Privacy notice

Who we are

StellarCosmic Global Limited (“StellarCosmic”, “we”, “us”) is a private limited company based in Nairobi, Kenya. We are the data controller for the personal data we collect through this website.

You can contact us about this notice or your personal data at privacy@stellarcosmic.com (or info@stellarcosmic.com).

This notice explains how we handle personal data under the Data Protection Act, 2019 (the Act).

What we collect

We collect the personal data you give us through the forms on this website. We ask only for what we need for each form.

Enquiry form

Your name, organisation, email address and phone number, details of your project, and any files you attach.

Site assessment form

Your name and contact details, the site location, a description of the problem, and any photos or drawings you upload. Photos can show people, vehicles or property. Where you can, please avoid sending photos that show people’s faces.

Prequalification form

Your name, job title, organisation and contact details, and details of the tender or project.

Supplier and subcontractor form

The name, role and contact details of the person registering, details of the company, and any documents you attach, such as a company profile.

Careers form

Your name and contact details, your CV, and details of your qualifications, experience and the roles you are interested in. Please do not include sensitive personal data, such as health information, religion or ethnic origin, unless we ask for it.

Uploaded files

Files you upload are stored with your form submission. They may contain personal data about you or about other people. Please upload only files you have the right to share.

Technical data

When you visit the website, our hosting provider processes technical data, such as your IP address and browser type, to deliver the pages and keep the site secure. Our analytics does not use cookies and reports only totals that do not identify you. See our cookie notice for details.

Why we use it and our lawful basis

We use your personal data to:

• reply to your enquiry and discuss your project;
• arrange and carry out a site assessment;
• send prequalification documents and answer questions about a tender;
• consider your company as a subcontractor or supplier;
• consider you for current and future roles;
• run, secure and improve this website.

We rely on these lawful bases under the Act:

• Consent. When you send a form, you agree to us using the information for the purpose of that form. We also rely on your consent to keep your CV on file. You can withdraw your consent at any time by emailing us. This does not affect our use of your data before you withdrew it.
• Legitimate interests. We use personal data to answer business enquiries, assess subcontractors and suppliers, respond to tender evaluators, and keep the website secure. We rely on this basis only where it does not cause unwarranted harm to your rights and interests.
• Legal obligation. Sometimes the law requires us to keep or share information.

We do not sell your personal data. We do not use it to make automated decisions about you. We will not send you marketing messages unless you have agreed to receive them.

Who we share it with

We share personal data only where we need to.

• Our execution partners. We deliver projects through two international execution partners. Where it is needed to answer your enquiry, assess your site or prepare a proposal, we share the relevant details with them.
• Service providers. We use Vercel Inc. to host this website and its forms, and an email service provider to receive form submissions and send replies. They process personal data on our behalf and on our instructions.
• Authorities. We may share personal data where the law requires it, for example with a court or a regulator.

Transfers outside Kenya

Some of the organisations we share data with are outside Kenya. Our execution partners are international, and our service providers may store or process data on servers in other countries.

We transfer personal data outside Kenya only as the Act allows. We protect it with safeguards such as:

• sharing only the data needed for the purpose;
• using partners and providers who give appropriate safeguards for personal data, set out in contract terms where possible;
• checking that the recipient will protect the data to a standard comparable to the Act;
• asking for your consent where the Act requires it, for example for sensitive personal data.

You can ask us for more information about the safeguards we use.

How long we keep it

We keep personal data only for as long as we need it, unless the law requires us to keep it longer.

• Enquiries and site assessment requests, including photos and drawings: 24 months from our last contact with you.
• Prequalification requests: 24 months from our last contact with you.
• Supplier and subcontractor registrations: 24 months from your last update, unless you ask us to remove them sooner.
• CVs and careers applications: 12 months from when you send them.
• Contracts: if an enquiry leads to a contract, we keep the project records for as long as the contract and the law require.

After that, we delete the data or make it anonymous.

Your rights

Under the Act, you have the right to:

• be informed about how we use your personal data;
• access the personal data we hold about you;
• correct personal data that is false, out of date, incomplete or misleading;
• delete personal data that is false or misleading, or that we no longer have a reason to keep;
• object to us processing all or part of your personal data;
• data portability, which means receiving your personal data in a structured, commonly used and machine-readable format, and having it sent to another organisation where this is possible.

You can also withdraw your consent at any time.

To use any of these rights, email privacy@stellarcosmic.com. We may need to confirm your identity first. We will respond within the time the law allows.

How to complain

If you are unhappy with how we have handled your personal data, please contact us first at privacy@stellarcosmic.com so that we can try to put it right.

You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya’s data protection regulator. The ODPC website, www.odpc.go.ke, explains how to make a complaint.

Cookies

This website uses only strictly necessary storage and cookieless analytics. See our cookie notice for details.

Security

We use appropriate technical and organisational measures to protect personal data. These include encrypted connections (HTTPS) to this website, limiting access to the people who need it, and choosing service providers who protect data properly.

No website or email system is completely secure. If a data breach puts your personal data at risk, we will notify the ODPC and, where required, you, as the Act sets out.

Children

This website is for adults and businesses. We do not knowingly collect personal data from children under 18.

If you are under 18 and interested in training or apprenticeships, please ask a parent or guardian to contact us for you. If you think a child has sent us personal data, contact us and we will delete it.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed. We will post any updated notice on this page.

Contact us

StellarCosmic Global Limited
Head Office, Suite 312, Applewood Adams, Ngong Road, Nairobi
P.O. Box 22251-00100, Nairobi, Kenya

Phone: +254 746 333333

Email: privacy@stellarcosmic.com (general enquiries: info@stellarcosmic.com)