Privacy Policy
Last updated: 11 September 2025
Zidi Marketing (“Zidi Marketing”, “we”, “us”, “our”) is a full-service digital marketing agency based in Nairobi, Kenya and part of Zidi Group. We respect your privacy. This Privacy Policy explains what personal data we collect, how we use it, the legal bases we rely on, the choices and rights available to you, and how to contact us.
Who this policy applies to
Website visitors, prospective and current clients, suppliers/partners, job applicants, and other individuals who interact with us online and offline.
Important note
This Policy describes our role as a data controller for our own business operations (e.g., website, CRM, marketing). Where we process personal data on behalf of clients (e.g., running ad campaigns), we act as a data processor and follow the client’s written instructions under our service agreement and data processing addendum.
1) The laws we follow
We process personal data in line with the Kenya Data Protection Act, 2019 (DPA) and related guidance by the Office of the Data Protection Commissioner (ODPC). Where we target or work with individuals in the UK/EU, we also apply principles aligned to the UK/EU GDPR and applicable e-privacy rules for cookies/consent.
Registration: Where required, we register with the ODPC as a Data Controller and/or Data Processor in accordance with ODPC regulations and thresholds (including the direct-marketing category).
2) Data we collect
We collect the following categories of information:
- Identity & contact data: name, company, role, email, phone, country, and any details you share in forms or emails.
- Business & engagement data: project briefs, RFP/RFQ information, contract notes, billing details, and communications history.
- Marketing preferences: your opt-in/opt-out status for email or messaging.
- Technical & usage data: IP address, device/browser type, pages viewed, session duration, referral source, interactions with forms or buttons.
- Cookie/pixel data: via tools such as Google Analytics, Google Ads, Meta Pixel, TikTok Pixel, and LinkedIn Insight Tag.
- Recruitment data: CVs, portfolios, LinkedIn profiles, referees, and interview records if you apply for a role.
We collect data directly from you (forms, calls, emails, meetings), automatically (cookies/pixels), and from trusted third parties (e.g., analytics, ad platforms, lead-gen partners) consistent with this Policy.
3) How we use your data (purposes)
- To provide and improve our services: respond to enquiries, prepare proposals, deliver campaigns, optimise performance, provide support, and manage accounts.
- To operate our website and measure performance: analytics, troubleshooting, security, and product improvements.
- To communicate with you: service updates, invoices, administrative notices, and—where permitted—marketing communications you can opt out of at any time.
- To develop our business: case-study outreach (with consent), client satisfaction, and pipeline forecasting (aggregated or pseudonymised where possible).
- To comply with law & protect rights: record-keeping, audits, preventing fraud or abuse, and responding to lawful requests.
Legal bases (examples): performance of a contract (or steps prior to contract), consent (e.g., certain marketing/cookies), compliance with legal obligations, and our legitimate interests (e.g., running and improving our services, ensuring security, and developing our business) balanced against your rights.
4) Cookies and similar technologies
We use cookies, pixels, and tags to:
- make the site function,
- understand site usage, and
- measure and improve the effectiveness of our advertising.
Where required, we’ll display a cookie banner so you can accept, reject, or manage non-essential cookies. You can also change your browser settings to block cookies. Note that blocking some cookies may affect site functionality.
5) Sharing your data
We do not sell your personal data. We share it only with:
- Service providers / processors under contract (e.g., hosting, CRM, analytics, ad platforms, email/SMS providers, payment and accounting tools).
- Affiliates within Zidi Group where needed to deliver services you request (subject to appropriate safeguards).
- Professional advisors (legal, accounting, insurance) under confidentiality.
- Legal/regulatory authorities if required by law or to protect our rights, users, or the public.
Where we act as a data processor for a client, we may share data with that client and its designated partners strictly under the client’s instructions.
6) International transfers
Because we are a digital agency, service providers and ad/analytics platforms may be located outside Kenya, including the UK/EU and the United States. When we transfer personal data internationally, we implement appropriate safeguards (e.g., standard contractual clauses and technical/organizational controls) to protect your information.
7) Data retention
We keep personal data only as long as necessary for the purposes described above, including to meet legal, tax, and accounting requirements, resolve disputes, and enforce agreements. Typical retention periods are:
- Marketing enquiries: up to 24 months from last meaningful interaction (unless you withdraw consent earlier).
- Client files and invoices: 7 years (or longer if legally required).
- Recruitment data: generally 12 months for unsuccessful applicants unless you ask us to keep it longer or local law requires otherwise.
8) Security
We use administrative, technical, and physical safeguards designed to protect personal data against accidental, unlawful, or unauthorised access, alteration, disclosure, or loss. Examples include role-based access, encryption in transit (HTTPS), strong authentication, least-privilege principles, and staff awareness. No system can be 100% secure, but we continuously improve our controls.
9) Your privacy rights
Subject to applicable law, you may have the right to:
- Access your personal data and request a copy.
- Correct inaccurate or incomplete data.
- Delete/erase your data in certain circumstances.
- Object to or restrict certain processing (e.g., direct marketing).
- Withdraw consent where consent is the legal basis.
- Data portability (where applicable).
Kenya’s DPA recognises data subject rights and sets principles for lawful processing enforced by the ODPC.
How to exercise your rights:
Email contact@zidimarketing.com with the subject line “Privacy Request” and tell us which right you want to exercise. We may ask for information to verify your identity and will respond within the timelines set by applicable law.
If you are in the UK/EU, you may also lodge a complaint with your local supervisory authority. If you are in Kenya and are not satisfied with our response, you may contact the Office of the Data Protection Commissioner (ODPC).
10) Marketing communications
With your consent—or where permitted by law—we may send you updates about services, insights, case studies, and events. You can unsubscribe at any time via the email footer or by writing to contact@zidimarketing.com. We will still send essential service or account notices.
11) Children
Our services are not directed to children under 18, and we do not knowingly collect their personal data.
12) Third-party links
Our website may link to third-party sites (e.g., partner platforms, social channels). Those sites have their own privacy policies. Please review them; we are not responsible for their content or practices.
13) Changes to this Policy
We may update this Policy from time to time. The “Last updated” date at the top reflects the latest version. Significant changes will be notified on this page (and, where appropriate, by email).
14) How to contact us
For questions or requests about this Policy or your personal data:
Zidi Marketing
Email: contact@zidimarketing.com
Phone: +254 726 835 810
Address: Kilimani, Nairobi, Kenya.