Privacy Policy

Baristapro Ltd

Last updated: September 11, 2026

1. Introduction

Baristapro Ltd (“Baristapro”, “we”, “us”, “our”) is committed to protecting the privacy and personal data of everyone who interacts with us — our students, prospective students, corporate clients, event clients, website visitors and suppliers.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have in relation to it.

We process personal data in accordance with the Data Protection Act, 2019 (No. 24 of 2019) of the Laws of Kenya, the Data Protection (General) Regulations, 2021, and any other applicable data protection law.

Our details:

• Data Controller: Baristapro Ltd
• Physical address: The Mirage, Waiyaki Way, Westlands, Nairobi, Kenya
• Email: enquiries@baristapro.co.ke
• Telephone: +254 707 818 319
• Website: https://baristapro.co.ke

If you have any questions about this policy or how we handle your data, contact us using the details in Section 15.

2. Scope of this policy

This policy applies to personal data we collect:

• Through our website, https://baristapro.co.ke
• Through our course application and enrolment process
• In the course of delivering training, certification and assessment
• Through our other services — café consultancy, barista sourcing, corporate training and coffee bar services at events
• At our premises, including through CCTV where installed
• Through our social media pages, WhatsApp Business and messaging channels
• Through any other interaction you have with us

It does not apply to third-party websites or services we link to. Those operate under their own privacy policies, and we encourage you to read them.

3. Personal data we collect

3.1 Students and prospective students

• Full name, date of birth and gender
• Contact details: telephone number, email address, physical and postal address
• Next of kin or emergency contact details
• Educational background and prior qualifications
• Employment history and career objectives, where relevant to course placement
• Photographs taken for identification and certification purposes
• Course selection, attendance records, assessment results and certification status
• Payment records, including amounts, dates, method of payment and receipt numbers
• KRA PIN, where required for the issue of a tax invoice
• Correspondence between you and us

3.2 Corporate and business clients

• Business name, registration details and KRA PIN
• Contact person’s name, role, telephone number and email address
• Billing address and payment records
• Details of the services requested and delivered

3.3 Website visitors

• IP address and approximate location
• Browser type, device type and operating system
• Pages visited, time spent and referring website
• Information submitted through contact and enquiry forms
• Cookie data (see Section 10)

3.4 Job applicants and baristas placed through our sourcing service

• CV, qualifications, certifications and work history
• Contact details and references
• Right-to-work documentation where applicable

3.5 Sensitive personal data

We do not routinely collect sensitive personal data. Where it is necessary — for example, a dietary requirement, allergy or accessibility need disclosed so we can make appropriate arrangements during training — we will collect only what is needed, tell you why, and obtain your explicit consent where the law requires it.

4. How we collect your data

We collect personal data:

• Directly from you — when you complete an application form, make an enquiry, register for a course, subscribe to our updates, message us on WhatsApp or social media, or speak to us by telephone or in person
• Automatically — when you use our website, through cookies and analytics tools
• From third parties — including your employer where they sponsor your training, referees you nominate, and payment service providers who confirm transactions
• From publicly available sources — such as business directories, where relevant to a corporate enquiry

5. Why we process your data, and our lawful basis

We process personal data only where we have a lawful basis to do so under the Data Protection Act, 2019.

Where we rely on consent, you may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Photographs, video and recordings

We frequently photograph and record training sessions, graduations, competitions and events, and we use this material on our website, social media channels and in promotional material.

• We will ask for your consent before using identifiable images of you for marketing purposes.
• You may decline without any effect on your training, your assessment or your results.
• You may withdraw your consent at any time by contacting us. We will stop using the material in future publications and remove it from channels under our control where it is reasonably practicable to do so. We may be unable to recover material that has already been shared or republished by others.
• Where a participant is under the age of 18, we will obtain consent from a parent or guardian.

7. Who we share your data with

We do not sell your personal data. We share it only where necessary, and only with:

• Certification bodies and awarding organisations, where you are pursuing an international or accredited qualification and your details must be submitted for registration, assessment or certification
• Payment service providers and financial institutions, to process and confirm payments
• The Kenya Revenue Authority, where required for tax invoicing and compliance
• Employers or sponsors, where they are funding your training and have a legitimate need to receive attendance or completion information. We will tell you what is shared.
• Prospective employers, where you have asked us to place you through our barista sourcing service and have consented to your details being shared
• Professional advisers — accountants, auditors and lawyers — bound by duties of confidentiality
• IT and service providers who host our website, provide email and messaging services, or support our systems, under written agreements requiring them to protect your data
• Regulators, law enforcement and courts, where we are required to disclose by law

8. International transfers

Some of our service providers, and certain certification bodies, are located outside Kenya. Where we transfer personal data outside Kenya, we do so in accordance with the Data Protection Act, 2019, and only where:

• The receiving country has adequate data protection safeguards; or
• Appropriate safeguards are in place, such as contractual commitments requiring the recipient to protect your data to a comparable standard; or
• You have given your explicit consent to the transfer; or
• The transfer is necessary for the performance of a contract with you

If you would like details of the safeguards applied to a particular transfer, contact us.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes it was collected, and to meet our legal, tax and regulatory obligations.

At the end of the retention period we securely delete or anonymise the data. Where a record is needed to verify a qualification you hold, we may retain minimal certification data for longer, and we will tell you if that applies to you.

10. Cookies and website analytics

Our website uses cookies and similar technologies to function correctly, remember your preferences, and help us understand how the site is used.

We use:

• Strictly necessary cookies — required for the website to operate. These cannot be switched off.
• Analytics cookies — which help us understand visitor numbers and behaviour so we can improve the site.
• Marketing cookies — which may be used to measure the performance of our advertising and show you relevant content.

You can control cookies through your browser settings. Disabling some cookies may affect how parts of the website work.

We use third-party services including [LIST: e.g. Google Analytics, Google Tag Manager, Meta Pixel]. These providers may process data outside Kenya under their own privacy policies.

11. Marketing communications

If you have given us consent, or where we have a legitimate interest and the law permits, we may send you information about our courses, upcoming intakes, workshops and services by email, SMS or WhatsApp.

You can opt out at any time by:

• Clicking the unsubscribe link in any email
• Replying STOP to an SMS
• Messaging us on WhatsApp asking to be removed
• Emailing enquiries@baristapro.co.ke

We will continue to send you essential service messages about a course you are enrolled in — schedule changes, assessment arrangements, fee notices — as these are necessary to deliver the training.

12. Persons under 18

Our courses are generally intended for adults. Where we accept a participant under the age of 18:

• We require the consent of a parent or guardian before processing their personal data
• We collect only the minimum data necessary
• We obtain separate parental consent before using any identifiable image of the participant in marketing
• We do not use their data for behavioural profiling or targeted advertising

If you believe we hold data about a person under 18 without appropriate consent, contact us immediately and we will investigate.

13. How we protect your data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include:

• Access controls limiting staff access to what their role requires
• Encryption of data in transit, including SSL on our website
• Secure storage of physical records
• Confidentiality obligations for staff and trainers
• Written agreements with service providers who process data on our behalf
• Regular review of our security practices

No system is completely secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Office of the Data Protection Commissioner and, where required, notify you, in accordance with the timelines set out in the Data Protection Act, 2019.

14. Your rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed of the use to which your personal data is put
• Access the personal data we hold about you
• Object to the processing of all or part of your personal data
• Correction of false or misleading data
• Deletion of false or misleading data about you
• Data portability, where applicable — to receive your data in a structured, commonly used format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Office of the Data Protection Commissioner

To exercise any of these rights, contact us using the details in Section 15. We will respond within the timeframe required by law. We may ask you to verify your identity before acting on a request. We do not charge a fee for a reasonable request, but we may charge a reasonable fee, or decline, where a request is manifestly unfounded or excessive.

15. Contact us

For any question about this policy, to exercise your rights, or to raise a concern:

• Email: enquiries@baristapro.co.ke
• Telephone: +254 707 818 319
• Address: Baristapro Ltd, The Mirage, Waiyaki Way, Westlands, Nairobi, Kenya.

16. Complaints to the regulator

If you are not satisfied with how we have handled your personal data or your request, you have the right to complain to:

Office of the Data Protection Commissioner (ODPC) Britam Tower, 33rd Floor, Hospital Road, Upper Hill, Nairobi Email: info@odpc.go.ke Website: https://www.odpc.go.ke

We would appreciate the opportunity to address your concern directly before you approach the ODPC, but you are entitled to complain to them at any time.

17. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services or the law. The current version will always be available at https://baristapro.co.ke/privacy-policy and the “Septermber-11-2026” date at the top will show when it was last revised.

Where changes are significant, we will bring them to your attention by email or a notice on our website.