Our commitment to you

Privacy Policy

Effective Date: January 1, 2025
Company Name: Beverage Industries Africa Ltd (BIA)
Website: www.bia.co.ke

1. Introduction

Beverage Industries Africa Ltd ("BIA", "we", "us", or "our") is committed to ensuring the protection of your personal data and compliance with applicable data protection legislation, including but not limited to:

• General Data Protection Regulation (GDPR) (EU) 2016/679
• Kenya Data Protection Act (DPA) 2019
• California Consumer Privacy Act (CCPA) 2018
• OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data
• African Union Convention on Cyber Security and Personal Data Protection

This Privacy Policy delineates the modalities by which we collect, process, store, share, and safeguard personal data when you interact with our website or services, ensuring transparency and adherence to regulatory obligations.

2. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings ascribed below:

• Personal Data: Any information relating to an identified or identifiable natural person.
• Data Subject: The natural person to whom the personal data pertains.
• Data Controller: BIA, the entity determining the purposes and means of processing personal data.
• Data Processor: A third party processing personal data on behalf of the Data Controller.
• Processing: Any operation or set of operations performed on personal data, whether automated or manual.

3. Lawful Basis for Processing

We process personal data pursuant to the following legal bases:

• Consent: Where the Data Subject has provided explicit consent to processing.
• Contractual Necessity: Where processing is necessary for the performance of a contract or pre-contractual measures.
• Legal Obligation: Where processing is mandated by applicable laws or regulations.
• Legitimate Interests: Where processing is necessary for the legitimate interests of BIA, provided such interests are not overridden by the Data Subject’s rights and freedoms.

4. Categories of Personal Data Collected

We collect and process the following categories of personal data:

a. Data Provided by Data Subjects

• Full legal name
• Electronic mail address
• Telephone number
• Company name and professional designation
• Physical address
• Content of business inquiries or communications

b. Automatically Collected Data

• Internet Protocol (IP) address
• Browser type and version
• Website navigation patterns and duration
• Device identifiers
• Geolocation data (limited to city/country level)

BIA does not intentionally collect or process special categories of personal data (e.g., biometric, health, religious, or political data) unless required by law or with the explicit consent of the Data Subject.

5. Purposes of Processing

Personal data is processed exclusively for the following purposes:

• Responding to inquiries, requests, or feedback
• Performing contractual obligations or pre-contractual measures
• Transmitting service-related communications, newsletters, or updates (subject to opt-out mechanisms)
• Optimizing website functionality and user experience
• Fulfilling legal, regulatory, or statutory obligations
• Conducting internal audits, compliance monitoring, and risk management

6. Disclosure of Personal Data

BIA does not sell, lease, or trade personal data. Disclosure is limited to:

• Authorized Third Parties: Data Processors (e.g., cloud service providers, analytics firms) bound by data processing agreements and confidentiality obligations.
• Regulatory Authorities: Where mandated by court orders, subpoenas, or statutory requirements.
• Business Transfers: In the context of mergers, acquisitions, or corporate restructuring, subject to stringent confidentiality measures.

All Data Processors are contractually obligated to comply with applicable data protection laws and are subject to periodic compliance assessments.

7. International Data Transfers

Where personal data is transferred to jurisdictions outside the Data Subject’s country of origin (e.g., Kenya to Somalia, or to servers in the EU/USA), BIA ensures:

• Adherence to GDPR Article 45 adequacy decisions
• Implementation of Standard Contractual Clauses approved by competent authorities
• Supplementary safeguards, including encryption and anonymization

8. Data Retention

Personal data is retained only for the duration necessary to fulfill the purposes for which it was collected or to comply with legal, contractual, or regulatory requirements:

• Inquiries: 12–24 months
• Contractual/Service Data: 7 years or as mandated by applicable law
• Marketing Data: Until consent is withdrawn or the Data Subject unsubscribes

Data no longer required is securely deleted or anonymized in accordance with industry standards.

9. Data Security Measures

BIA implements robust technical, organizational, and physical safeguards, including:

• Encryption of data in transit and at rest
• Firewalls and anti-malware protections
• Periodic security audits and vulnerability assessments
• Role-based access controls
• Mandatory staff training and non-disclosure agreements

In the event of a personal data breach, BIA will notify affected Data Subjects and relevant supervisory authorities within the timeframes prescribed by law (e.g., 72 hours under GDPR).

10. Data Subject Rights

Data Subjects are entitled to the following rights:

• Right of Access: Obtain confirmation of processing and a copy of personal data.
• Right to Rectification: Correct inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of personal data, subject to legal exemptions.
• Right to Restriction: Restrict processing under specific circumstances.
• Right to Data Portability: Receive personal data in a structured, machine-readable format for transfer to another controller.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Revoke consent at any time without affecting prior lawful processing.

To exercise these rights, contact:
Email: rmiranda@bia.co.ke (mailto:rmiranda@bia.co.ke)
Kenya: +254 739 475669 / +254 722 204165
Somalia: +252 612 110001

Requests will be acknowledged within 7 business days and resolved within 30 days, in compliance with regulatory timelines.

11. Protection of Children’s Data

BIA’s services are not directed to individuals under the age of 16. We do not knowingly collect or process personal data from minors. Upon discovery of such data, it will be promptly deleted.

12. Automated Decision-Making and Profiling

BIA does not engage in automated decision-making or profiling that produces legal effects or similarly significant impacts on Data Subjects.

13. Cookies and Tracking Technologies

Our website employs cookies and similar technologies to enhance functionality, including:

• Essential Cookies: Necessary for website operation
• Analytics Cookies: For performance monitoring (e.g., Google Analytics)
• Functional Cookies: To retain user preferences

Data Subjects may manage or disable cookies via browser settings. Further details are provided in our Cookie Policy.

14. Third-Party Links

Our website may contain hyperlinks to external websites. BIA is not liable for the content or privacy practices of such third-party sites. Data Subjects are advised to review the privacy policies of these websites prior to data submission.

15. Data Protection Officer

BIA has appointed a Data Protection Officer to oversee compliance with data protection obligations:
Name: Rita Miranda
Email: rmiranda@bia.co.ke (mailto:rmiranda@bia.co.ke)
Telephone: +254 739 475669

16. Complaints

Data Subjects may lodge complaints regarding the handling of their personal data with:

• Office of the Data Protection Commissioner (ODPC), Kenya
• Relevant supervisory authorities in their jurisdiction (e.g., EU Member States, Somalia)

BIA encourages Data Subjects to contact us directly to resolve concerns prior to escalating matters to supervisory authorities.

17. Amendments to This Privacy Policy

BIA reserves the right to amend this Privacy Policy as necessary. Amendments will be published on this page with an updated Effective Date. Material changes will be communicated to Data Subjects via electronic mail or website notifications.

18. Legal Disclaimer

This Privacy Policy does not constitute a contractual agreement or abrogate any statutory rights or obligations. It is designed to ensure compliance with applicable data protection laws while promoting transparency and lawful processing.