Privacy Policy

Effective Date: 01st July 2026

Company Name: Sheffield Steel Systems Limited

1. Commitment to Privacy

The Company respects your privacy and is committed to protecting personal information in accordance with the Kenya Data Protection Act, 2019 and applicable regulations.

For purposes of this Privacy Policy:

"Personal Data" shall have the meaning assigned under the Data Protection Act, 2019; and
"Processing" includes collection, recording, organization, storage, adaptation, retrieval, disclosure, transfer, use, deletion or destruction of personal data.

2. Information We Collect

Personal Information - Name, National ID or passport number, Email address, Telephone number, Postal and physical address.
Business Information - Company name, Business registration details, Tax information, Authorized representatives, Procurement contacts.
Service Information - Site addresses, Project specifications, Equipment records, Installation reports, Maintenance records, Warranty records.
Technical Information - IP address, Browser information, Device information, Website usage information.
Monitoring Information - Where applicable: Equipment performance data, Temperature monitoring data, Fault reports, Remote diagnostics information.

3. Purpose of Processing

We process information to provide services, process transactions, manage contracts, deliver products, schedule maintenance, respond to inquiries, administer warranties, improve services, conduct quality assurance, comply with legal obligations and protect our legitimate business interests.

4. Legal Basis for Processing

The Company processes personal data only where it has a lawful basis to do so under applicable data protection laws. The legal basis relied upon will depend on the nature of the personal data being processed and the purpose for which it is processed.

The Company may process personal data on one or more of the following legal bases:

The data subject has provided consent for the processing of his or her personal data for one or more specific purposes;
The processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
The processing is necessary for compliance with a legal or regulatory obligation to which the Company is subject;
The processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, provided that such interests are not overridden by the rights and freedoms of the data subject;
The processing is necessary to protect the vital interests of the data subject or another natural person; or
Any other lawful basis permitted under applicable data protection laws.

Where processing is based on consent, the data subject may withdraw such consent at any time, provided that the withdrawal shall not affect the lawfulness of any processing carried out before such withdrawal.

5. Site Visits and Service Documentation

Our technicians may collect Photographs, Inspection records, Equipment readings and technical reports. Such information is used solely for service delivery, safety, quality control, warranty administration and legal compliance.
The Company will take reasonable steps to avoid collecting unnecessary personal information when capturing photographs during inspections, maintenance activities or project documentation.

6. Sharing of Information

The Company may share information with equipment manufacturers, authorized service partners, installation contractors, payment processors, logistics providers, legal advisers, regulators and competent authorities where necessary for the purposes described in this Policy or where required by law.

7. Cross-Border Transfers

Where personal data is transferred outside Kenya, the Company shall ensure that appropriate safeguards are implemented and that such transfers are carried out in accordance with applicable data protection laws and regulatory requirements.

8. Data Security

The Company implements reasonable technical and organizational measures including:

Access controls
Secure storage systems
Password protection
Staff confidentiality obligations
Data backup procedures
Cybersecurity controls

9. Data Retention

The Company retains personal data for as long as necessary to fulfil the purposes for which it was collected, comply with legal, tax, accounting and regulatory obligations, resolve disputes and enforce contractual rights.

10. Your Rights

Subject to applicable laws, you have the right to:

Access personal data;
Correct inaccurate information;
Request deletion where lawful;
Restrict processing;
Object to processing;
Withdraw consent;
Request data portability;
Lodge complaints with the Office of the Data Protection Commissioner (ODPC).

11. Marketing Communications

The Company may send:

Service updates
Maintenance reminders
Product information
Safety notices
Promotional communications

You may opt out of marketing communications at any time. However, the Company may continue to send communications necessary for the administration of services, warranties, safety notices, contractual obligations or legal compliance.

12. Cookies and Website Technologies

Our website may use Cookies, Analytics tools and Performance monitoring tools. Users may manage cookie preferences through browser settings.

13. Children's Privacy

Our services are not intended for individuals under eighteen (18) years of age and we do not knowingly collect personal information from children.

14. Data Protection Officer & Website Management

For privacy-related inquiries, requests or complaints, please contact:

Data Protection Officer
Email: crm@sheffieldafrica.com
Telephone: +254 713 777 111
Physical Address: Sheffield Africa Headquarters, Off Old Mombasa Road near the Nairobi SGR Terminus

If you are dissatisfied with the Company's handling of your personal data, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) or seek any other remedy available under applicable law.

15. Policy Updates

The Company may update this Policy periodically.
Updated versions shall be published through appropriate communication channels and become effective upon publication.