This Privacy Policy explains how Milele Paints Ltd. ("Milele Paints", "we", "us") collects, uses and protects your personal data when you visit our website or contact us. Because our website is hosted in Austria (European Union), we apply both the Kenya Data Protection Act, 2019 and the EU General Data Protection Regulation (GDPR), whichever gives you stronger protection.
1. Data controller
Milele Paints Ltd., Savanna Oilcom Petrol Station, Outer Ring Road, Donholm, Nairobi, Kenya. Email: contact@milelepaints.com. Our contact person for data protection matters can be reached at the same address.
2. What data we collect
- Contact data you give us — name, phone/WhatsApp number, email address and message content when you enquire or request a quote.
- Technical data automatically processed by our hosting and security providers — IP address, browser type, device and access timestamps, held briefly in server logs.
- Aggregated usage statistics collected via our cookie-free analytics tool — see Section 8. We do not use cookies.
3. How we use your data & legal basis
- To respond to enquiries and prepare quotes — performance of a contract / steps prior to a contract (GDPR Art. 6(1)(b); DPA s.30).
- To operate, secure and maintain the website — legitimate interest (GDPR Art. 6(1)(f)).
- For aggregated traffic statistics — legitimate interest (GDPR Art. 6(1)(f)), since our analytics tool does not identify individuals.
4. Sharing & international transfers
We do not sell your personal data. To operate this website we rely on a small number of service providers acting as processors on our behalf:
- World4You Internet Services GmbH (Linz, Austria) — our web hosting provider; website data is stored on servers in Austria.
- Cloudflare, Inc. — provides content delivery and security (e.g. DDoS protection) in front of our website, and processes technical request data, including your IP address, while routing traffic to our host.
As data is processed in the EU in connection with a Kenyan business, any transfer of personal data outside Kenya is carried out with adequate safeguards as required by Part VI of the Data Protection Act, 2019, and, where EU data is involved, using GDPR-approved transfer mechanisms.
5. How long we keep it
We retain personal data only as long as necessary for the purposes above or as required by law, after which it is securely deleted. Enquiry records that do not lead to a business relationship are typically kept for up to 24 months and then deleted. Where an enquiry results in a contract, order or invoice, the related records are retained for the statutory retention periods — generally up to 7 years for tax and accounting purposes (e.g. § 132 Austrian Federal Fiscal Code and comparable Kenyan requirements).
6. Your rights
Under the Kenya Data Protection Act and the GDPR you have the right to access, correct, delete or restrict processing of your data, to object to processing, to data portability, and to withdraw consent. To exercise any right, email contact@milelepaints.com.
You may also lodge a complaint with the Office of the Data Protection Commissioner (Kenya) at odpc.go.ke, or, for EU-related processing, with the Austrian Data Protection Authority (Datenschutzbehörde) at dsb.gv.at.
7. Data security
We use appropriate technical and organisational measures — including encrypted connections (HTTPS via Cloudflare) and access controls — to protect your data against loss, misuse or unauthorised access.
8. Cookies & analytics
This website does not use cookies of any kind — no essential, analytics or advertising cookies — and does not require a cookie banner. For anonymous traffic statistics we use Pima Analytics, a cookie-free, self-hosted analytics tool running on our own server. It records only aggregated usage data — pages visited, page titles, the referring website, device type, browser language and country of origin. It does not set cookies, does not track individuals across other websites and does not create profiles. Your raw IP address is not stored in the analytics database; instead a short-lived, daily-rotating anonymous identifier is derived (the last part of the IP address is removed before it is hashed). To determine the country of origin, the IP address is transmitted once to the geolocation service ip-api.com and is only briefly cached for that lookup — see ip-api.com/docs/legal. The legal basis is our legitimate interest in understanding and improving our website (GDPR Art. 6(1)(f)). No consent banner is needed because no personal identifiers are stored on your device. Should we introduce cookies in future (e.g. for a login area), we will update this policy and show a consent banner before any non-essential cookie is set.
9. Maps & web fonts
To show our location we embed an interactive map. The map tiles are loaded from CARTO (based on OpenStreetMap data) and the mapping library from a content delivery network. When the map loads, your browser connects directly to these providers, which transmits your IP address to them; we have no control over this processing. This is done on the basis of our legitimate interest in presenting our location (GDPR Art. 6(1)(f)). Our website font is self-hosted on our own server — no font files are loaded from Google or any third party. For more information see:
- CARTO — carto.com/privacy
- OpenStreetMap Foundation — osmfoundation.org privacy policy
- The "Get directions" button opens Google Maps — policies.google.com/privacy
10. Changes to this policy
We may update this policy from time to time. The current version is always available on this page.
Last updated: 5 July 2026