Privacy, ExplainedSimply and Clearly

01About This Privacy Policy

This Privacy Policy explains how Kenstar Plastic Industries Limited, operating under the Cool Baby brand ("Cool Baby", "we", "us", or "our"), collects, uses, stores, shares, and protects personal data received through the Cool Baby website.

This policy is prepared in full compliance with the Kenya Data Protection Act, 2019 (DPA 2019), the Data Protection (General) Regulations 2021, and applicable international data protection standards.

This policy applies whenever you access or browse the website, complete the Contact Us form, communicate with our team via email or telephone, or interact with website features such as map services.

By accessing the website or submitting personal data to us, you acknowledge that you have read and understood this Privacy Policy.

02Who We Are & Data Controller Details

Cool Baby is a proprietary manufacturing and retail brand of Kenstar Plastic Industries Limited, a company incorporated in the Republic of Kenya.

Under Section 2 of the Data Protection Act 2019, Kenstar Plastic Industries Limited acts as the Data Controller responsible for determining the purposes and means of processing personal data collected through this website.

Data Protection Officer Email: dpo@coolbaby.co.ke / info@coolbaby.co.ke

Registration Status: Kenstar Plastic Industries Limited complies with the Data Controller and Data Processor registration requirements established by the Office of the Data Protection Commissioner (ODPC) of Kenya.

03Information We Collect

We do not require website visitors to create an account, log in, or disclose personal identity information merely to browse the Cool Baby website or view our product catalog.

We collect personal data only when voluntarily provided by you through our Contact Us form or direct communications. Depending on your submission, this data includes:

• Your full name
• Your email address
• Your telephone number (optional)
• Your selected enquiry category (Product Information, Stockists, Wholesale & Distribution, Partnerships, Support, General)
• Selected product name or category of interest (optional)
• Subject title of your enquiry
• The written message content of your enquiry
• Explicit privacy consent confirmation
• Any additional details voluntarily disclosed within your correspondence

Special Categories of Data: Please do not submit sensitive personal data (such as health status, biometric data, financial details, or national identity numbers) or details concerning minors unless legally necessary and authorized.

04How We Collect Information

We collect information directly from you when you:

• Complete and submit the digital Contact Us form on our website
• Directly email our customer service, wholesale, or management teams
• Call our telephone lines for product, stockist, or commercial enquiries
• Request technical product specifications, retail stockist locations, or distribution terms
• Respond to follow-up communications initiated by our representative

Automatically Collected Technical Information: When you visit the website, our server and security infrastructure automatically process limited technical metadata required for internet communication. This includes your IP address, browser user-agent string, device operating system, access timestamp, requested URL, and firewall security flags.

We do not cross-reference server logs with personal submission details to construct individual behavioral profiles.

05How We Use Your Information

We process personal data strictly for legitimate, declared, and specific operational purposes, including:

• Evaluating and responding to your direct customer or commercial enquiry
• Providing guidance regarding Cool Baby product specifications, feeding bottle care, and retail stockist availability
• Processing wholesale, retail distribution, and brand partnership proposals
• Maintaining necessary operational records and correspondence history
• Protecting our website, backend infrastructure, and network against malicious attacks, spam, or unauthorized access
• Fulfilling statutory obligations under Kenyan law, including corporate record-keeping and tax mandates
• Establishing, exercising, or defending legal claims where required by competent judicial bodies

Direct Marketing Exemption: We do not subscribe your contact details to general marketing newsletters or send promotional email blasts unless you provide separate, unambiguous consent.

06Our Legal Basis Under Kenya DPA 2019

In accordance with Section 30 of the Kenya Data Protection Act 2019, we process personal data only under valid legal bases:

• Consent (Section 30(1)(a)): You have given clear, explicit consent by checking the privacy agreement box before submitting the contact form.
• Pre-Contractual Steps (Section 30(1)(b)): Processing is necessary to evaluate requested commercial arrangements, wholesale distribution inquiries, or retail partnerships prior to formal agreement.
• Legitimate Interests (Section 30(1)(g)): Processing is necessary for our legitimate operational interests in maintaining customer care, ensuring website security, and defending operational integrity.
• Legal Obligation (Section 30(1)(c)): Processing is required to comply with statutory law, regulatory directives, or law enforcement mandates in Kenya.
• Legal Claims (Section 30(1)(f)): Processing is required for the establishment, exercise, or defense of a legal claim.

You maintain the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

07Cookies and Technical Storage

The Cool Baby website is engineered to operate without invasive advertising tracking cookies or third-party behavioral profiling scripts.

Essential Functionality: We utilize essential browser session storage and security tokens required strictly for navigation, form anti-spam validation (honeypot safeguards), and responsive user interface state.

Server Log Records: Our web server infrastructure retains short-term access and error logs (containing IP address, browser type, timestamp, and requested page) solely for fault diagnosis, performance monitoring, and DDOS mitigation.

Analytics & Third-Party Trackers: At present, our website does not embed Google Analytics, Meta (Facebook) Pixel, TikTok Pixel, Hotjar, or session playback utilities. Should non-essential analytics or tracking technologies be introduced in the future, this policy and an explicit cookie consent banner will be implemented prior to activation.

08Maps and Third-Party Services

To protect visitor privacy, our interactive Google Maps integration on the Contact Us page does not load third-party scripts or transfer IP data until you explicitly click "LOAD MAP".

Upon activating the interactive map or navigating to external links (such as social media profiles or physical direction maps), your browser connects directly to third-party servers governed by their respective privacy terms.

We recommend reviewing the privacy statements of third-party platforms before interacting with external links.

09Data Security & Safeguards

We implement robust technical and organizational security measures pursuant to Section 41 of the Data Protection Act 2019 to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure.

Our security architecture includes:

• TLS/SSL end-to-end encryption for all web transmission (HTTPS protocol)
• Strict role-based administrative access control restricted to authorized personnel
• Secure firewalls, network monitoring, and vulnerability patching
• Encrypted cloud email infrastructure with multi-factor authentication

While we apply industry-standard protections, no electronic transmission over the internet can be guaranteed as 100% secure. We encourage users to avoid transmitting sensitive confidential credentials over unencrypted channels.

10Data Breach Notification Protocol

Pursuant to Section 43 of the Data Protection Act 2019, Kenstar Plastic Industries Limited maintains a documented Incident Response Framework.

In the event of a security incident resulting in unauthorized access, breach, or destruction of personal data that presents a real risk of harm to data subjects:

• We will notify the Office of the Data Protection Commissioner (ODPC) of Kenya within 72 hours of becoming aware of the breach.
• We will notify affected data subjects without undue delay, outlining the nature of the breach, potential consequences, and recommended protective measures.

11Data Retention & Disposal Schedule

In accordance with Section 39 of the Data Protection Act 2019, personal data is retained only for as long as necessary to fulfill the purpose for which it was collected.

Standard Retention Schedule:

• Contact Form Enquiries & Correspondence: Retained for a maximum of twelve (12) months following complete resolution of the enquiry, unless ongoing commercial relations require continued retention.
• Wholesale & Commercial Partner Records: Retained for seven (7) years in compliance with Kenya Companies Act and Tax Law record-keeping requirements.
• Server Security Logs: Retained for ninety (90) days for operational audit and security analysis before automatic deletion.

Upon expiration of the retention period, personal data is permanently deleted, overwritten, or rendered irreversibly anonymized.

12When We Share Information

Kenstar Plastic Industries Limited does not sell, trade, rent, or lease personal data to third parties under any circumstances.

We disclose personal data only on a strict need-to-know basis to:

• Authorized Internal Employees: Personnel within customer service, commercial sales, or executive management assigned to handle your request.
• Vetted Service Providers: Trusted infrastructure providers (web hosting, SMTP email delivery, and IT security partners) bound by confidentiality and data protection contracts.
• Law Enforcement & Statutory Bodies: Government, judicial, or regulatory authorities in Kenya where mandated by statutory subpoena, court order, or legal obligation.
• Corporate Successors: A legal successor entity in the event of a merger, acquisition, re-organization, or asset sale involving Kenstar Plastic Industries Limited.

13International Data Transfers & Safeguards

Certain digital infrastructure, such as cloud web hosting, content delivery networks (CDNs), and enterprise email platforms, may process or store data on secure servers situated outside the Republic of Kenya.

Pursuant to Sections 48, 49, and 50 of the Data Protection Act 2019, any cross-border data transfer is executed strictly under authorized legal mechanisms:

• Adequacy Decisions: Transfer to jurisdictions with equivalent or adequate data protection laws as determined by the Data Protection Commissioner.
• Contractual Safeguards: Transfer bound by Standard Contractual Clauses (SCCs) ensuring data protection standards equivalent to Kenyan law.
• Explicit Consent: Where necessary, based on your voluntary submission of communications destined for global cloud communication channels.

14Children’s Data Protection

Although Cool Baby manufactures products for infants and young children, the Cool Baby website is targeted strictly at adult parents, guardians, retailers, and commercial partners.

Pursuant to Section 33 of the Data Protection Act 2019, we do not intentionally process or collect personal data directly from children under the age of eighteen (18) without verifiable parental or guardian consent.

If a parent or guardian discovers that a child has submitted personal data through our website without consent, please notify us immediately at info@coolbaby.co.ke. We will promptly investigate and permanently delete such records.

15Your Statutory Rights Under Kenya DPA

Under Section 26 of the Kenya Data Protection Act 2019, you hold comprehensive rights regarding your personal data:

• Right to be Informed: The right to receive clear, transparent details regarding how your data is collected and processed.
• Right of Access: The right to request confirmation of whether we hold your personal data and obtain a copy of such data.
• Right to Rectification: The right to request immediate correction of inaccurate, incomplete, or outdated personal data.
• Right to Erasure / Deletion: The right to request deletion of personal data where retention is no longer authorized or necessary.
• Right to Object to Processing: The right to object at any time to data processing based on legitimate interests or direct marketing.
• Right to Restriction of Processing: The right to request that we temporarily suspend or limit processing under specific legal conditions.
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
• Automated Decision-Making: The right not to be subject to a decision based solely on automated processing or profiling.

16How to Exercise Your Rights

To exercise any of your data protection rights, submit a written request to our Data Protection Officer at: info@coolbaby.co.ke.

Verification Procedure: To protect customer privacy and prevent unauthorized data disclosure, we may request reasonable proof of identity prior to processing your request.

Response Timeline: We will evaluate and fulfill your request free of charge within twenty-one (21) calendar days as required by Kenyan statutory regulations.

17Complaints & Regulatory Escalation

If you have concerns regarding our processing of your personal data, we encourage you to contact us first so we can address the matter promptly: info@coolbaby.co.ke.

Regulatory Recourse: You retain the legal right under Kenya DPA 2019 to lodge a formal complaint directly with the Office of the Data Protection Commissioner (ODPC) of Kenya.

Office of the Data Protection Commissioner Kenya: Visit the official ODPC Portal.

18Changes to This Policy

We reserve the right to revise this Privacy Policy periodically to reflect updates in our website technology, internal operations, or statutory requirements.

Any updates will be published directly on this page with a revised "Last updated" date at the top of the policy.

Material changes affecting how personal data is processed will be highlighted with prominent notice on our website prior to taking effect.

19Contact Us