1. Who we are
Curzey Design Studio is an interior design, strategy and project-delivery practice based in Nairobi, Kenya. For personal data collected through this website and our public digital tools, Curzey acts as the data controller unless we tell you otherwise.
You can contact us about privacy matters at info@curzeystudio.com or through our contact details published on this website.
2. The information we collect
Depending on how you use the website, we may collect information you provide directly, including your name, email address, telephone number, organisation, project location, project type and stage, approximate floor area, budget range, programme or timeline, procurement preference and the project information you type into an enquiry or planning tool.
Our public planning workspace may also store draft project information, brief content, tool inputs, tool results, recommendations, progress and related session information so that the workspace can function and, where available, allow you to resume your work.
For security, continuity and abuse prevention, our systems may process technical information such as browser or device information, a session identifier and hashed network or browser fingerprints. We design these mechanisms to avoid retaining a plain-text IP address in the public workspace where hashing is used.
3. Why we use your information
We use personal data to respond to enquiries, assess prospective projects, prepare or develop a project brief, provide requested planning tools, maintain a public project workspace, arrange consultations, communicate with you about the project you have raised, protect the website and our systems, prevent abuse, maintain operational records, and comply with legal or regulatory duties.
Where you ask us to consider a project or contact you about an enquiry, processing is generally necessary to take steps at your request before entering into a contract and/or for our legitimate interests in responding to prospective clients and operating our business. Where the law requires consent, or where we offer an optional use that is genuinely consent-based, we will ask for it separately.
4. Incomplete enquiries and follow-up
If you expressly choose the “save my progress” option, we may save the incomplete enquiry and use the email address you supplied to send one recovery message intended to help you complete it. This is optional. If you do not opt in, the website should not use the incomplete-enquiry follow-up feature for you.
Incomplete enquiry records are designed to expire after a limited period. The current application is configured to suppress old incomplete records after approximately 30 days and remove their stored raw payload from active use.
5. Website sessions, local storage and cookies
The public project-planning tools use a strictly functional session mechanism so that the server can associate your browser with the public workspace that belongs to that session. The current session cookie is HTTP-only, uses SameSite=Lax, is marked Secure in production, and is configured with a lifespan of approximately 30 days.
Some planning features may also use your browser's local storage to preserve functional project or tool state. Local storage remains on your device until it is removed by the application, overwritten, or cleared through your browser. These technologies are used for website functionality rather than behavioural advertising.
At the effective date of this policy, the reviewed website implementation does not include Google Analytics, Google Tag Manager, Meta Pixel, Hotjar or a comparable advertising-tracking stack. If we introduce non-essential analytics or advertising cookies later, we will update this notice and implement any consent controls required by applicable law.
6. How long we keep information
We keep personal data only for as long as reasonably required for the purpose for which it was collected, for legitimate business records, to establish or defend legal claims, or where law requires a longer period. Public website sessions are currently configured for approximately 30 days. Draft public projects and certain public tool records are generally configured for approximately 30 to 45 days unless they are submitted, converted, refreshed or otherwise become part of an active business record.
If an enquiry becomes a genuine client or project opportunity, relevant information may be transferred into Curzey's internal client and project systems. Those records may be retained for longer periods appropriate to the resulting business relationship, contractual administration, project delivery, finance, audit and legal obligations.
7. Who may receive the information
Personal data may be accessible to authorised Curzey personnel who need it for enquiry handling, project assessment, client administration, design or project delivery. We may also use service providers that support hosting, infrastructure, email delivery, security, data storage, professional services or other business operations. Such providers should receive only the information necessary for their role and be subject to appropriate contractual or legal safeguards.
We may disclose information where required by law, a court, a regulator or another lawful authority, or where reasonably necessary to protect Curzey, our clients, our users or the security of our services.
8. International transfers
Some technology or professional service providers may process information outside Kenya. Where personal data is transferred internationally, Curzey will take reasonable steps to use a transfer mechanism or safeguards permitted by applicable data-protection law and to assess the protection available to the information.
9. Security
We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. The reviewed public workspace includes measures such as server-side session ownership controls, HTTP-only session cookies, production Secure-cookie settings, hashed fingerprints and rate limiting. No internet service can guarantee absolute security, so we also rely on responsible access controls, monitoring and operational procedures.
10. Your rights
Subject to the Data Protection Act, 2019 and applicable exceptions, you may have rights to be informed about the use of your personal data, access personal data we hold about you, object to certain processing, request correction of inaccurate or misleading information, and request deletion of false or misleading data. Other rights may apply depending on the processing and the law that applies to you.
To exercise a privacy right, contact us at info@curzeystudio.com. We may need to verify your identity before acting on a request. If you believe your data-protection rights have been infringed, you may also lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).
11. Visitors outside Kenya
Curzey is established in Kenya and this policy is written primarily for compliance with Kenyan law. If you are in another jurisdiction whose data-protection law applies to our processing — including, where its territorial requirements are met, the EU or UK GDPR — we will respect the additional rights and obligations that apply to that processing. Nothing in this policy is intended to claim that every foreign privacy law applies to every visit to this website.
12. Children
This website and its project-planning services are intended for adults acting for themselves, their organisations or a project. We do not knowingly design these services to collect personal data from children. If you believe a child has provided personal data through the site without appropriate authority, please contact us.
13. Changes to this policy
We may update this Privacy Policy when our website, services, technology or legal obligations change. The effective date at the top of the page will show when the current version took effect. Material changes may also be highlighted through the website where appropriate.