Privacy Policy

1.Definitions

Personal data

any information relating to an identified or identifiable natural person, as defined in the Data Protection Act, 2019.

Data subject

the individual to whom personal data relates, which may be you.

Data controller

the person who determines the purpose and means of processing personal data.

Data processor

the person who processes personal data on behalf of a data controller.

Processing

any operation performed on personal data, including collecting, recording, storing, using, sharing, restricting, erasing or destroying it.

Sensitive personal data

data revealing race, health status, ethnic or social origin, conscience, belief, genetic or biometric data, property details, marital status, family details or sexual orientation, as defined in the Act. We do not ask for it.

Data Commissioner

the Data Protection Commissioner, who heads the Office of the Data Protection Commissioner (ODPC), the Kenyan regulator under the Act.

2.Who is responsible for your data

1. 2.1For personal data collected through the Site, from prospective clients and from our own business dealings (suppliers, invoicing and records), Marabi Made It is the data controller. We operate from Nairobi, Kenya.
2. 2.2For personal data that a client's own customers, staff or users place into a system we build, host or support (for example an e-commerce store or CRM), the client is the data controller and we act as its data processor. Section 13 explains how we handle that data.
3. 2.3Privacy questions, requests and complaints go to marabimadeit@gmail.com, marked "Privacy". Our principals, Aineah Marabi (Founder) and Ian Otollo (Co-Founder), are responsible for data protection at the studio.

3.The data we collect

4.How we collect it

1. 4.1Directly from you: when you email or call us, complete the enquiry form, attend a discovery call, sign a Statement of Work or pay an invoice.
2. 4.2Automatically: when you use the Site, our hosting infrastructure records standard server logs. These are used only for security, reliability and troubleshooting.
3. 4.3Through the enquiry form: the form on the Site prepares an email in your own email application addressed to marabimadeit@gmail.com. Our Site does not transmit or store what you type unless and until you send that email.
4. 4.4From third parties: occasionally from a referrer who introduces you to us, or from public sources such as your organisation's website. We use such information only to respond to you and tell you where we obtained it if you ask.

5.Why we use it and our lawful basis

6.Consent

1. 6.1Where we rely on your consent, it will be specific, informed and given by a clear affirmative action, such as clicking "Allow" on the cookie banner or ticking a marketing box. We do not use pre-ticked boxes or treat silence as consent.
2. 6.2Refusing or withdrawing consent never affects your access to the Site or to our services. You can withdraw consent at any time using the Cookie settings link in the footer or the unsubscribe link in any email, or by writing to us. Withdrawal does not affect processing carried out before you withdrew.

7.The Marabi assistant and on-device storage

1. 7.1The Marabi assistant is a guided feature on the Site that helps you understand our services and prepare a project brief. It runs in your browser.
2. 7.2The assistant keeps its state, such as whether it is awake and which prompts you have dismissed, and any draft brief you create, in your browser's local storage on your own device. We cannot see this data and it is not sent to us or to any third party by the assistant.
3. 7.3A brief reaches us only if you choose to send it, through the enquiry form, which opens your email application. You can delete the stored data at any time by clearing this site's data in your browser settings.
4. 7.4If we change the assistant so that it processes your conversation on a server or with a third-party service, we will update this policy before enabling that change, explain what is processed and by whom, and ask for your consent where the law requires it.

8.Who we share personal data with

1. 8.1Service providers acting on our instructions under written terms: hosting and infrastructure providers, email and communication tools, accounting and invoicing software, document-signing tools, and payment providers such as Safaricom (M-Pesa) and banks. They may use the data only to provide their service to us.
2. 8.2Professional advisers such as lawyers, accountants, auditors and insurers, who are bound by duties of confidentiality.
3. 8.3Courts, regulators and law-enforcement authorities, where we are legally required to disclose or where it is necessary to establish, exercise or defend legal claims.
4. 8.4A buyer or successor of our business, if it is sold or reorganised, who must honour this policy and give you notice of any material change.
5. 8.5We do not otherwise disclose personal data. We do not permit processors to use it for their own purposes.

9.Transfers outside Kenya

1. 9.1Some of our providers store or process data outside Kenya. We transfer personal data out of Kenya only as permitted by sections 48 to 50 of the Data Protection Act, 2019: where the recipient country or provider offers appropriate safeguards for the protection of personal data, such as binding contractual terms; where you have consented after being informed of the risks; or where another condition in the Act is met.
2. 9.2Where Kenyan law requires certain personal data to be processed in Kenya, for example in connection with strategic interests of the State or certain categories of sensitive data, we will keep it in Kenya.
3. 9.3You may ask us where your data is held and what safeguards apply by writing to marabimadeit@gmail.com.

10.How long we keep it

11.How we protect personal data

1. 11.1We apply technical and organisational measures appropriate to the risk, as the Data Protection Act, 2019 requires, including data protection by design and by default. These include encryption in transit using TLS, access limited to those who need it, multi-factor authentication on administrative accounts, regular software updates and dependency review, separate environments for development and production, and routine backups.
2. 11.2Everyone who may access personal data on our behalf is bound by a duty of confidentiality. We review our measures at least annually and when our systems change.
3. 11.3More detail, and how to report a vulnerability, is in our Security & Responsible Disclosure policy.

12.Personal data breaches

1. 12.1If a personal data breach occurs, we will contain it, assess the risk to individuals, and record it.
2. 12.2Where we are the controller and the breach is likely to result in a real risk of harm to your rights and freedoms, we will notify the Data Commissioner within 72 hours of becoming aware of it, as section 43 of the Data Protection Act, 2019 requires, and will notify you without unreasonable delay, describing what happened, the likely consequences, the measures we have taken, and what you can do to protect yourself.
3. 12.3Where we are a processor for a client, we will notify the client without undue delay, and in any event within 48 hours of confirming the breach, so that it can meet its own obligations.

13.When we are your processor

1. 13.1When we act as a processor for a client, we will: process personal data only on the client's documented instructions; keep it confidential; apply appropriate security measures; engage sub-processors only under written terms that give the same protections, and tell the client who they are on request; help the client respond to data subject requests and to breaches and impact assessments; and, when the engagement ends, delete or return the data at the client's choice within 60 days unless the law requires us to keep it.
2. 13.2The client is responsible for having a lawful basis to give us the data, for the notices it gives its own customers, and for registering with the Data Commissioner where the Act requires it to do so.
3. 13.3These commitments form part of the Engagement Terms and any Statement of Work, and a separate data processing agreement is available on request.

14.Your rights

15.How we handle your requests

1. 15.1Send your request to marabimadeit@gmail.com, marked "Privacy", saying what you want and giving enough detail for us to find your data. We may ask for information to verify your identity, and for authority if someone is acting on your behalf.
2. 15.2We respond promptly, and in any event within the time the Data Protection (General) Regulations, 2021 and the Act require. We aim to reply within seven days. If a request is complex and we need longer, we will tell you why and when to expect a full response.
3. 15.3We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we will explain our reasons and may charge a reasonable administrative fee or decline, as the law allows.
4. 15.4If we refuse a request, we will give you our reasons in writing and tell you how to complain.

16.Children

1. 16.1The Site and our services are for businesses and adults. We do not knowingly collect personal data from a child, meaning a person under 18, without the consent of a parent or guardian, as section 33 of the Data Protection Act, 2019 requires.
2. 16.2If you believe a child has given us personal data, please tell us at the address above and we will delete it.

17.Automated decision-making

1. 17.1We do not use personal data for solely automated decision-making that has legal or similarly significant effects on you, and we do not build profiles of visitors for advertising.
2. 17.2The Marabi assistant offers guided suggestions based on the choices you make in it. Its output is a convenience, not a decision about you, and a person at our studio makes every decision about proposals and pricing.

18.Cookies and similar technologies

1. 18.1We use only a small amount of browser storage to remember your cookie choice and the state of the Marabi assistant. We do not use advertising cookies. Analytics, if we activate it, will load only after you consent.
2. 18.2Details of each item, what it does and how long it lasts are in our Cookie Policy at marabimadeit.co.ke/cookies.

19.Links to other websites

1. 19.1The Site may link to websites run by others, including social media platforms and messaging services such as WhatsApp and Instagram. When you follow a link, the other site's privacy practices apply, not ours. We encourage you to read their policies. We are not responsible for them.

20.Complaints

1. 20.1If you are unhappy with how we have handled your personal data, please contact us first at marabimadeit@gmail.com. We will investigate and reply in writing.
2. 20.2You also have the right to lodge a complaint with the Data Commissioner at the Office of the Data Protection Commissioner of Kenya, under section 56 of the Data Protection Act, 2019, at any time and whether or not you have first contacted us.

21.Changes to this policy

1. 21.1We will post any change on this page with a new date. If a change materially affects data we already hold, we will tell you directly, for example by email. Last updated 5 November 2026.