Privacy Policy

StarNabula Ventures Ltd ("StarNabula", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect when you visit starnabula.tech, why we collect it, how we use it, and your rights under the Kenya Data Protection Act 2019 (DPA 2019) and applicable international standards.

By using this website or submitting our contact form, you acknowledge that you have read and understood this policy.

1. Who We Are (Data Controller)

StarNabula Ventures Ltd
Westlands, Redhill Road, Nairobi, Kenya
Email: starnabula18@gmail.com
Website: https://starnabula.tech

We are the data controller responsible for personal data collected through this website. For any privacy-related queries or to exercise your rights, contact us at the address above.

2. What Personal Data We Collect

We collect the minimum data necessary to respond to your enquiry. The only personal data we collect is submitted voluntarily through our contact form:

• Full name: to address you personally
• Email address: to send you a reply
• Project type (optional): to route your enquiry to the right team
• Message / project description: to understand your needs

We do not collect payment information, government identification, or any sensitive categories of personal data as defined under the DPA 2019.

We do not use cookies, tracking pixels, analytics scripts (e.g. Google Analytics), or advertising networks. See our Cookie & Storage Policy for details on the limited browser storage we do use.

3. How We Use Your Data

The data you submit through the contact form is used solely to:

• Respond to your enquiry or project request
• Provide you with information about our services
• Follow up on a conversation you initiated

We do not use your data for automated decision-making, profiling, or marketing without your explicit consent.

4. Legal Basis for Processing

Under the Kenya Data Protection Act 2019, we rely on the following legal bases:

• Consent: by ticking the consent checkbox on our contact form and submitting it, you give us your explicit consent to process your data for the purpose stated at that point.
• Legitimate interest: responding to a business enquiry you initiated is a legitimate interest that is not overridden by your privacy rights.

You may withdraw consent at any time by emailing us at starnabula18@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. Data Sharing & Third-Party Processors

We share your contact form data with the following third-party service providers who process it on our behalf under appropriate data processing terms:

• Web3Forms (web3forms.com): our form submission processor. When you submit the contact form, your data is transmitted to Web3Forms' servers and forwarded to our email inbox. Web3Forms stores form submissions for a limited period. Review their privacy policy at web3forms.com.
• GitHub Pages: our website is hosted on GitHub Pages (GitHub, Inc., USA). GitHub may process IP addresses as part of normal server operations. Review GitHub's privacy statement at github.com/privacy.
• Google Fonts: we load fonts from Google's CDN. Google may log your IP address. Review Google's privacy policy at policies.google.com/privacy.
• Cloudflare CDN: JavaScript libraries are loaded from cdnjs.cloudflare.com. Cloudflare may process IP addresses as part of CDN delivery.

We do not sell, rent, or trade your personal data to any third party.

We may disclose your data if required to do so by Kenyan law, court order, or regulatory authority, or to protect the rights and safety of StarNabula and its clients.

6. Data Retention

We retain contact form enquiry data for a maximum of 12 months from the date of your last interaction with us. After this period, data is deleted unless we are legally required to retain it longer, or you have entered into a service agreement with us (in which case contractual records may be kept for up to 7 years as required under Kenyan commercial law).

7. International Data Transfers

Some of our third-party processors (Web3Forms, GitHub, Google, Cloudflare) are based outside Kenya, primarily in the United States. Where data is transferred internationally, we ensure that appropriate safeguards are in place consistent with the requirements of the Kenya DPA 2019 and, where applicable, international data protection standards.

8. Your Rights Under the Kenya DPA 2019

As a data subject, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your personal data where we no longer have a lawful reason to process it.
• Right to restriction: ask us to temporarily stop processing your data in certain circumstances.
• Right to object: object to processing based on legitimate interests.
• Right to data portability: receive your data in a structured, commonly used format.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at starnabula18@gmail.com with the subject line "Data Rights Request". We will respond within 30 days as required by the DPA 2019. We may ask you to verify your identity before fulfilling a request.

If you believe your data rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.

9. Website & Browser Storage

We do not use tracking cookies or analytics. We use browser localStorage (a local, client-side storage mechanism) for the following non-personal purposes only:

• Theme preference: remembers whether you prefer dark or light mode.
• Visit state: remembers if you have visited before to skip the intro animation on return visits.
• UI state: remembers which featured project was last displayed for rotation purposes.
• Form rate-limiting: stores a timestamp to prevent rapid repeated form submissions. No personal data is stored, only a Unix timestamp.

None of these items contain personal data and none are transmitted to any server. You can clear them at any time through your browser settings. See our Cookie & Storage Policy for more detail.

10. Security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption on all data in transit
• HTTP Strict Transport Security (HSTS) headers
• Content Security Policy and other security headers
• Honeypot and rate-limiting on the contact form to prevent automated abuse

While we take reasonable precautions, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of data transmitted to us.

11. Third-Party Links

Our website contains links to third-party websites (client project sites, social media platforms). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before submitting any personal data to them.

12. Children's Privacy

Our services are not directed to persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us immediately and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will be revised accordingly. We encourage you to review this policy periodically. Continued use of our website after any changes constitutes your acceptance of the updated policy.

14. Contact Us

For any questions, concerns, or data rights requests, please contact us: