1. Who we are
Curzey Design Studio Limited ("Curzey", "we", "us" or "our") is an interior design, strategy, design-and-build, fit-out and project-delivery practice based in Kenya. For personal data collected through this website, our public digital tools and our direct business relationships, Curzey acts as the data controller unless we tell you otherwise. In some project arrangements, we may also process personal data on behalf of a client under that client's instructions.
You can contact us about privacy matters at info@curzeystudio.com or through our contact details published on this website.
2. The information we collect
Depending on how you use our services, we may collect information you provide directly, including your name, email address, telephone number, organisation, job title, project location, project type and stage, approximate floor area, budget range, programme or timeline, procurement preference and the project information you type into an enquiry, planning tool or client-facing system.
Our public planning workspace may also store draft project information, brief content, tool inputs, tool results, recommendations, progress and related session information so that the workspace can function and, where available, allow you to resume your work.
Where you engage us for an active project, we may also process project administration information, correspondence, approvals, site records, supplier or consultant information, billing records, invoice and receipt details, payment references and other records reasonably required to deliver or administer the engagement.
For security, continuity and abuse prevention, our systems may process technical information such as browser or device information, a session identifier and hashed network or browser fingerprints. We design these mechanisms to avoid retaining a plain-text IP address in the public workspace where hashing is used.
3. Why we use your information
We use personal data to respond to enquiries, assess prospective projects, prepare or develop a project brief, provide requested planning tools, maintain a public project workspace, arrange consultations, communicate with you about the project you have raised, administer active client engagements, manage approvals and project records, reconcile payments, provide receipts, protect the website and our systems, prevent abuse, maintain operational records, and comply with legal or regulatory duties.
Where you ask us to consider a project or contact you about an enquiry, processing is generally necessary to take steps at your request before entering into a contract and/or for our legitimate interests in responding to prospective clients and operating our business. Where the law requires consent, or where we offer an optional use that is genuinely consent-based, we will ask for it separately.
4. Incomplete enquiries and follow-up
If you expressly choose the “save my progress” option, we may save the incomplete enquiry and use the email address you supplied to send one recovery message intended to help you complete it. This is optional. If you do not opt in, the website should not use the incomplete-enquiry follow-up feature for you.
Incomplete enquiry records are designed to expire after a limited period. The current application is configured to suppress old incomplete records after approximately 30 days and remove their stored raw payload from active use.
5. WhatsApp and other communications
If you communicate with Curzey through WhatsApp, we may receive and process your telephone number, profile information made available through the service, message content, attachments, delivery or read status information and related communication metadata supplied through the WhatsApp Business Platform.
We use this information to respond to you and, where appropriate and permitted, to provide project, service or transaction-related communications. This may include payment acknowledgements, receipt links, project updates or requests for information. We do not use the presence of a telephone number alone as consent to receive WhatsApp communications where a communication preference or other permission is required.
Our use of WhatsApp involves processing by Meta and its service providers under their applicable terms and privacy practices. Information may therefore be processed through systems operated outside Kenya, subject to the international-transfer safeguards described below.
6. Payments and financial information
Where you make or receive a payment connected to Curzey, we may process information necessary to identify, reconcile, record and acknowledge that transaction. This may include the payer or recipient name, amount, payment reference, M-PESA transaction identifier, bank reference, invoice number, receipt number and related project or account information.
Mobile-money operators, banks and other payment providers process payment information under their own legal and privacy obligations. Curzey does not ask you to send passwords, PINs or other payment-authentication credentials through our website, client portal or WhatsApp.
7. Website sessions, local storage and cookies
The public project-planning tools use a strictly functional session mechanism so that the server can associate your browser with the public workspace that belongs to that session. The current session cookie is HTTP-only, uses SameSite=Lax, is marked Secure in production, and is configured with a lifespan of approximately 30 days.
Some planning features may also use your browser's local storage to preserve functional project or tool state. Local storage remains on your device until it is removed by the application, overwritten, or cleared through your browser. These technologies are used for website functionality rather than behavioural advertising.
Curzey uses Google Analytics 4 (GA4) as an optional website analytics service. Google Analytics is loaded only after you choose to allow analytics. When enabled, it helps us understand matters such as website usage, page and content engagement, referral sources and interactions with website features. Analytics is not required for the website to function. You may decline analytics or later change your choice using the Privacy choices control available on the website. Google Analytics may use cookies or similar identifiers when analytics consent is granted.
8. How long we keep information
We keep personal data only for as long as reasonably required for the purpose for which it was collected, for legitimate business records, to establish or defend legal claims, or where law requires a longer period. Public website sessions are currently configured for approximately 30 days. Draft public projects and certain public tool records are generally configured for approximately 30 to 45 days unless they are submitted, converted, refreshed or otherwise become part of an active business record.
If an enquiry becomes a genuine client or project opportunity, relevant information may be transferred into Curzey's internal client and project systems. Those records may be retained for longer periods appropriate to the resulting business relationship, contractual administration, project delivery, finance, audit and legal obligations.
9. Who may receive the information
Personal data may be accessible to authorised Curzey personnel who need it for enquiry handling, project assessment, client administration, design or project delivery. We may also use service providers that support hosting, infrastructure, email delivery, communications, security, data storage, payment processing, professional services or other business operations. Such providers should receive only the information necessary for their role and be subject to appropriate contractual or legal safeguards.
We may disclose information where required by law, a court, a regulator or another lawful authority, or where reasonably necessary to protect Curzey, our clients, our users or the security of our services.
10. International transfers
Some technology, cloud, communications or professional service providers may process information outside Kenya. Where personal data is transferred internationally, Curzey will take reasonable steps to use a transfer mechanism or safeguards permitted by applicable data-protection law and to assess the protection available to the information.
11. Security
We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. The reviewed public workspace includes measures such as server-side session ownership controls, HTTP-only session cookies, production Secure-cookie settings, hashed fingerprints and rate limiting. Internal project and financial systems also use role-based access controls intended to limit sensitive information to personnel with a legitimate business need. No internet service can guarantee absolute security, so we also rely on responsible access controls, monitoring and operational procedures.
12. Your rights
Subject to the Data Protection Act, 2019 and applicable exceptions, you may have rights to be informed about the use of your personal data, access personal data we hold about you, object to certain processing, request correction of inaccurate or misleading information, and request deletion where legally applicable. Other rights may apply depending on the processing and the law that applies to you.
To exercise a privacy right, contact us at info@curzeystudio.com. We may need to verify your identity before acting on a request. If you believe your data-protection rights have been infringed, you may also lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).
13. Visitors outside Kenya
Curzey is established in Kenya and this policy is written primarily for compliance with Kenyan law. If you are in another jurisdiction whose data-protection law applies to our processing — including, where its territorial requirements are met, the EU or UK GDPR — we will respect the additional rights and obligations that apply to that processing. Nothing in this policy is intended to claim that every foreign privacy law applies to every visit to this website.
14. Children
This website and its project-planning services are intended for adults acting for themselves, their organisations or a project. We do not knowingly design these services to collect personal data from children. If information relating to a minor is legitimately required for a project or service, we will handle it in accordance with applicable law and the relevant authority or consent requirements.
15. Changes to this policy
We may update this Privacy Policy when our website, services, technology or legal obligations change. The effective date at the top of the page will show when the current version took effect. Material changes may also be highlighted through the website where appropriate.