Privacy Policy & Data Protection

1. Statutory Framework & Scope

This Privacy Policy sets out how Ronnel Group Limited ("Ronnel Group", "we", "us", or "our"), incorporated under the Companies Act of Kenya and operating under WRMA, NEMA, and EPRA regulatory accreditations, collects, processes, protects, and retains personal data provided by visitors, clients, and commercial partners across our website (www.ronnelgroup.com) and our nationwide engineering operations in all 47 counties in Kenya.

We strictly uphold the provisions of the Kenya Data Protection Act, 2019 (Act No. 24 of 2019), the regulations of the Office of the Data Protection Commissioner (ODPC), and international privacy benchmarks including the General Data Protection Regulation (GDPR).

2. Personal & Commercial Data We Collect

Depending on your interactions with our engineering platform, we collect the following categories of data:

3. How Your Information Is Used

We process your data strictly under lawful legal bases:

• Contractual Performance: Processing your equipment orders, coordinating dispatch logistics with our transport team, conducting site visits, and carrying out turnkey installations.
• Direct Engineering Telephone Callbacks: Telephoning clients to confirm technical hydraulic, solar PV sizing, or generator load sizing before dispatching heavy machinery.
• Legal & Tax Compliance: Generating verified invoices, tracking warranties (1 to 25 years), and complying with Kenya Revenue Authority (KRA) obligations.
• Cybersecurity & Honeypot Protection: Detecting, blocking, and logging unauthorized automated bots, webshell probes, and malicious penetration scanners to protect customer order records.

4. Payment on Delivery & Invoicing Integrity

To ensure total financial safety for our clients across Kenya, Ronnel Group Limited primarily operates a Payment on Delivery (POD) model:

• You are never asked to enter credit card numbers or banking passwords on our public website.
• Payment is executed physically or via official Ronnel Group M-Pesa Buy Goods Till / Paybill after equipment arrives on your site and has undergone physical inspection.
• Upon payment confirmation, our administrative desk generates an official electronic invoice featuring a digital security seal, verification QR code, and sends a copy directly to your verified email address.

5. Third-Party Sharing & Operational Disclosure

We only disclose limited personal information to trusted third parties strictly necessary for project fulfillment:

• Certified Logistics & Transport Drivers: Sharing delivery phone numbers and physical directions to facilitate machinery delivery.
• Subsidiary Technical Partners: Our parent entity Water Equipment's & Systems Limited (WEQSL) for specialized pump machining and factory calibration.
• Statutory Authorities: If required by judicial court order, Kenya National Police Service, or authorized regulatory agencies in accordance with the Laws of Kenya.

6. Cookies & Tracking Technologies

Our website employs strictly essential session cookies (`rgl_cache_`, `ronnel_cart`, `XSRF-TOKEN`) to remember your cart items, maintain session integrity, and protect form submissions from Cross-Site Request Forgery. For comprehensive details, please consult our dedicated Cookie Policy.

7. Data Security & Storage Standards

We employ modern enterprise safeguards to prevent unauthorized access, alteration, or disclosure:

• 256-Bit SSL/TLS Encryption: All browser-to-server traffic is encrypted in transit.
• Encrypted Database Sessions: Session records and password reset tokens are protected using robust cryptographic hashing (`bcrypt`).
• Rate Limiting & Honeypot Firewalls: Strict submission limits on quote, cart, and appointment endpoints prevent brute-force attacks and harvesting.

8. Your Statutory Legal Rights (Kenya ODPC)

Under the Kenya Data Protection Act 2019, you have the following enforceable rights: