Privacy Notice
Last updated: 4 October 2026
1. Who we are
Nairoreel Productions ("Nairoreel", "we"), Nairobi, Kenya, is the data controller for personal data described here. Contact for privacy matters: privacy@nairoreelproductions.com. Our annual turnover and staff headcount are both below the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021 exemption thresholds, so we are not currently required to register with the Office of the Data Protection Commissioner. This exemption is from registration only — it does not exempt us from the data-protection duties described in this notice.
2. What we collect and why
| Data | When | Why | Kept |
|---|---|---|---|
| Name, email, phone, company, role, account location | Onboarding, account creation, profile edits | Perform our contract with you; set up your portal access | Life of the account + 2 years |
| Password (stored only as a one-way hash), login history (time, IP address, browser/user-agent, success/failure) | Every login attempt | Security and fraud prevention; legal duty to protect data | Failed-login counters ~1 hour; security/audit log 2 years |
| Project content: comments, approvals, revision requests, meeting requests, agenda text | Using the portal | Perform our contract; keep evidence of what was approved | Project life + 90 days after final delivery, then deleted or archived |
| Invoices, payment preferences, billing contacts | Billing | Contract and legal/tax record-keeping | As tax law requires (commonly 5+ years) |
| Audit trail of actions in the portal (who did what, when, from what address) — field names and status only, never your comment text or passwords | Every write action | Security, accountability, dispute evidence | 2 years |
| Booking and meeting details, calendar invites | Booking | Contract | Project life + 1 year |
| Contact-form and enquiry data | Website forms | Respond to you; steps before a contract | 12 months after last contact |
| Footage, images, voices and likenesses of people supplied by clients | Client uploads | We process it for the client (see Terms) | Per client instruction; deleted 90 days after final delivery |
| Site analytics (Google Analytics on the public website) | Browsing | Legitimate interest / consent where required | Google's retention settings |
We do not sell personal data. We do not use it for automated decisions with legal effect. Marketing messages are sent only with your express consent, and you can withdraw it at any time.
3. Who receives it
- Shujaa Host and its infrastructure provider (Contabo GmbH) — hosts the portal and database.
- Google — Drive (invoice PDFs), Calendar/Meet (meetings), reCAPTCHA (bot protection), Analytics (public site).
- Cloudflare (R2 storage) — stores and delivers project media.
- Our team and contractors who need access to do the work, under confidentiality duties.
- Authorities, courts, or professional advisers when the law requires or to defend legal claims.
4. Transfers outside Kenya
Our hosting, Google and Cloudflare services may process data outside Kenya. We rely on our providers' own data-processing terms and take reasonable steps to protect data transferred to them. A record of transfers is kept, and you can ask us which safeguard applies to your data.
5. Security
We use access controls, hashed passwords, login rate-limiting and lockout, an audit trail, and signed time-limited links for media. Project media stored with our storage provider (Cloudflare R2) is encrypted at rest (AES-256) and transferred only over TLS-encrypted connections — both are that provider's standard, always-on behaviour. No system is perfectly secure; we do not promise otherwise.
6. Your rights and how fast we respond
You may ask to: access your data (within 7 days), correct it, object to or restrict processing, or have it erased (within 14 days), or receive a portable copy (within 30 days). Write to the privacy contact above; we may ask for proof of identity. We may keep data we are legally required to keep (for example tax records) and will tell you what and why. You can complain to the Office of the Data Protection Commissioner (Kenya) — www.odpc.go.ke, info@odpc.go.ke.
7. If something goes wrong
If a breach is likely to harm you we will notify the Data Commissioner within the legal time limit and tell you directly.
8. Children
The portal is for business users. We do not knowingly collect children's data except where a client's footage includes minors, in which case the client must hold the guardian's consent (see Terms).
9. Changes
We will post updated versions here with the date. For material changes affecting existing clients we will email the account's primary contact.