Legal
Privacy Policy
Effective date: 1 June 2025
1. Data Controller
Libro East Africa Limited, a company incorporated in Kenya under the Companies Act (Cap. 486), is the data controller responsible for your personal information. You can contact us at admin@libroafrica.com or by post at Nairobi, Kenya.
2. Information We Collect
We collect personal data only when you actively provide it or when it is generated automatically as a result of your visit.
2a. Information you provide
- Contact and inquiry form — name, company name, email address, country, coffee grade of interest, and the content of your message.
- Email correspondence — any personal data you include when communicating with us directly.
2b. Information collected automatically
- IP-derived geolocation — we use IPinfo (ipinfo.io) to derive your approximate country and city from your IP address for internal analytics. Your raw IP address is immediately hashed using a one-way SHA-256 salt and is not stored in identifiable form.
- Visit metadata — page path, timestamp, and referrer, stored alongside the hashed identifier.
- Service worker cache — a PWA service worker caches page assets in your browser for performance. No personal data is stored in this cache.
3. Legal Basis for Processing
| Purpose | Legal basis |
|---|---|
| Responding to trade inquiries and sample requests | Pre-contractual steps / legitimate interest |
| Sending you a reply email or quote | Consent (you initiated contact) |
| Internal visit analytics (hashed IP, country, path) | Legitimate interest (understanding website usage) |
| Compliance with Kenyan law (AFA licensing, NCE reporting) | Legal obligation |
4. How We Use Your Information
- To respond to your inquiry about our coffee lots, grades, pricing, or sample availability.
- To send you requested documentation such as lot specifications, cupping reports, or proforma invoices.
- To improve the content and structure of our website based on aggregate, anonymised analytics.
- To fulfil any legal or regulatory obligations under Kenyan law.
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
5. Third-Party Services
We share data with the following sub-processors, each bound by data-processing agreements or equivalent safeguards:
| Service | Purpose | Location |
|---|---|---|
| Vercel Inc. | Website hosting and edge delivery | USA (SCCs) |
| Neon Inc. | PostgreSQL database hosting | USA (SCCs) |
| Microsoft (Office 365) | Outbound transactional email | Ireland / EU |
| IPinfo LLC | IP-to-country geolocation | USA (SCCs) |
"SCCs" means Standard Contractual Clauses adopted by the European Commission, which provide an adequate transfer mechanism under GDPR Article 46(2)(c).
6. Data Retention
- Contact form submissions — retained for up to 3 years from the date of submission, or for the duration of any resulting commercial relationship, whichever is longer.
- Visit analytics — hashed identifiers and metadata are retained for up to 12 months.
- Email correspondence — retained in line with our standard business record-keeping obligations (7 years under Kenyan tax law).
7. Your Rights
Under the Kenya Data Protection Act 2019 and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — request deletion of your data where there is no overriding legal basis to retain it.
- Restriction — ask us to limit how we use your data while a dispute is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
To exercise any of these rights, email admin@libroafrica.com with the subject line "Data Rights Request". We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at odpc.go.ke.
8. Cookies
This website does not use third-party tracking cookies or advertising cookies. The only browser storage used is:
- A service worker cache (Cache Storage API) for offline-capable page delivery — no personal data.
No cookie consent banner is displayed because no consent-requiring cookies are set.
9. Security
All data in transit is encrypted via TLS 1.2 or higher. Our database is hosted on Neon with connection-level SSL enforced. IP addresses are hashed before storage and cannot be reversed to identify individuals. Access to production systems is restricted to authorised personnel.
10. Children
This website is directed exclusively at businesses and trade professionals. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has submitted data through this site, please contact us immediately at admin@libroafrica.com.
11. Changes to This Policy
We may update this policy to reflect changes in our practices or applicable law. When we do, we will revise the effective date above. Material changes will be communicated via email to users who have submitted contact forms.
12. Contact
All privacy-related queries should be directed to:
Libro East Africa Limited
Nairobi, Kenya
admin@libroafrica.com