Privacy Policy
Last updated: Oct 4, 2026
This policy explains what personal data Creative Bay collects through creativebay.co.ke, why we collect it, who we share it with and the rights you have under the Kenya Data Protection Act, 2019 (the “Act”) and the Data Protection (General) Regulations, 2021.
By using our website or sending us an enquiry, you acknowledge that your personal data will be handled as described here. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.
Effective date: 4 October 2026
1. Who we are
Creative Bay (“Creative Bay”, “we”, “us”, “our”) is a digital technology company and the data controller for the personal data described in this policy.
| Name | Creative Bay |
|---|---|
| Location | Nation Centre, Kimathi Street, Nairobi, Kenya |
| info@creativebay.co.ke | |
| Phone / WhatsApp | +254 181 941 445 |
2. Personal data we collect
We collect only the data we need to respond to you and run our website.
Data you give us
- Enquiry and quote forms: your name, company or organisation, email address, phone or WhatsApp number, industry, project details and budget or timeline information you choose to share.
- Uploaded files: briefs, documents or images you attach to an enquiry. Please do not upload sensitive personal data (such as health, financial or identity documents) unless we have asked for it.
- Communications: messages you send us by email, phone or WhatsApp, and our replies.
Comments and user accounts
- Comments: if you comment on a blog post, we collect the name, email address and website you enter, your comment, and your IP address and browser user agent string to help detect spam. Your name and comment are shown publicly once approved; your email address is never published.
- Gravatar: an anonymised string created from your email address (a hash) may be sent to the Gravatar service to check whether you have a profile picture there. If you do, it appears next to your approved comment. See the Automattic Privacy Policy.
- Registered users: if you have an account on our site (for example as a staff member or client with portal access), we store the details in your user profile. You can view and edit them at any time, except your username.
Data collected automatically
- Attribution data: the page you first landed on, the referring website and campaign parameters (such as utm_source, utm_medium and utm_campaign), so we know which channels bring enquiries.
- Technical data: IP address, browser type, device type and the date and time of your visit, recorded in server logs for security and troubleshooting.
- Analytics and advertising data: only if you accept cookies, information about how you use the site, collected through tools such as Google Analytics, Google Ads and Meta Pixel (see section 4).
We do not knowingly collect sensitive personal data as defined in section 2 of the Act.
Data from third parties. If you accept advertising cookies, Google and Meta may give us aggregated reports on how our ads perform and which visitors went on to send an enquiry. These reports do not identify you by name. If you reach us through a referral partner or an advertising lead form, we receive the contact details you gave on that form.
3. How we use your data and our lawful basis
We process personal data only where section 30 of the Act allows it. We do not sell your personal data.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and preparing quotes | Enquiry details, uploaded files, communications | Steps taken at your request before entering a contract |
| Delivering services you have engaged us for | Contact details, project information, communications | Performance of a contract |
| Understanding which channels bring enquiries | Attribution data | Our legitimate interests in measuring our marketing |
| Website analytics and advertising measurement | Analytics and advertising cookie data | Your consent, given through the cookie banner |
| Keeping the website secure and working | Technical data, essential cookies | Our legitimate interests in security |
| Invoicing, accounting and tax records (clients) | Name, company, billing details | Compliance with a legal obligation |
| Sending updates or marketing messages | Email, phone or WhatsApp number | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have weighed them against your rights and you can object at any time (see section 9). We do not make decisions about you based solely on automated processing. If you accept advertising cookies, Google and Meta may use the data their tools collect to build advertising profiles and decide which ads to show you; we do not receive those profiles, and you can stop this by rejecting advertising cookies or adjusting your Google and Meta ad settings.
4. Cookies and similar technologies
Analytics and advertising cookies stay off until you accept them; essential cookies are always on because the site cannot work without them.
| Category | What it does | Examples | How long | Needs consent? |
|---|---|---|---|---|
| Essential | Keeps the site secure, remembers your cookie choice and makes forms work | Session and consent cookies | Session to 12 months | No |
| Login (registered users only) | Keeps you signed in and remembers screen display choices | WordPress login and screen-options cookies | Login: 2 days, or 2 weeks with “Remember Me”; screen options: 1 year | No |
| Comment details | Saves your name, email and website so you need not retype them | WordPress comment cookies (only if you tick the box) | 1 year | Yes (opt-in box) |
| Analytics | Measures visits and how pages are used, in aggregate | Google Analytics | Up to 2 years | Yes |
| Advertising | Measures the results of our ad campaigns and may help show you our ads on other sites | Google Ads, Meta Pixel | Up to 90 days | Yes |
Visiting the login page sets a temporary test cookie with no personal data, deleted when you close your browser. When a staff member edits a post, a cookie holding only the post ID is saved for 1 day.
You can accept or reject non-essential cookies in the cookie banner and change your choice at any time using “Cookie settings” in the website footer. You can also block or delete cookies in your browser settings. Rejecting cookies will not stop you from using the site or sending an enquiry.
Google and Meta process data collected through their tools under their own privacy policies: Google Privacy Policy and Meta Privacy Policy.
5. Who we share your data with
We share personal data only with service providers who help us run the website and our business, and only as much as they need.
- Website hosting and database providers: these store enquiry records, comments and uploaded files.
- Email providers: these deliver enquiry notifications to our team mailbox. Password-reset emails include the requesting IP address.
- Spam detection: comments and form submissions may be checked by an automated spam service such as Akismet, which receives the content, IP address and user agent. See the Automattic Privacy Policy.
- Gravatar: receives a hash of a commenter’s email address, as described in section 2.
- Messaging: WhatsApp (Meta), if you choose to contact us that way.
- Analytics and advertising providers: Google and Meta, only if you have accepted the relevant cookies.
- Professional advisers: accountants, auditors and lawyers, where needed.
- Authorities: government bodies, regulators or courts, where the law requires us to disclose data.
Our service providers act as data processors on our instructions and are bound by written agreements that require them to keep your data secure and confidential, as required by section 42 of the Act. If Creative Bay is ever involved in a merger or sale, your data may be transferred to the new owner under the same protections.
Embedded content. Pages on our site may include embedded videos, maps, social posts or images from other websites such as YouTube, Vimeo, Google Maps or Instagram. Embedded content behaves exactly as if you had visited that website: the provider may collect data about you, set cookies, add further tracking and monitor your interaction with the content, especially if you are logged in to their service. Where possible, we load embeds only after you accept cookies.
6. Transfers outside Kenya
Some of our service providers, including Google and Meta and possibly our hosting and email providers, store or process data on servers outside Kenya.
We transfer personal data outside Kenya only in line with Part VI of the Act: where the recipient provides appropriate safeguards for the security and protection of the data, where the transfer is necessary to respond to your enquiry or perform our contract with you, or with your consent. You can contact us for more information about the safeguards we rely on.
7. How we store and protect your data
Enquiries are stored in our website’s database and uploaded files in a private storage area that is not publicly accessible. Enquiry notifications are sent to our team mailbox.
We use appropriate technical and organisational measures to protect your data, including:
- encrypted connections (HTTPS) across the website;
- access to enquiry data and files limited to staff who need it, protected by strong passwords and, where available, two-factor authentication;
- private file storage with no public links;
- regular software updates and backups.
No system is completely secure. If a personal data breach occurs that is likely to put you at real risk of harm, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it and inform you without undue delay, as required by section 43 of the Act.
8. How long we keep your data
We keep personal data only as long as we need it for the purpose it was collected, as required by section 39 of the Act. Then we delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiries that do not become projects | 24 months after our last contact |
| Client project and contract records | Duration of the relationship plus 7 years |
| Invoices and accounting records | As required by Kenyan tax law (currently at least 5 years) |
| Uploaded files | Deleted with the related enquiry, or at the end of the project plus 12 months |
| Blog comments and their metadata | Kept while the post is published, so follow-up comments can be approved automatically; removed on request |
| Registered user profiles | Until the account is deleted; users can edit or delete their details at any time |
| Server logs | 90 days |
| Analytics data | As set in Google Analytics, currently 14 months |
You can ask us to delete your data sooner at any time, unless we must keep it to meet a legal obligation or to establish or defend a legal claim.
9. Your rights
Under section 26 and related provisions of the Act, you have the right to:
- be informed about how your personal data is used, which this policy does;
- access the personal data we hold about you and get a copy;
- correct data that is inaccurate, out of date or incomplete;
- delete data that is no longer needed or was processed unlawfully;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- restrict our processing in certain circumstances;
- data portability, meaning to receive your data in a structured, commonly used format or have it sent to another controller;
- withdraw consent at any time, without affecting processing that took place before you withdrew.
To exercise any of these rights, email info@creativebay.co.ke with the subject “Data Request”. We may ask you to confirm your identity before acting. We will respond within the timelines set by the Data Protection (General) Regulations, 2021, and we do not charge for reasonable requests.
10. Children, marketing and other websites
Children. Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, contact us and we will delete it.
Marketing. We will only send you newsletters or promotional messages by email, SMS or WhatsApp if you have agreed to receive them or are an existing client. Every message will include a simple way to opt out.
Other websites. Our site may link to other websites, such as our social media pages or client projects. We are not responsible for their privacy practices, so please read their policies.
11. Complaints, changes and contact
Complaints. If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
Changes to this policy. We may update this policy when our practices or the law change. The “Last updated” date at the top shows the latest version. We will highlight significant changes on the website.
Contact us. For questions about this policy or your data:
- Email: info@creativebay.co.ke
- Phone / WhatsApp: +254 181 941 445