Last updated ·
You can browse the portfolio, prepare a project brief and email the completed PDF to the studio. The questionnaire keeps your answers in your browser until you choose to save, export or share them. Online brief submission, private return links and website checkout are currently unavailable.
Who is responsible
Samuel Ndung’u Karanja operates NDUNGU in Nairobi, Kenya, and is the controller for personal information the studio receives through enquiries, project briefs and client work. For privacy questions or requests, email samndungukaranja@gmail.com.
What we collect and why
- Enquiries and briefs. Our office secretary handles initial enquiry calls and emails. We use your name, contact details and project information to respond, assess whether we can help and prepare a scope or quotation at your request. This may include a general site location, budget range, timeline, references and household requirements. Share enough to help us respond and leave optional questions blank where you prefer.
- Client work. If you appoint us, we use relevant correspondence, drawings, decisions, agreed deliverables and invoice or payment records to carry out the appointment, administer the project and meet applicable accounting or legal obligations.
- Site operation and security. Cloudflare Pages hosts this site. Cloudflare may process connection details such as IP address, browser information and page requests to deliver and protect the site. Our interest is to keep the site available, diagnose faults and prevent abuse.
- Optional information and separate permissions. Where we rely on consent, such as for optional marketing or another separately agreed use, you can withdraw it. Sending a brief does not subscribe you to marketing or give permission to publish your project or personal details.
Information generally comes from you. During an appointment, a representative or project consultant may also provide relevant information. Share only what is needed. Describe access or household needs in practical terms and avoid including diagnoses, children’s names, identity numbers, title documents, passwords or financial credentials in a general enquiry. A parent or guardian should provide any necessary information about a child.
Browser storage and website requests
Drafts. Answers remain in the open tab unless you choose a way to save or send them. Remember this draft on this browser stores a copy in that browser profile. Anyone with access to that profile may be able to read it. Use Clear this browser draft or your browser’s site-data settings to remove it. Exported PDFs and answer files are separate copies under your control.
Email. We receive enquiry emails and PDF attachments in Gmail. The office secretary uses delegated Gmail access to handle enquiries, and the studio account has two-step verification enabled. Enquiry attachments are kept in Gmail. Downloading a brief creates a copy on your own device. The studio receives it when you attach and send it using your email service. Ask us how to share private drawings or reports before sending them.
Fonts and external links. Your browser requests typefaces from Google Fonts and sends ordinary connection information, including its IP address. If you open WhatsApp or a social profile, the service you visit handles your activity under its own privacy terms.
Sharing and international handling
We share information as needed with service providers that help deliver the site, email or secure storage, and with appointed project professionals where it is relevant to their role. We may also disclose information when legally required or to establish, exercise or defend a legal claim. Project material intended for public display is handled separately from the private brief.
Cloudflare and Google operate international infrastructure, so website requests or enquiry emails may be processed outside Kenya. For information about where your data is handled and the safeguards applicable to a transfer, contact the studio using the address above.
Retention and security
- Browser drafts remain until you clear them, disable browser saving, or your browser removes the stored data.
- Enquiries that do not become projects. We review the correspondence and attachments after six months from the last substantive contact. We delete them sooner if they are no longer needed. If a follow-up is still relevant, we may keep them for up to 12 months from that contact. We keep records longer only where necessary to meet a legal obligation or handle a legal claim.
- Client and payment records are kept as needed to deliver the work, manage the appointment, meet applicable record-keeping obligations and handle any outstanding claims.
We limit access to those who need it to handle the enquiry or project. Keep exported copies of your brief secure. If you think someone has accessed your information without permission, contact us promptly so we can investigate and make any notifications required by law.
Your rights and how to contact us
Under Kenya’s data protection law, you can ask how your information is used, request access, object to processing, and request correction or deletion of false or misleading information. Depending on the law that applies and the circumstances, you may also be able to request erasure, restriction or a portable copy, or withdraw consent where processing relies on it. Withdrawal applies going forward.
Email samndungukaranja@gmail.com and tell us what you need. We may ask for enough information to verify your identity or authority to act for someone else. You may also lodge a complaint with Kenya’s Office of the Data Protection Commissioner, or contact another competent regulator where applicable.
We’ll update this notice when the website or our handling of personal information changes. The date at the top identifies the current version.