Privacy Policy

This policy covers acaciawave.com and the enquiries sent through it. Acaciawave Limited, a company based in Nairobi, Kenya, is the data controller for that information.

Where we handle personal data inside a system we have built for a client, the client is the controller and we act as their processor under the project agreement. This policy does not describe that data — their own privacy notice does.

Only what you type into the enquiry form, and the technical minimum needed to serve the page:

• The enquiry itself — your name, email address, company and message, plus the time it arrived.
• Ordinary request data handled by our host, Cloudflare, when the site is served: IP address, browser user agent, and the page requested. This is what makes the site work and lets it be defended against abuse.

The site loads no analytics, advertising or tracking scripts of any kind. There is no advertising cookie, no pixel, no session recording, no cross-site profile, and no account for you to create.

We do not buy personal data, and we do not enrich what you send us with data from anywhere else.

The site loads its two typefaces, Manrope and Inter, from Google Fonts. Requesting a font file means your browser contacts Google’s servers, and Google receives your IP address and user agent as part of that request.

When you send an enquiry, your browser posts it directly to our customer relationship system at crm.gzzlr.net. That system therefore also receives your IP address and user agent alongside what you wrote. It is contacted only at the moment you press send, never while you are simply reading the site.

Those are the only two third-party hosts this site sends your browser to. We state it plainly because it is the kind of thing a privacy policy usually leaves out. Google’s handling of its request is governed by its own privacy policy.

Nothing. This site sets no cookies and writes nothing to your browser’s local storage. There is no analytics, no advertising and no tracking of any kind.

Until September 2026 there was one item — your choice of light or dark theme, saved under the key aw-theme. The site now has a single presentation, so there is no preference to remember. If you visited before then, clearing your site data removes what is left of it; it never left your browser and was never sent to us.

We use what you send us to reply to your enquiry, to discuss and scope the work, and to provide services if you go ahead. That is the whole purpose.

Under the Kenyan Data Protection Act, 2019, we rely on your consent for the enquiry you choose to send us, on the necessity of processing to take steps at your request before entering a contract, and on our legitimate interest in keeping the site available and secure for the technical request data.

We do not use your information for automated decision-making or profiling.

Your enquiry goes to one place: the customer relationship system we use to track and answer enquiries, at crm.gzzlr.net. We keep no separate copy of it, and the site itself stores nothing.

Your browser sends it there directly, which is why that system sees your IP address and user agent as well as the enquiry.

Cloudflare serves this site from a global network, so the ordinary request data described above may be processed outside Kenya. We use our providers as processors, under their data processing terms.

Nothing is copied to a marketing platform or an advertising system.

An enquiry is kept for as long as it takes to deal with it and any engagement that follows, and then for as long as we are required to keep business records.

If a conversation goes nowhere, the enquiry is deleted once it is clear there is nothing to follow up. You can ask us to delete it sooner.

We do not sell, rent or trade personal information. Ever.

We share it only with the providers we need in order to run the business — hosting, the customer relationship system described above, and email — and only to the extent they need it. They are bound to keep it confidential and to process it on our instructions.

We will disclose information where the law requires it, and we will tell you when we are permitted to.

The site is served over HTTPS, enquiries are transmitted encrypted, and access to stored enquiries is limited to the people who need to answer them.

No system is perfectly secure, and we would rather say so than promise otherwise. If a breach affects your personal data we will act on it and notify you and the Data Commissioner as the law requires.

Under the Data Protection Act, 2019 you have the right to:

• Be told what personal data we hold about you, and get a copy of it.
• Have inaccurate data corrected, and incomplete data completed.
• Have your data deleted where we no longer have a reason to keep it.
• Object to processing, or ask us to restrict it.
• Withdraw consent at any time, without affecting what was done before you withdrew it.

Email acacia@acaciawave.com, or use the contact form. We will respond within the period the Act allows, and there is no charge for a reasonable request.

If you are not satisfied with how we have handled it, you can complain to the Office of the Data Protection Commissioner in Kenya. We would rather you came to us first, but the route is yours to choose.

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

We may update this policy — most often because something in the site itself has changed. The current version is always the one published at this address, and the date at the top says when it last moved.

Where a change materially affects how we handle data you have already sent us, we will contact you rather than rely on you re-reading this page.

Acaciawave Limited, Nairobi, Kenya. For anything in this policy, email acacia@acaciawave.com.