Privacy notice

Who we are

Distilled Blue Marketing Ltd, 2nd Floor Pembe Plaza, Industrial Area Off Enterprise Rd, Nairobi, Kenya, is the data controller for the personal data described here. Contact us at sales@dbm.co.ke or +254 741 124 814 for anything about your data.

What we collect

• Enquiries: your name, company, email, phone and the brief you send through our website.
• Clients and suppliers: contact details of the people we work with, company KRA PIN and VAT status, purchase orders, invoices, delivery notes, job cards, site photos, signatures on sign-offs and compliance documents.
• Portal users: name, email, phone, job title, sign-in times and the actions you take, kept in an audit trail.
• Technical data: your IP address, used to protect the site from abuse. We do not use advertising or tracking cookies.

Why we use it and on what basis

• To reply to enquiries and prepare quotations (steps you ask us to take before a contract).
• To deliver projects, place and pay purchase orders and run the client and supplier portals (performance of a contract).
• To issue electronic tax invoices through KRA eTIMS, withhold and remit taxes and keep tax records (legal obligation under the Tax Procedures Act, the VAT Act and the Income Tax Act).
• To keep our systems secure and prevent fraud (legitimate interests).

Who we share it with

Kenya Revenue Authority (eTIMS invoices, withholding returns); Zoho Corporation, which hosts our accounting system (Zoho Books); our website host; our bank and payment providers; professional advisers; and authorities where the law requires. Some providers store data outside Kenya; we use them only with appropriate safeguards as required by the Act.

How long we keep it

Tax and accounting records, including invoices, credit notes, supplier invoices and withholding certificates, are kept for at least five years as required by section 23 of the Tax Procedures Act. Enquiries that do not lead to work are deleted after two years. Portal accounts are disabled when the business relationship ends.

Your rights

You can ask to be informed about how we use your data, to access it, to correct or delete inaccurate or unnecessary data, to object to processing, and to receive a copy in a portable format, subject to our legal duties to keep tax records. Write to sales@dbm.co.ke. If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner.

Security

Portal passwords are stored as one-way hashes, sessions are protected, files are checked when uploaded and stored outside the public website, and access is limited by role. Each company sees only its own records in the client and supplier portals.

Last updated October 2026.