Who We Are
Ribyon Studios is a branding and website development studio based in Nairobi, Kenya. We specialise in brand identity, brand strategy, and web design for businesses that want to stand for something. When we refer to "we," "us," or "our" in this policy, we mean Ribyon Studios.
Our registered address is Nairobi, Kenya. You can contact us at [email protected]. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage our services.
Information We Collect
We collect several types of information to provide and improve our services to you:
Personal Data
When you contact us, request a quote, or engage our services, we may collect personally identifiable information such as your name, email address, phone number, billing address, company name, and payment information. This data is necessary to communicate with you, prepare proposals, deliver projects, and issue invoices.
Usage Data
We automatically collect certain information when you visit our website, including your IP address, browser type and version, operating system, referral sources, page views, session duration, and browsing patterns. We use this data to analyse trends, administer the site, and improve user experience.
Cookies and Tracking Technologies
Our website uses cookies, pixels, and similar tracking technologies to enhance functionality and analyse traffic. These may include session cookies, persistent cookies, and third-party analytics cookies. For detailed information about the cookies we use, please refer to our Cookie Policy.
Communications
If you correspond with us via email, contact forms, or messaging platforms, we may retain the content of those communications along with metadata such as timestamps and your contact information.
How We Collect Information
We collect information in the following ways:
Direct Collection. You provide information directly when you fill out our contact form, request a quote, sign up for communications, or engage us for services.
Automated Collection. When you browse our website, we automatically collect usage data and cookie information through analytics tools and server logs.
Third-Party Sources. We may receive information about you from third-party platforms you use to interact with us, such as LinkedIn, Instagram, or payment processors, where you have consented to such sharing or where it is necessary for service delivery.
Legal Basis for Processing (GDPR Article 6)
Under the General Data Protection Regulation (GDPR), we process your personal data on the following lawful bases:
Consent. Where you have given clear consent for us to process your personal data for a specific purpose, such as subscribing to communications or accepting non-essential cookies. You have the right to withdraw consent at any time.
Contractual Necessity. Where processing is necessary for the performance of a contract with you or to take steps at your request before entering a contract. This includes project delivery, invoicing, and client communication.
Legitimate Interests. Where processing is necessary for our legitimate business interests, provided your rights and freedoms do not override those interests. This includes website analytics, direct marketing (where you have an existing business relationship), improving our services, and network security.
Legal Obligation. Where processing is necessary to comply with a legal or regulatory obligation, such as tax reporting, anti-money laundering checks, or responding to lawful requests from authorities.
How We Use Your Information
We use the information we collect for the following purposes:
To respond to your enquiries, provide quotes, and communicate with you about our services. To deliver branding and web development projects, including design, strategy, and technical implementation. To process payments and manage billing and accounting records. To improve our website, services, and user experience through analytics. To send relevant communications about our services, industry insights, and updates (where we have a legitimate interest or your consent). To comply with legal and regulatory obligations. To detect, prevent, and address fraud, security incidents, and technical issues.
Data Sharing and Disclosure
We do not sell your personal data. We may share your information in the following circumstances:
Service Providers. We engage trusted third-party service providers who assist us in operating our business, including payment processors (such as Stripe or PayPal), hosting providers, email communication platforms, analytics services (such as Google Analytics), and project management tools. These providers are contractually bound to process your data only on our instructions and in compliance with applicable data protection laws.
Legal Compliance. We may disclose your information if required to do so by law or in response to valid legal requests from public authorities, such as a court order, government agency, or regulatory body.
Business Transfers. In the event of a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure your data continues to be protected under this policy.
International Data Transfers
As a studio based in Kenya, your personal data may be transferred to, stored in, or processed in countries outside your country of residence, including Kenya and the United Kingdom. When we transfer personal data from the European Economic Area (EEA) or the United Kingdom to countries that have not been deemed adequate by the European Commission or the UK Government, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office. By submitting your personal data, you acknowledge and consent to these transfers where necessary for service delivery.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Client project records, including invoices and contracts, are retained for a minimum of seven years after project completion to comply with tax and legal obligations in Kenya and the UK. Marketing and enquiry correspondence is retained for up to two years following the last interaction, unless you withdraw consent or object to processing. Usage data and analytics records are retained for up to 26 months. When data is no longer required, we securely delete or anonymise it.
Your Rights
We respect your privacy rights under applicable data protection laws, including the GDPR, UK DPA 2018, and CCPA.
Your Rights Under GDPR and UK DPA 2018
If you are resident in the EEA, Switzerland, or the United Kingdom, you have the following rights:
Right of Access. You have the right to request confirmation of whether we process your personal data and, if so, to request a copy of that data along with information about how we process it.
Right to Rectification. You have the right to request correction of inaccurate or incomplete personal data we hold about you.
Right to Erasure (Right to be Forgotten). You have the right to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing.
Right to Restrict Processing. You have the right to request that we restrict processing of your personal data in certain circumstances, such as where you contest its accuracy or where processing is unlawful.
Right to Data Portability. You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.
Right to Object. You have the right to object to processing of your personal data based on legitimate interests or direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
Your Rights Under CCPA
If you are a resident of California, United States, you have the following rights under the California Consumer Privacy Act (CCPA):
Right to Know. You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom it was shared.
Right to Opt-Out. We do not sell personal information as defined under the CCPA. However, you have the right to opt out of the sale of your personal information should our practices change.
Right to Deletion. You have the right to request deletion of personal information we have collected, subject to certain exceptions such as completing transactions, detecting security incidents, or complying with legal obligations.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights, including by denying services, charging different prices, or providing a different level of service.
To exercise any of your rights, please contact us at [email protected]. We will respond to your request within the timeframes prescribed by applicable law (typically 30 days under GDPR and 45 days under CCPA). We may need to verify your identity before processing your request.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies to improve functionality, analyse traffic, and understand how visitors interact with our site. Cookies are small text files stored on your device by your web browser. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired).
The types of cookies we use include: essential cookies required for the website to function properly, analytics cookies that help us understand how visitors use our site (such as Google Analytics), and functionality cookies that remember your preferences. You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For a full description of the cookies we use and their purposes, please refer to our separate Cookie Policy.
Security Measures
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS/SSL protocols, secure server infrastructure with firewalls and access controls, regular security audits and software updates, strict access controls limiting data access to personnel who need it to perform their duties, and secure payment processing through PCI-compliant third-party payment processors. While we strive to protect your data, no method of transmission or storage is completely secure. We cannot guarantee absolute security but will notify you of any data breach that is likely to result in a high risk to your rights and freedoms without undue delay.
Children's Privacy
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that information promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the "Effective Date" at the top of this policy and, where appropriate, notify you by email or through a notice on our website. We encourage you to review this policy periodically. Your continued use of our website or services after changes take effect constitutes your acceptance of the updated policy.
Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: [email protected]
Location: Nairobi, Kenya
If you are resident in the EEA or the United Kingdom and believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local supervisory authority, such as the UK Information Commissioner's Office (ICO) or your national data protection authority.
If you are resident in Kenya, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya.