1. Introduction

This Privacy Policy explains how SemaBOX Africa (“SemaBOX”, “we”, “us” or “our”) collects, uses, stores and shares personal data, and the rights available to individuals whose data we process. It applies to visitors to our website, our production clients and their representatives, and candidates who apply to work with us.

Because SemaBOX operates from Kenya and may work with clients, partners or website visitors based in the European Economic Area, Switzerland or the United Kingdom, this Policy has been written to reflect both Kenya's Data Protection Act, 2019 (“Kenya DPA”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

SemaBOX Africa [SEMABOX LTD] is the data controller responsible for personal data processed as described in this Policy, unless stated otherwise.

We may update this Policy from time to time. Where a change is material, we will take reasonable steps to notify you, such as posting a notice on our website or updating the effective date above. Continued use of our website or services after changes take effect will be treated as acceptance of the updated Policy.

2. Your Rights Over Your Personal Data

Under the Kenya DPA and, where applicable, the GDPR, you have a number of rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us using the details in Section 9.

● Right of access – you can ask us to confirm what personal data we hold about you and request a copy of it.

● Right to rectification – you can ask us to correct or update personal data that is inaccurate or incomplete.

● Right to erasure – you can ask us to delete your personal data where we no longer have a valid reason to keep it, subject to any legal or contractual obligations that require us to retain it.

● Right to restrict processing – you can ask us to limit how we use your data in certain circumstances, for example while a dispute about its accuracy is resolved.

● Right to data portability – where we process your data with your consent or to perform a contract, you can ask for a copy of it in a portable, machine-readable format.

● Right to object – you can object to processing that is based on our legitimate interests, including for direct marketing.

● Right to withdraw consent – where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

● Right to lodge a complaint – you may complain to Kenya's Office of the Data Protection Commissioner (ODPC), or, if the GDPR applies to you, to the data protection authority in your own EEA/UK jurisdiction.

3. Personal Data We Collect and Why

3.1 Website Visitors

When you browse our website, we may collect limited technical information such as your IP address, browser type, device information, and general location, along with information about how you interact with our site (for example, pages viewed and time spent on the site).

We process this information on the basis of our legitimate interest in keeping our website secure, understanding how it is used, and improving it, or on the basis of your consent where required for non-essential cookies (see Section 8). We use this data to operate and maintain the website, diagnose technical issues, protect against fraud and misuse, and understand visitor interest in our services.

Website visitor data is retained only for as long as necessary for these purposes, after which it is deleted or anonymised.

3.2 Clients and Production Customers

When an organisation or individual engages SemaBOXfor production, content or related services, we collect personal data about the client's representatives and, where relevant, individuals involved in a production (such as guests or interviewees featured in content we produce on a client's behalf).

● Contact details: name, job title, organisation, email address and phone number.

● Contract and invoicing details: billing information, payment details and correspondence relating to a project.

● Production-related information: information shared with us for the purpose of planning, recording or delivering content, such as guest names, biographies and scheduling details.

We process this data because it is necessary to perform our contract with the client, or based on our legitimate interest in managing our business relationships and delivering agreed services. We use it to communicate with clients, plan and deliver productions, manage invoicing and payment, and maintain business records as required by law.

Client and production data is retained for the duration of our engagement and for a reasonable period afterwards to meet contractual, accounting or legal record-keeping obligations, after which it is deleted or anonymised.

3.3 Job Applicants

When you apply for a role with SemaBox, we collect the personal data you provide as part of your application, which may include your name, contact details, CV or resume, work history, references, and any other information you choose to share during the recruitment process.

We process this data on the basis of our legitimate interest in recruiting suitable candidates, and, where applicable, to take steps prior to entering into an employment contract. We use it to assess your application, contact you about your candidacy, and, if you are unsuccessful, to consider you for future opportunities where you have agreed to this.

Application data for unsuccessful candidates is retained for a limited period after the recruitment process concludes, after which it is deleted, unless you have consented to us retaining it for future opportunities.

4. Sharing Your Personal Data

We do not sell personal data. We may share personal data with:

● Service providers who support our operations, such as cloud hosting, email, payment processing, accounting and IT support providers, acting on our instructions and under appropriate contractual safeguards.

● Clients, where information about production participants (such as guests) is shared with the client commissioning the production.

● Professional advisers, such as auditors or lawyers, where necessary.

● Authorities or regulators, where required by law or to protect our legal rights.

5. International Data Transfers

Some of our service providers may store or process personal data outside Kenya, including in the EEA, UK or elsewhere. Where we transfer personal data internationally, we take steps to ensure it remains protected in line with the requirements of the Kenya DPA and, where applicable, the GDPR, including through contractual safeguards with the recipient.

6. Data Security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, including access controls and secure storage practices. No system can be guaranteed completely secure, and we encourage you to contact us if you have any concerns.

7. Children

Our website and services are directed at businesses and professional contacts and are not intended for children. We do not knowingly collect personal data from children. Where a production we work on involves a young guest, any collection of their data is handled with the informed involvement of a parent or guardian.

8. Cookies

Our website may use cookies or similar technologies to help it function and to understand how visitors use it. Where required, we will ask for your consent before placing non-essential cookies, and you can manage or withdraw your preferences at any time through your browser settings.

9. How to Contact Us

If you have questions about this Policy or wish to exercise any of your rights, please contact us:

Email: hello@semabox.africa

Postal address: P. O Box 536-00517, Nairobi