Privacy policy.

This policy explains how Labmond Group Limited collects, uses and protects personal data when you use www.labmondgroup.co.ke, send us a quote request or a question, or buy from us. It follows the Data Protection Act, 2019 of Kenya and the Data Protection (General) Regulations, 2021.

---

1. Who we are

Labmond Group Limited ("Labmond", "we", "us") is a medical and pharmaceutical supplier in Nairobi, Kenya. We are the data controller for the personal data described in this policy.

For any privacy question or request, email info@labmondgroup.co.ke.

2. The data we collect

Data you give us through the quote form:

• your name
• your facility or organisation, and its type
• your phone number and email address
• your county
• the product ranges you are interested in, your product list, quantities and any notes
• any file you upload, such as a product list or tender document
• when you need the order, and whether you want delivery or collection
• your consent to be contacted about the request

Data you give us through the quick question form: your name, your phone number or email address, and your message.

Data you give us when you buy from us: order, delivery and invoice details, the name of the person who signs for a delivery, and, for regulated products, a copy of your facility's licence.

Data you give us when you call, email or message us: your contact details and what you tell us.

Technical data: our website is hosted on a cloud server provided by Google Cloud. When you visit the site, this server records your IP address, device and browser type, the pages you request and the time of each request. These records keep the site secure and working. If we turn on website analytics, we will use a privacy friendly tool, only with your consent where the law requires it, and we will update this policy and our Cookie Notice first.

Please do not send us patient information. We do not need it to quote or supply.

3. Why we use your data, and our lawful basis

Purpose	Lawful basis
Preparing and sending your quote, and answering your questions	Steps you ask us to take before a contract
Processing orders, delivery, invoicing and after sales support	Performance of a contract
Checking licences before we supply regulated products	Legal obligation
Keeping tax, financial and regulatory records	Legal obligation
Keeping the website secure and fixing faults	Legitimate interests
Following up on a quote you requested	Legitimate interests
Sending you news or offers, if we do so	Consent, which you can withdraw at any time

Where we rely on legitimate interests, we have checked that our interest does not override your rights. You can object at any time (see section 9).

4. Who we share your data with

We share personal data only where needed, and only with:

• Google Cloud, which provides the cloud server our website is hosted on. Data sent through our forms passes through this server.
• Our IT provider, which operates that server for us.
• Resend, a transactional email provider, which delivers form submissions to our inbox.
• The provider of our business email, which holds the emails we send and receive.
• Delivery partners, only the details needed to deliver your order.
• Professional advisers, such as accountants and lawyers, under a duty of confidence.
• Regulators, courts and public authorities, such as the Pharmacy and Poisons Board or the Kenya Revenue Authority, when the law requires it.

We do not sell your personal data, and we do not share it for other companies' marketing.

Our service providers act on our instructions and must keep your data secure.

5. Transfers outside Kenya

Some of our service providers, including Google Cloud and Resend, may store or process data outside Kenya, for example in the United States. When data leaves Kenya, we make sure the transfer meets the Data Protection Act. That means the provider gives appropriate safeguards for the security and protection of the data, such as contractual terms, or the transfer is otherwise allowed under the Act.

6. How long we keep your data

• Quotes and order records: for as long as you are a customer, and then as long as we need them for tax, accounting and regulatory records. Financial records are generally kept for 7 years.
• Enquiries and quotes that do not become orders: deleted after 24 months.
• Licence copies for regulated products: for as long as the related order records are kept.
• Website technical records (server logs): for a short period, only as long as needed for security and operation.

When we no longer need data, we delete it or make it anonymous.

7. How we keep your data secure

The site uses an encrypted connection (HTTPS). Form submissions go straight to our business email and are not stored in a separate website database. Access to customer records is limited to staff who need it. If a personal data breach puts your rights at risk, we will tell the Office of the Data Protection Commissioner and, where required, you, as the Act requires.

8. Children

This website and our services are for businesses and health facilities. They are not directed at anyone under 18, and we do not knowingly collect data from children.

9. Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used
• access the personal data we hold about you
• correct data that is wrong or incomplete
• have your data deleted
• object to our use of your data
• restrict our use of your data in some cases
• receive your data in a portable format, or have it sent to another organisation
• withdraw consent at any time, where we rely on consent

To use any of these rights, email info@labmondgroup.co.ke. We may ask you to confirm your identity first. We will respond within the time the law sets. Some rights have limits. For example, we cannot delete records the law requires us to keep.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

10. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will say so on the website.

11. Contact us

Labmond Group Limited, Nairobi, Kenya Email: info@labmondgroup.co.ke Website: www.labmondgroup.co.ke