Privacy Policy

ITEC Engineering Ltd (“ITEC”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how ITEC collects, uses, stores, protects and may disclose personal data when you visit or interact with our website, www.iteceng.org, or otherwise provide personal information to us through the website.

This Privacy Policy is intended to comply with the Data Protection Act, 2019 of Kenya, the Data Protection (General) Regulations, 2021, and other applicable data protection requirements. The Office of the Data Protection Commissioner (ODPC) is responsible for regulating the processing of personal data in Kenya and protecting the rights of data subjects.

1. Who We Are

ITEC Engineering Ltd is a Kenyan engineering consultancy providing professional engineering and infrastructure consultancy services.

For purposes of applicable data protection legislation, ITEC may act as a data controller in respect of personal data that we collect and determine the purposes and means of processing.

Our website address is:https://www.iteceng.org/

For privacy-related enquiries, you may contact us using the contact details provided on our website or by emailing info@itecengineering.co.ke.

2. Personal Data We May Collect

Depending on how you interact with our website and services, we may collect personal information such as:

  • Name and contact details;
  • Email address and telephone number;
  • Organisation, company or job title;
  • Information provided through contact, enquiry or other website forms;
  • Information contained in documents or attachments voluntarily submitted to us, including CVs and professional information where applicable;
  • Information provided when applying for employment or expressing interest in working with ITEC;
  • Website usage and technical information, including IP address, browser type, device information and information about how you interact with our website;
  • Information contained in communications you send to us; and
  • Any other information that you voluntarily provide to us.

We will seek to collect only personal data that is adequate, relevant and limited to what is necessary for the purpose for which it is processed.

3. How We Collect Personal Data

We may collect personal data:

  • Directly from you when you complete a form or contact us;
  • When you submit an enquiry or request information;
  • When you submit a CV, application or other document to us;
  • Through your use of our website;
  • Through cookies and similar technologies, where applicable; and
  • From other lawful sources where permitted by applicable law.

Where we collect personal data directly from you, we will provide appropriate information about how and why the data will be used.

4. Purposes for Which We Use Personal Data

We may process personal data for legitimate and lawful purposes, including:

  • Responding to enquiries and requests;
  • Communicating with clients, prospective clients, consultants, suppliers and other stakeholders;
  • Providing information about our services;
  • Managing business and professional relationships;
  • Considering employment and consultancy applications;
  • Managing and improving our website and digital services;
  • Maintaining website security and preventing fraud, abuse or malicious activity;
  • Complying with legal, regulatory, contractual and professional obligations;
  • Establishing, exercising or defending legal claims where necessary; and
  • Other purposes that are communicated to you at the time your personal data is collected.

We will not use personal data for purposes that are incompatible with the purpose for which it was collected unless permitted or required by applicable law.

5. Lawful Basis for Processing

ITEC will process personal data only where there is a lawful basis for doing so.

Depending on the circumstances, the lawful basis may include:

  • Consent, where you have provided valid consent;
  • Performance of a contract, where processing is necessary to enter into or perform a contract;
  • Legal obligation, where processing is necessary for compliance with applicable law;
  • Legitimate interests, where processing is necessary for legitimate business interests and those interests are not overridden by the rights and interests of the data subject;
  • Public interest, where applicable; or
  • Another lawful basis recognised under applicable Kenyan data protection legislation.

Where processing is based on consent, you may withdraw your consent at any time, although this will not affect the lawfulness of processing carried out before withdrawal.

6. Cookies and Similar Technologies

Our website may use cookies and similar technologies to enable website functionality, improve user experience, understand website usage and, where applicable, support website security and analytics.

Cookies are small files placed on your device when you visit a website.

The types of cookies that may be used include:

  • Essential cookies – necessary for the website to function properly;
  • Functional cookies – used to remember preferences and improve functionality; and
  • Analytics or performance cookies – used, where enabled, to understand how visitors use the website and help us improve its performance.

Where third-party services are used on the website, those services may place their own cookies or similar technologies in accordance with their respective privacy policies.

You can manage or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.

7. Comments, Forms and Website Submissions

Where the website provides facilities for visitors to submit comments, enquiries, forms or other information, we may collect the information submitted together with technical information such as the IP address and browser information where necessary for security, spam prevention or website administration.

We will use information submitted through the website for the purpose for which it was provided and for other lawful purposes described in this Privacy Policy.

8. Media and Uploaded Content

Where the website permits users to upload images or other files, you should ensure that you do not upload content containing unnecessary personal or location information, including embedded GPS or EXIF metadata.

You should only upload information that you are authorised to provide and that is necessary for the relevant purpose.

9. Embedded Content and Third-Party Services

Our website may contain links to or embedded content from third-party websites and services, including videos, maps, social media platforms, document services, analytics services or other external resources.

When you interact with embedded content or visit a third-party website, that third party may collect information about you, use cookies or similar technologies, and process your personal data in accordance with its own privacy policy.

ITEC does not control the privacy practices of third-party websites and services. We encourage you to review the privacy policies of those third parties before providing them with personal information.

10. Sharing and Disclosure of Personal Data

ITEC does not sell or rent personal data to third parties.

We may share personal data where necessary and lawful with:

  • Employees and authorised personnel who require the information to perform their duties;
  • Professional advisers, consultants and service providers acting on our behalf;
  • Website hosting, IT, security, communications and technology service providers;
  • Government agencies, regulators, courts or other authorities where required or permitted by law;
  • Project partners, joint-venture partners or subcontractors where necessary for the performance of a legitimate business or contractual purpose; and
  • Other persons where you have provided consent or where disclosure is otherwise permitted by applicable law.

Where third parties process personal data on our behalf, we will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place.

11. Transfer of Personal Data Outside Kenya

Some of our service providers or technology platforms may process or store personal data outside Kenya.

Where personal data is transferred outside Kenya, ITEC will ensure that the transfer is undertaken in accordance with applicable Kenyan data protection requirements, including the requirements relating to appropriate safeguards, adequacy decisions, necessity or consent, as applicable.

Where appropriate, we will assess the safeguards applicable to such transfers and take reasonable measures to protect personal data during and after the transfer.

12. Security of Personal Data

ITEC takes reasonable technical and organisational measures to protect personal data against:

  • Unauthorised access;
  • Unauthorised disclosure;
  • Loss or destruction;
  • Accidental or unlawful alteration;
  • Misuse; and
  • Other forms of unauthorised processing.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

In the event of a personal data breach that meets the applicable legal requirements for notification, ITEC will take the required steps in accordance with Kenyan data protection legislation.

13. Retention of Personal Data

We retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, or for as long as required by applicable contractual, legal, regulatory, accounting or professional requirements.

The retention period will depend on the nature of the information and the purpose for which it is processed.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymise or otherwise dispose of it in accordance with our applicable data retention procedures.

14. Your Rights as a Data Subject

Subject to applicable law and any lawful limitations, you have rights in relation to your personal data, including the right to:

  • Be informed about the use of your personal data;
  • Access personal data that we hold about you;
  • Request correction of inaccurate, incomplete, false or misleading personal data;
  • Request deletion or erasure of personal data in circumstances permitted by law;
  • Object to the processing of your personal data;
  • Request restriction of processing in circumstances provided by law;
  • Request portability of your personal data where applicable;
  • Withdraw consent where processing is based on consent; and
  • Exercise any other rights available under applicable data protection legislation.

The Data Protection Act and Regulations provide mechanisms for exercising these rights, subject to applicable conditions and exemptions.

15. How to Exercise Your Rights

To exercise your data protection rights or make a privacy-related enquiry, please contact ITEC using the contact details provided below.

We may need to verify your identity before processing certain requests in order to protect personal data from unauthorised disclosure.

We will handle requests in accordance with the applicable requirements and statutory timelines.

16. Complaints

If you have a concern about how ITEC has handled your personal data, we encourage you to contact us first so that we can investigate and address the matter.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in accordance with applicable Kenyan law. The ODPC is the statutory authority responsible for regulating the processing of personal data and protecting data-subject rights in Kenya.

Information about the ODPC and its complaints mechanisms is available on the ODPC website.

17. Children’s Data

Our website is not specifically directed at children.

We do not knowingly collect children’s personal data except where such collection is lawful and appropriate for the relevant purpose and in accordance with applicable legal requirements.

Where the processing of children’s personal data is required, ITEC will apply the safeguards required under applicable data protection legislation.

18. Third-Party Links

Our website may contain links to websites operated by third parties.

ITEC is not responsible for the privacy practices, content or security of external websites. Visitors should review the privacy policies of third-party websites before providing personal information to them.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology, applicable laws or regulatory requirements.

Any updated version will be published on this page with a revised effective date.

We encourage visitors to review this Privacy Policy periodically.

20. Contact Us

If you have any questions, requests or concerns regarding this Privacy Policy or the processing of your personal data, please contact us:

ITEC Engineering Ltd
SIFA Towers, Lenana Road, Kilimani
P.O. Box 3103-00100 GPO
Nairobi, Kenya

Tel: +254 792745459

Email: info@itecengineering.co.ke
Website: www.iteceng.org

Last Updated: 23 September 2026