Privacy Policy

1. About This Policy

This Privacy Policy applies to LG-GRAPHICS Kenya Design Studio ("we", "us", or "our"), a professional graphic design and web development company based in Eldoret, Kenya. Our website is located at https://lg-graphics.co.ke.

This policy describes what personal data we collect, why we collect it, how we use it, and your rights regarding your data. By using our website and services, you agree to the practices described in this policy.

2. What Data We Collect

We collect the following categories of personal information:

• Registration Data: Full name, email address, and phone number when you create an account.
• Google Account Data: If you sign in with Google, we receive your Google name, email address, and profile picture. See Section 3 for full details.
• Order Data: Project descriptions, delivery preferences, file uploads (reference materials), and order history.
• Contact Form Data: Name, email, phone number, subject, and message when you contact us.
• Payment Data: Mobile phone number for M-Pesa (Safaricom) payment processing. We do not store credit card numbers.
• Technical Data: IP address, browser type, operating system, pages visited, time spent on pages, and referring URLs — collected automatically via server logs and Google Analytics.
• Cookie Data: Session identifiers and preference cookies to keep you logged in.

4. How We Use Your Data

We use the information we collect for the following purposes:

• To create and manage your account on our platform
• To process and deliver your graphic design and web development orders
• To send you order confirmation, status updates, and completion notifications
• To respond to your contact form inquiries and support requests
• To process payments via M-Pesa
• To improve our website, services, and user experience
• To generate invoices and maintain financial records
• To comply with applicable Kenyan laws and regulations

5. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Safaricom / M-Pesa: Your phone number is shared with Safaricom's payment API to process M-Pesa transactions.
• Google Analytics: Anonymous usage data (pages visited, session duration) is sent to Google Analytics for website performance monitoring. This does not include your name or email.
• Email Provider: Your email address is used to send transactional emails via our SMTP server.
• Legal Compliance: We may disclose your data if required by Kenyan law, court order, or government authority.

6. Data Retention

We retain your personal data for the following periods:

• Account data: For as long as your account is active. You may request deletion at any time.
• Order records: 7 years from completion for legal and accounting compliance.
• Contact form submissions: 2 years.
• Server logs: 90 days.

7. Cookies

We use the following types of cookies:

• Session cookies (essential): Keep you logged in during your visit. These expire when you close your browser.
• Analytics cookies: Google Analytics uses cookies to track anonymous usage patterns.

You can disable cookies in your browser settings. Note that disabling essential cookies will prevent you from logging in.

8. Data Security

We protect your data using the following measures:

• HTTPS / SSL: All data transmitted between your browser and our server is encrypted.
• Password hashing: Passwords are hashed using bcrypt and are never stored in plain text.
• Prepared statements: All database queries use PDO prepared statements to prevent SQL injection.
• Access controls: Admin panel access is restricted to authorised personnel only.

9. Your Rights

Under Kenya's Data Protection Act (2019) and general best practices, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Request that we correct any inaccurate data.
• Deletion: Request that we delete your account and personal data.
• Objection: Object to the processing of your data for certain purposes.
• Portability: Request your data in a machine-readable format.
• Withdraw Consent: Disconnect your Google account or delete your account at any time.

To exercise any of these rights, email us at info@lg-graphics.co.ke with "Privacy Request" in the subject line.

10. Children's Privacy

Our services are not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify registered users by email. Your continued use of our services after changes constitutes acceptance of the updated policy.