postal address: P.O. Box 24512-00502, Nairobi, Kenya
Email: info@mshaleenterprises.com
Phone: +254 (0) 722 360 757
Data protection contact: [Name / title of Data Protection Officer], [privacy email]

02Scope of this policy

This policy explains how we collect, use, share, store and protect personal data when you visit our website, use our client portal, contact us, request a quotation, or work with us as a client, supplier or partner. It is provided to meet our duty to notify under section 29 of the Act.

Our website may link to third-party websites. We are not responsible for how those websites handle personal data, and we encourage you to read their privacy policies.

03Personal data we collect

Identity and contact details: name, job title, organisation, email address, phone number and postal or delivery address.
Enquiry and engagement details: the requirements, specifications, quotations, orders, delivery instructions and correspondence you share with us.
Account details: the login ID and password (stored in encrypted form) you use for our client portal, and records of your activity in the portal.
Transaction details: invoicing, payment and tax information needed to complete and account for an order, such as a KRA PIN for businesses.
Supplier and partner details: information about representatives of suppliers, manufacturers, logistics providers and partners we work with.
Technical details: IP address, browser type, device information and session cookies generated when you use our website or portal.

We do not intentionally collect sensitive personal data as defined in the Act, such as health data or data on ethnic origin. Please do not send us this kind of information unless we ask for it for a specific, lawful reason.

04How we collect personal data

Directly from you, when you fill in a form, email or call us, request a quotation, place an order or register for the client portal.
From your organisation, when a colleague names you as a contact for an engagement or delivery.
From suppliers, logistics providers and customs agents involved in fulfilling an order.
Automatically, through session cookies and server logs when you use our website and portal.
From publicly available sources, such as company registries and procurement notices, where relevant to an engagement.

05Why we use personal data and our lawful basis

Under section 30 of the Act, we only process personal data where we have a lawful basis. We use personal data for the following purposes:

Purpose	Lawful basis
Responding to enquiries and preparing quotations	Steps taken at your request before entering into a contract; our legitimate interests
Sourcing, procuring and delivering goods and services	Performance of a contract
Operating the client portal and keeping accounts secure	Performance of a contract; our legitimate interests
Invoicing, accounting, tax and customs compliance	Compliance with a legal obligation
Supplier due diligence, fraud and anti-bribery checks	Compliance with a legal obligation; our legitimate interests
Improving our website and services	Our legitimate interests
Sending news and updates about our services	Your consent

Where we rely on legitimate interests, we have considered your rights and freedoms and are satisfied that they do not override our interests. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

06Who we share personal data with

We do not sell personal data. We share it only where necessary for the purposes above, with:

Suppliers and manufacturers, to source and fulfil your requirement.
Freight forwarders, logistics providers, clearing and customs agents, to deliver goods.
Service providers who host our website, email and client portal, or provide IT, accounting and professional services.
Banks and payment providers, to process payments.
Government authorities, regulators and courts, including the Kenya Revenue Authority, where required by law.

Service providers who process personal data on our behalf act as data processors. We engage them under written contracts that require them to process the data only on our instructions and to keep it secure, as required by section 42 of the Act.

07Transfers outside Kenya

Because we source internationally, some personal data (usually business contact and delivery details) may be transferred to suppliers, logistics providers or service providers outside Kenya. We only make such transfers in line with sections 48 to 50 of the Act and the Data Protection (General) Regulations, 2021. This means one of the following applies:

The recipient country or organisation provides appropriate safeguards for the protection of personal data.
The transfer is necessary to perform a contract with you, or a contract made in your interest.
You have given your consent after being told of the possible risks.

We do not transfer sensitive personal data outside Kenya without your consent.

08How long we keep personal data

In line with section 39 of the Act, we keep personal data only for as long as it is needed for the purpose it was collected for, or as required by law. In general:

Enquiries that do not lead to an engagement are kept for up to [24 months].
Contract, order, invoice and tax records are kept for at least five years, as required by the Tax Procedures Act, 2015, and longer where a dispute or legal claim requires it.
Client portal accounts are kept while active and deleted or anonymised [12 months] after closure.
Marketing preferences are kept until you unsubscribe or withdraw consent.

When personal data is no longer needed, we delete it, destroy it, or anonymise it so that it can no longer identify you.

09How we protect personal data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure, as required by section 41 of the Act. These include access controls, encrypted passwords, secure connections for the client portal, and confidentiality obligations for staff and processors.

If a personal data breach creates a real risk of harm, we will notify the Data Protection Commissioner within 72 hours of becoming aware of it and will inform affected people as soon as reasonably practicable, as required by section 43 of the Act.

10Your rights

Under sections 26, 37, 38 and 40 of the Act, you have the right to:

Be informed of how your personal data is used.
Access the personal data we hold about you.
Object to the processing of all or part of your personal data.
Ask us to correct false or misleading data.
Ask us to delete false, misleading or unlawfully processed data.
Receive your data in a structured, commonly used and machine-readable format and have it transmitted to another controller, where technically possible.
Withdraw consent at any time, where we rely on consent.
Not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions.

To exercise any of these rights, email [privacy email] or write to us at the address above. We may need to confirm your identity before acting on a request. We will respond within the timelines set by the Data Protection (General) Regulations, 2021, and we will not charge a fee except where the law allows.

11Direct marketing

We only send marketing messages where you have consented or where the law otherwise allows, as required by section 37 of the Act. Every marketing email includes a simple way to opt out, and you can also opt out at any time by emailing info@mshaleenterprises.com.

12Cookies

Our website uses only the session cookies needed for the client portal to work while you are logged in. These cookies are deleted when you close your browser. We do not use advertising or tracking cookies. If we introduce analytics or other non-essential cookies in future, we will update this policy and ask for your consent first.

13Children

Our website and services are intended for businesses and organisations, and are not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has given us personal data, please contact us and we will delete it, in line with section 33 of the Act.

14Complaints

If you have a concern about how we handle personal data, please contact us first so that we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner:

Office: Office of the Data Protection Commissioner, Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi
Post: P.O. Box 30920-00100, Nairobi
Email: complaint@odpc.go.ke
Website: www.odpc.go.ke

15Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. Where changes are significant, we will tell our clients directly. This version was last updated on 29 September 2026.

privacy policy