Sate Medali Privacy Policy
Effective date: October 2026
1 Who we are and what this policy covers
Sate Medali Limited (“we”, “us” or “our”) is based in Kenya. This policy explains how we handle personal information when you use www.satemedali.com, contact us, represent a client or supplier, or participate in our consultancy, training, surveys, assessments and related programmes, where offered.
Contact: enquiries@satemedali.com | +254 723 595825 | P.O. Box 75805–00200, Nairobi, Kenya. Please mark privacy correspondence “Privacy request”.
We determine how information is used for our own enquiries and business administration. For commissioned work, our role may instead be to process information on the client’s documented instructions. The notice for that engagement identifies the responsible organisation, our role and the contact for exercising your rights. Separate staff and recruitment notices apply where relevant.
2 Information we collect and its sources
Depending on your interaction, we collect contact details, your organisation and role, enquiry messages, correspondence, attendance and programme administration details, contractual and payment records, and feedback. Website systems may collect IP addresses, browser and device details, security logs and cookie information.
For agreed assessments or surveys, information may include responses, interview notes and relevant workplace information. We obtain information from you and, where lawful and necessary, from your employer, commissioning organisation, authorised representative or service partner. The engagement notice explains the actual sources and categories.
Please do not submit medical records, detailed health information or confidential information about other people through the general website form. Contact us first to establish an appropriate route. Required fields and the consequences of not providing information will be explained at collection.
3 Why we use information
We use necessary information to answer enquiries, arrange and deliver agreed services, administer programmes, prepare findings, manage client relationships, maintain records, protect our systems and meet legal obligations.
The lawful basis depends on the activity. It may be steps requested before entering a contract, performance of a contract with you, a legal obligation, consent, or a legitimate interest assessed against your rights. A contract with your employer does not automatically provide a contractual basis for processing your personal information. Each programme notice identifies the applicable basis.
Where we rely on consent, we explain the specific purpose and how to withdraw it. Withdrawal does not invalidate earlier lawful processing. Optional publicity or marketing consent is separate from service participation. This policy itself is not a request for blanket consent.
4 Sensitive information and children
Where an agreed service requires sensitive information, we collect only what is necessary and establish the additional legal conditions and safeguards before collection. Health information is handled only where the applicable legal requirements, including those governing authorised responsibility and confidentiality, are met.
Where programmes involve children under 18, we provide an age-appropriate notice, use appropriate age and parent or guardian verification, and obtain parental or guardian consent where required by law. Processing must protect the child’s rights and best interests. School or employer approval alone does not replace required individual or parental safeguards.
5 Confidentiality and reports to clients
Before participation, we explain collection, access, reporting and confidentiality limits. We report collective findings without identifying participants, unless disclosure is authorised or required by law. Any exceptions are explained before participation.
Removing names may not prevent identification through small teams, job roles or quotations. Anonymous information must not reasonably identify anyone. Coded information that can be linked to a person remains personal information.
6 Access and sharing
Access is limited to authorised personnel and providers who need information for the stated purpose, including facilitators, advisers, technology providers and service partners. Independent practitioners may have separate privacy responsibilities.
We may disclose necessary information where legally required, to establish or defend legal claims, or where a lawful safeguarding obligation applies. A client’s request alone does not authorise unrestricted disclosure of participant information.
7 Overseas processing
Some providers may store or access information outside Kenya. Where this occurs, we establish the applicable lawful transfer conditions and safeguards. Additional requirements apply to sensitive information. You may contact us for information about the recipients, destinations and safeguards relevant to your information.
8 Cookies marketing and publicity
Our website may use cookies and similar technologies to support essential functions and security. Where optional analytics or marketing technologies are used, we explain their purposes and provide applicable choices before they are enabled. You may also block or remove cookies through your browser settings, although some website functions may be affected. Contact us for information about the technologies used on the website.
Where we send promotional communications, we obtain consent where required and provide an easy way to unsubscribe. Enquiring about a service does not automatically subscribe you to marketing. Identifiable testimonials, photographs or recordings require a defined lawful basis and appropriate permission for their intended use.
9 Retention security and incidents
We retain personal information only for as long as necessary for its stated purpose, including applicable legal recordkeeping requirements and the handling of claims. We then securely delete or anonymise it. Retention depends on the nature of the record: enquiries are kept while needed to respond and manage relevant follow-up; contractual and financial records for applicable statutory and claims periods; and participant records and survey responses for the agreed programme, reporting and follow-up purposes. Retention arrangements for each programme are explained before collection. Records subject to a legal hold are retained until that need ends. Backup copies are removed through the applicable backup retention cycle. You may request details of the retention criteria relevant to your information.
We apply appropriate organisational and technical safeguards for the information handled. No system is entirely risk-free. Where a breach occurs, we assess it and make required notifications to the regulator and affected individuals within applicable legal deadlines.
10 Automated decisions
Where an assessment involves profiling or automated processing, the relevant notice explains its purpose and use. Where applicable, you may request human intervention, express your views and challenge a decision based solely on automated processing that has legal or similarly significant effects. Contact us to exercise these rights.
11 Your rights and complaints
Subject to applicable conditions, you may request information about how your data is used, access to your data, correction, erasure, restriction, portability, or object to processing. You may withdraw consent where processing relies on it and object to direct marketing. Rights concerning solely automated decisions apply where relevant.
Contact enquiries@satemedali.com to make a request. We may need proportionate information to verify your identity or an authorised representative’s authority. We respond within the applicable statutory period and explain any lawful limitation. Where we act for another controller, we identify or liaise with that organisation as appropriate.
You may also complain directly to Kenya’s Office of the Data Protection Commissioner at www.odpc.go.ke. You do not have to complete our internal process before exercising that right.
12 Programme notices and policy changes
Before a specific survey, assessment or programme begins, we provide a notice explaining its purposes, information collected, lawful basis, recipients, retention, participation choices and confidentiality limits. Such notices supplement this policy and cannot remove your statutory rights.
We update this policy when practices or legal requirements change and show the effective date above. Where required, we provide further notice or obtain fresh consent before using information for a new purpose.