This privacy notice for Cralite Digital ('we', 'us', or 'our') describes how and why we collect, store, use, and share ('process') your information when you use our services ('Services'), such as when you:
Last updated: June 27, 2026
This privacy notice for Cralite Digital ('we', 'us', or 'our') describes how and why we collect, store, use, and share ('process') your information when you use our services ('Services'), such as when you:
Visit our website at https://cralite.com, or any website of ours that links to this privacy notice.
Engage with us in other related ways, including any sales, marketing, or events.
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at hello@cralite.com.
1. What Information Do We Collect?
Personal information you disclose to us
We collect personal information that you voluntarily provide when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. The personal information we collect may include:
Names
Phone numbers
Mailing addresses
Email addresses
Sensitive Information: We do not process sensitive information.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, and location.
Log and Usage Data: Service-related, diagnostic, usage, and performance information our servers automatically collect. This may include your IP address, device information, browser type, activity in the Services, and device event information such as system activity and error reports.
Device Data: Information about your computer, phone, tablet, or other device, including IP address, device identification numbers, browser type, hardware model, Internet service provider, operating system, and system configuration.
Location Data: Information about your device's location, which can be either precise or imprecise. You can opt out by disabling your Location settings on your device, though this may limit certain aspects of the Services.
Cookies and tracking technologies
We use cookies and similar tracking technologies (web beacons, pixels) to collect and store information when you interact with our Services. Types of cookies we use:
Essential cookies: Required for the basic operation of our website.
Analytics cookies: Help us understand how visitors interact with our website (e.g., Google Analytics).
Preference cookies: Allow us to remember choices you have made to provide a more personalised experience.
You can control cookie settings through your browser preferences. Blocking certain cookies may affect the functionality of our Services.
2. Legal Basis for Processing Your Information
If you are located in the European Economic Area (EEA), United Kingdom (UK), or another jurisdiction with similar data protection laws, we rely on the following legal bases to process your personal information:
Consent: Where you have given us clear consent to process your personal information for a specific purpose.
Contractual Necessity: Where processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract.
Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights. Our legitimate interests include improving our Services, maintaining security, and communicating with users.
Legal Obligation: Where we need to process your personal information to comply with a legal obligation.
Vital Interests: Where processing is necessary to protect someone's life.
3. How Do We Process Your Information?
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
To deliver and facilitate delivery of services to you.
To respond to user inquiries and offer support.
To send marketing and promotional communications where you have given consent or where permitted by applicable law. You can opt out at any time.
To improve, personalise, and develop our Services.
To monitor and analyse usage and trends to improve your experience.
To detect, prevent, and address technical issues, fraud, or security breaches.
To comply with legal obligations, including those under the Kenya Data Protection Act, 2019, and the GDPR where applicable.
To save or protect an individual's vital interest, such as to prevent harm.
4. Third-Party Service Providers and Data Processors
We may share your personal information with third-party vendors, service providers, contractors, or agents who perform services on our behalf. We have contracts in place with our data processors designed to safeguard your personal information. Examples of third parties we may use include:
Analytics providers (e.g., Google Analytics) to help us understand website usage.
Email and communication service providers to send transactional and marketing communications.
Cloud hosting and infrastructure providers for data storage and processing.
Payment processors, where applicable, for secure payment handling.
We do not sell your personal information to third parties. We only share your information as described in this notice and where permitted or required by law.
5. When and With Whom Do We Share Your Personal Information?
We may need to share your personal information in the following situations:
Third-Party Service Providers: As described in Section 4 above.
Business Transfers: We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.
Legal Requirements: We may disclose your information where required by law, in response to legal processes, or to protect the rights, safety, or property of Cralite Digital or others.
With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.
6. International Data Transfers
Your information may be transferred to and maintained on computers located outside of your country where data protection laws may differ from those in your jurisdiction.
If you are located in the EEA, UK, or Switzerland, and we transfer your personal data to countries not deemed to provide an adequate level of data protection, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
As a company operating under Kenyan law, we also comply with cross-border data transfer requirements under the Kenya Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021.
7. What Is Our Stance on Third-Party Websites?
The Services may link to third-party websites, online services, or mobile applications and/or contain advertisements from third parties not affiliated with us. We do not make any guarantee regarding any such third parties, and we will not be liable for any loss or damage caused by the use of such third-party websites, services, or applications.
The inclusion of a link towards a third-party website does not imply an endorsement by us. Any data collected by third parties is not covered by this privacy notice. We encourage you to review the privacy policies of any third-party services you visit.
8. How Long Do We Keep Your Information?
We retain personal information only for as long as necessary to fulfil the purposes outlined in this privacy notice, unless a longer retention period is required or permitted by law. Our general retention periods are as follows:
Contact and enquiry data: Retained for up to 24 months from the date of last contact.
Analytics and usage data: Retained for up to 26 months, in line with standard analytics platform defaults.
Marketing communications data: Retained until you unsubscribe or withdraw consent, plus a reasonable period thereafter for compliance records.
Legal and financial records: Retained for the period required by applicable law, typically 7 years under Kenyan tax and accounting regulations.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If deletion is not immediately possible (e.g., data stored in backup archives), we will securely isolate it from further processing until deletion is possible.
9. How Do We Keep Your Information Safe?
We have implemented appropriate and reasonable technical and organisational security measures to protect your personal information. These include:
Encryption of data in transit using industry-standard TLS/SSL protocols.
Access controls limiting data access to authorised personnel only.
Regular security assessments and vulnerability testing.
Data minimisation practices to limit collection to only what is necessary.
Despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals as required by applicable law.
10. Do We Collect Information from Minors?
We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 years of age, or that you are the parent or guardian of a minor and consent to such minor's use of the Services.
If we learn that personal information from users under 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at hello@cralite.com.
11. What Are Your Privacy Rights?
Rights under the Kenya Data Protection Act, 2019
The right to be informed about how your personal data is being used.
The right to access your personal data.
The right to correct inaccurate or incomplete personal data.
The right to object to processing of your personal data.
The right to deletion of your personal data (right to be forgotten).
The right to data portability.
Additional rights under GDPR (EEA, UK, and Switzerland)
The right to restrict the processing of your personal information.
The right not to be subject to automated decision-making, including profiling, that produces legal or similarly significant effects.
The right to lodge a complaint with your Member State data protection authority or the UK Information Commissioner's Office (ICO).
If located in Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC).
To exercise any of these rights, please contact us using the details in Section 15 below. We will respond to your request in accordance with applicable data protection laws, generally within 30 days.
Withdrawing Consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us. This will not affect the lawfulness of processing before the withdrawal.
Opting Out of Marketing: You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in our emails, or by contacting us directly. We may still send you non-marketing service-related communications.
12. Controls for Do-Not-Track Features
Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature or setting you can activate to signal your preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy notice.
13. Kenya Data Protection Act Compliance
Cralite Digital is committed to complying with the Kenya Data Protection Act, 2019 ('KDPA') and its associated regulations, including the Data Protection (General) Regulations, 2021.
As a data controller operating in Kenya, we are registered with the Office of the Data Protection Commissioner (ODPC). If you are a Kenyan resident and believe that we have not handled your personal data in accordance with the KDPA, you have the right to lodge a complaint with the ODPC:
Office of the Data Protection Commissioner (ODPC)
Website: www.odpc.go.ke
Email: info@odpc.go.ke
We will cooperate fully with any investigation by the ODPC in relation to our processing of personal data.
14. Do We Make Updates to This Notice?
We may update this privacy notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this notice and will be effective as soon as it is accessible. If we make material changes, we may notify you either by prominently posting a notice on our website or by sending you a direct notification.
We encourage you to review this privacy notice periodically to stay informed about how we are protecting your information.
15. How Can You Contact Us About This Notice?
If you have questions or comments about this notice, you may contact us at:
Cralite Digital
Email: hello@cralite.com
Website: https://cralite.com
16. How Can You Review, Update, or Delete the Data We Collect from You?
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To submit a data subject access request (DSAR), please email us at hello@cralite.com with the subject line 'Data Subject Access Request' and include the following:
Your full name.
Your email address or other contact details we may hold for you.
A description of the information you wish to access, correct, or delete.
Proof of identity where required to verify your request.
We will respond to verified requests within 30 days in accordance with applicable data protection laws. If we require additional time or information, we will notify you promptly.