Privacy Policy

01 Who we are

This website is operated by Rickel Industries (“Rickel Industries”, “we”, “us”, or “our”), an independent creative business providing motion design, animation, visual identity, creative direction, and related services. For personal data handled through this website, Rickel Industries determines why and how that data is used and acts as the data controller where applicable.

02 Scope of this Policy

This Policy applies to the public portfolio, project-inquiry form, private administrative area, and related communications. It does not govern a third-party website or service linked from the portfolio. Those providers publish and control their own privacy practices.

A signed client agreement may contain additional privacy, confidentiality, or data-processing terms for a commissioned project. Where those terms conflict with this Policy, the signed agreement controls for that engagement.

03 Information we collect

Depending on how you use the Website, we may handle:

• Identity and contact details: your name, email address, company, and professional role.
• Project information: the requested service, estimated budget, preferred timeline, project description, referral source, and anything included in an attached PDF or image brief.
• Inquiry administration: your consent record, pipeline status, priority, estimated project value, follow-up dates, assigned administrator, contact timestamps, activity history, and private notes added by an authorized studio administrator while reviewing or responding to the inquiry.
• Security information: pseudonymous rate-limit identifiers derived from the submitted email address and the IP address supplied by the deployment proxy. The original values are converted into keyed cryptographic hashes for this check.
• Technical information: hosting and security providers may process request timestamps, IP addresses, browser or device information, requested pages, and diagnostic events needed to deliver and protect the Website.
• Administrator information: authorized studio users’ account identifiers, email addresses, authentication sessions, and locally saved editor drafts.

Please do not include passwords, payment-card details, government identifiers, health information, or other highly sensitive personal data in a project brief.

04 How we collect information

Most information comes directly from you when you submit a form, attach a brief, email us, or continue a project conversation. We also receive limited technical and security information automatically when a browser requests the Website.

If someone submits an inquiry on behalf of a company or another person, they must be authorized to provide the relevant information and should direct affected individuals to this Policy.

05 How we use information

We use personal information to:

• review, qualify, and respond to project inquiries;
• prepare proposals, estimates, schedules, and potential client engagements;
• manage follow-up communication and inquiry status;
• receive and securely retrieve an attached creative brief;
• authenticate authorized administrators and operate the private content-management area;
• prevent spam, repeated submissions, fraud, and unauthorized access;
• diagnose failures, maintain availability, and improve the Website; and
• comply with law and establish, exercise, or defend legal claims.

The inquiry rate limit automatically accepts or temporarily refuses repeated submissions. It does not profile visitors or make a decision with legal or similarly significant effects.

06 Legal bases for processing

Depending on the context and applicable law, processing is based on one or more of the following grounds:

• Your consent, including the consent given when sending a project inquiry. You may withdraw consent for future processing, but this does not invalidate processing already completed lawfully.
• Steps taken at your request before a contract,such as reviewing a brief or preparing a proposal.
• Legitimate business interests, such as securing the Website, preventing abuse, maintaining business records, and responding to professional correspondence, where those interests are not overridden by your rights.
• Legal obligations and claims, where information must be retained, disclosed, or used to comply with law or protect legal rights.

07 Storage and sharing

Inquiry records, statuses, and private notes are stored in a Supabase-hosted PostgreSQL database. Supabase also provides authentication for authorized studio administrators. Database access is restricted using server-side credentials, authenticated sessions, role checks, and row-level security policies.

Attached briefs are stored as private objects in Cloudflare R2. The Website uses short-lived signed links when an authorized administrator needs to retrieve a private file. Public portfolio media may use the same storage provider but is kept separate from inquiry briefs.

Information may be shared only as reasonably necessary with:

• authorized Rickel Industries administrators;
• Supabase, Cloudflare, and the Website’s deployment or hosting provider as technical processors;
• Resend, when inbox notifications are configured, which receives the inquiry's contact details, project information, message, and an indication of whether a brief was attached. The private brief file itself is not included in the notification;
• professional advisers, insurers, auditors, or contractors bound by appropriate duties; and
• regulators, courts, law enforcement, or another party when disclosure is legally required or necessary to protect rights and safety.

Rickel Industries does not sell or rent personal information and does not disclose inquiry details to data brokers or unrelated advertisers.

08 International transfers

Rickel Industries is based in Kenya, while infrastructure providers may store or process information in other countries. A Supabase project stores its primary data in its configured project region. Cloudflare determines R2 object location from the bucket’s configured location or jurisdiction.

Where personal data is transferred outside Kenya, we will use a lawful transfer ground and appropriate safeguards required by the Kenya Data Protection Act, taking account of the destination, provider commitments, security controls, and the nature of the information.

09 Cookies and browser storage

Public visitors do not need an account. The Website stores two small preferences in the browser’s local storage: the selected Normal or Ultra Dark theme and the selected homepage hero layout. These preferences remain on that browser until changed or cleared and are not submitted with a project inquiry.

Essential Supabase authentication cookies support the private administrator area. Authorized administrators may also save an unfinished project draft in their own browser’s local storage. Blocking essential authentication storage can prevent the private studio from working correctly.

The Website may use first-party, cookieless analytics to understand page and project views, campaign parameters, broad device and viewport categories, calls to action, showreel milestones, and the journey to a submitted inquiry. A random identifier is kept only in the current browser tab session; it is not a persistent advertising identifier. Raw IP addresses are not stored in analytics reports. Do Not Track and Global Privacy Control signals are respected. Analytics records are retained for no more than 13 months. No third-party advertising tracker is loaded by this system.

10 How long we keep information

Pseudonymous email and IP rate-limit identifiers expire after one hour and are removed during subsequent rate-limit checks. Inquiry records and attached briefs are kept while an inquiry is being assessed and during follow-up. Inquiries that do not become active client engagements should ordinarily be reviewed for deletion or anonymization within 24 months of the last meaningful contact. Spam and clearly irrelevant submissions should ordinarily be removed within 12 months unless limited evidence is needed to investigate repeated abuse. If an engagement begins, relevant information may become part of the client record and be retained for contract, accounting, tax, insurance, and legal-claim requirements.

Retention may be extended when required by law, when a dispute is active, or when deletion would affect another person’s rights. At the end of the applicable period, information should be deleted, anonymized, or securely isolated from ordinary use. Backup copies may remain for a limited recovery cycle before being overwritten. Authorized administrators can archive an inquiry, permanently delete it, or anonymize its identifying details while retaining a minimal non-identifying activity record.

11 How we protect information

We use proportionate technical and organizational safeguards, including encrypted network connections, private object storage, short-lived download links, server-side secrets, file type and size validation, origin checks, rate limiting, authenticated administrator sessions, role-based access, and database row-level security.

No internet service can guarantee absolute security. If a breach creates a legally reportable risk, Rickel Industries will assess it and notify the Office of the Data Protection Commissioner and affected individuals when required by applicable law.

12 Your rights and choices

Subject to applicable law and relevant exceptions, you may ask to be informed about processing, access personal data held about you, object to processing, correct inaccurate or misleading data, request deletion, withdraw consent, or receive portable data in a structured commonly used format.

Send a request using the contact details below and identify the inquiry or email address concerned. We may ask for proportionate proof of identity before disclosing or changing information. We will respond within the period required by applicable law and explain if a request cannot be fulfilled in full.

13 Children’s privacy

The Website and its project-inquiry service are intended for businesses and people able to enter professional engagements. They are not directed to children. If you believe a child has submitted personal information without appropriate authorization, contact us so the information can be reviewed and deleted where required.

14 Changes to this Policy

We may update this Policy when the Website, service providers, legal requirements, or data practices change. The revised date will appear at the top. Material changes will be communicated in an appropriate way when required by law.

15 Contact and complaints

Questions, requests, or privacy concerns can be sent to the contact form. Please write “Privacy request” in the subject or opening line so it can be routed appropriately.

If your concern is not resolved, you may contact or file a complaint with Kenya’s Office of the Data Protection Commissioner.