Privacy Policy

Splashmax Creative Ltd (“Splashmax”, “we”, “our”, or “us”) is a company based in Nairobi, Kenya. This Privacy Policy explains how we handle personal data when you visit splashmaxcreative.com, contact us, request a proposal, book a call, apply for an opportunity, make a payment, or engage our creative and digital services. For these activities, Splashmax is generally the data controller. We may act as a data processor where a client instructs us to handle personal data as part of an agreed project.

1. Personal Data We Collect

We may collect identity and contact details; company and role information; enquiry, project, budget and timeline details; correspondence, approvals and feedback; application and portfolio information; contract, invoice and payment records; and technical information such as IP address, browser, device, referring page and security or server-log data. M-PESA or bank records may include the payer’s name or phone number, transaction reference, account reference, amount and status. We do not ask visitors to disclose an M-PESA PIN or full payment-card credentials.

2. How We Collect Data

We collect data directly from you when you email, call, message, book a meeting, submit or send a project brief, apply for a role, approve work, sign an agreement or make a payment. The website’s enquiry forms currently prepare a message in your email application; Splashmax receives that information only when you send the email. We may also receive limited data from payment providers, scheduling and communication platforms, publicly available business sources, referrals, or a client that is authorised to share it.

3. Why We Use Personal Data

We use personal data to respond to enquiries; assess briefs; prepare quotations and proposals; schedule meetings; enter into and perform contracts; create, review and deliver work; manage client relationships; process and reconcile payments; issue invoices or receipts; maintain project, tax and accounting records; consider applications and collaborators; protect our systems and rights; prevent fraud; comply with law; and improve our services. We send promotional communication only where permitted, and you may opt out at any time.

4. Legal Grounds

Depending on the activity, we process personal data with your consent, to take steps at your request before a contract, to perform a contract, to comply with legal obligations, or for legitimate business interests that do not override your rights—such as responding to business enquiries, securing the website, maintaining records and improving services. You may withdraw consent at any time, without affecting processing already carried out lawfully.

5. Sharing and Service Providers

We do not sell or rent personal data. We may share only what is reasonably necessary with authorised staff and contractors; website hosting, email, cloud storage, scheduling, communications and payment providers; accountants, auditors, insurers, lawyers and other professional advisers; or regulators, courts and public authorities where required. Providers process data under their own terms or our instructions, as applicable. Links and embeds such as Calendly, WhatsApp and social platforms are operated by third parties whose privacy practices also apply when you use them.

6. International Transfers

Some technology providers may process data outside Kenya. Where personal data is transferred internationally, we take reasonable steps to use providers and safeguards permitted by applicable Kenyan data-protection law, or otherwise rely on a lawful basis for the transfer.

7. Retention

We keep personal data only for as long as reasonably necessary for the purpose collected, an active enquiry or engagement, dispute resolution, security, and applicable contractual, tax, accounting or legal obligations. Retention depends on the nature of the record and relationship. When information is no longer required, we delete, anonymise or securely archive it as appropriate.

8. Security

We use reasonable administrative, technical and organisational safeguards designed to protect personal data. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. Please do not send passwords, M-PESA PINs, private keys or other unnecessary sensitive credentials through website enquiries or ordinary email.

9. Your Rights

Subject to applicable law, you may ask to be informed about our use of your data, access data we hold about you, object to processing, correct inaccurate or misleading data, or request deletion of data that should no longer be held. You may also withdraw consent or object to direct marketing. We may need to verify your identity and may retain information where the law or an ongoing legal claim requires it.

10. Cookies, External Links and Children

Our hosting platform may use essential technical storage, security mechanisms or server logs needed to operate the website. Optional third-party embeds may set their own cookies when opened. We do not currently use the public site to knowingly profile visitors for behavioural advertising. External websites are responsible for their own content and privacy practices. Our business services and this website are not directed to children, and we do not knowingly collect children’s personal data without appropriate authority.

11. Changes to This Policy

We may update this Policy when our services, providers or legal obligations change. The effective date above identifies the latest published version. Material changes will be communicated through the website or another appropriate channel.

12. Contact and Complaints

For privacy questions or to exercise a data-protection right, email info@splashmaxcreative.com. You may also write to Splashmax Creative Ltd, P.O. Box 77213–00611, Nairobi, Kenya. If you believe your concern has not been resolved, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya.