About This Document
These Terms and Conditions, together with our Privacy Policy, form a legally binding agreement between you (“you,” “user,” or “data subject”) and Cadreatech Engineering Services Ltd. (“Cadreatech,” “we,” “us,” or “our”).
This document applies to:
- All visitors to cadreatech.com and any of its sub-pages
- All persons who contact us through our website, email, telephone, or in person
- All persons who engage us to provide professional engineering and consultancy services
- All persons who subscribe to our marketing communications, newsletter, or educational materials
This document is prepared in compliance with the Kenya Data Protection Act No. 24 of 2019, the Data Protection (General) Regulations 2021, Article 31 of the Constitution of Kenya 2010 (right to privacy), and other applicable Kenyan laws governing commercial transactions and professional services.
Who We Are
Cadreatech Engineering Services Ltd. is a full-service engineering consultancy firm and operating in Kenya. We provide structural engineering, architectural design, civil engineering, geotechnical investigations, MEP (mechanical, electrical, and plumbing) engineering, quantity surveying, project management, and related professional services.
- Registered Name: Cadreatech Engineering Services Limited.
- Registration: Professionals registered by the Board of Registration of Architects and Quantity Surveyors (BORAQS) and/or the Engineers Board of Kenya (EBK)
- Physical Address: Piedmont Plaza, Ngong Road, Nairobi, Kenya
- Telephone: 0719 532 233
- Email: info@cadreatech.com
- Website: cadreatech.com
As a data controller, Cadreatech determines the purposes and means by which personal data submitted through our website and service interactions is processed. As a data processor, we may also process personal data on behalf of our clients in the course of delivering project management and supervision services.
Use of Our Website
3.1 Permitted Use
You may access and use cadreatech.com for the purposes of:
- Learning about our engineering and consultancy services
- Reviewing our project portfolio and published resources
- Using our publicly available engineering tools and calculators
- Contacting us for a professional quotation or consultation
- Accessing educational content about construction and engineering in Kenya
3.2 Prohibited Use
You must not use this website to:
- Copy, reproduce, republish, or redistribute our content without prior written permission
- Introduce viruses, malware, or any code that may damage our systems or data
- Attempt to gain unauthorised access to any part of our website or systems
- Use automated tools to scrape, harvest, or extract data from our website
- Transmit unsolicited commercial communications (spam) through our contact forms
- Engage in any activity that violates Kenyan law, including the Computer Misuse and Cybercrimes Act No. 5 of 2018
3.3 Website Availability
We aim to keep cadreatech.com accessible at all times, but we do not guarantee uninterrupted availability. We reserve the right to suspend, modify, or discontinue any part of our website without prior notice for maintenance, security, or operational reasons.
3.4 Accuracy of Information
The information published on our website is provided for general informational purposes. While we strive for accuracy, engineering decisions must be made only in consultation with registered professionals. Content on our website does not constitute professional advice unless it is contained in a formal written engagement agreement.
3.5 Third-Party Links
Our website may contain links to external websites, including regulatory bodies such as the National Construction Authority (nca.go.ke) and the National Environment Management Authority (nema.go.ke). These links are provided for your convenience only. Cadreatech is not responsible for the content, privacy practices, or availability of any third-party websites.
Our Services and Professional Engagements
4.1 Nature of Services
Cadreatech provides professional engineering consultancy and management services. All services are delivered by or under the direct supervision of professionals registered with the relevant regulatory bodies in Kenya (EBK and BORAQS).
4.2 Service Agreements
All professional engagements are governed by a written service agreement between Cadreatech and the client. The following terms apply to all engagements:
- Scope of work, deliverables, and timelines will be clearly defined in a written agreement or letter of engagement before work commences
- Cadreatech’s professional fees are generally calculated at approximately 5% of the total project construction cost, subject to the specific services engaged and as agreed in writing
- Fees are payable in accordance with the schedule set out in the service agreement
- Any changes to the agreed scope of work must be agreed upon in writing by both parties
- Cadreatech’s professional opinions and designs are based on information provided by the client. We are not liable for errors arising from inaccurate or incomplete information provided by you
4.3 Client Responsibilities
In engaging Cadreatech, the client agrees to:
- Provide accurate, complete, and timely information relevant to the project
- Obtain all necessary permissions, consents, and approvals from landowners and relevant authorities where required
- Make payment of agreed fees in accordance with the agreed schedule
- Not engage any other consultant on the same scope of works during the period of our engagement without prior written notice
4.4 Regulatory Compliance Advice
Cadreatech provides guidance on construction approvals and regulatory compliance in Kenya. However, it remains the client’s ultimate responsibility to ensure that their project complies with all applicable laws, county regulations, and planning requirements. Our guidance does not substitute for legal advice.
4.5 Quotations and Estimates
Construction cost estimates, Bills of Quantities, and project budget projections provided by Cadreatech are professional estimates based on available information and prevailing market rates. Actual costs may vary. Cadreatech is not liable for cost overruns arising from changes in market conditions, contractor pricing, or unforeseen site conditions, unless caused directly by professional negligence on our part.
Intellectual Property
All content on cadreatech.com, including but not limited to text, articles, blog posts, engineering tools, calculators, calculators, images, graphics, logos, and the overall design of the website, is the intellectual property of Cadreatech Engineering Services Ltd. and is protected under applicable Kenyan and international intellectual property law.
5.1 Website Content
- You may not copy, reproduce, republish, distribute, or exploit any content from this website for commercial purposes without our express prior written consent
- You may share links to our blog articles and resources provided that you credit Cadreatech Engineering Services Ltd. as the source and do not modify the content
- Our engineering tools and calculators are provided for informational purposes only and must not be used as a substitute for professional engineering analysis
5.2 Engineering Deliverables
- Engineering drawings, reports, designs, and calculations produced by Cadreatech for a specific client engagement remain the intellectual property of Cadreatech until full payment of professional fees is received
- Upon full payment, the client receives a licence to use the deliverables for the specific project purpose described in the engagement agreement
- Cadreatech retains the right to use anonymised versions of project data and imagery for portfolio and marketing purposes, unless the client expressly requests confidentiality in writing
Personal Data We Collect
In compliance with Section 26 of the Kenya Data Protection Act 2019, we are required to inform you of the personal data we collect before or at the time of collection. The following describes what we collect and why.
Contact Information
- Full name
- Email address
- Phone number(s)
- Physical / postal address
- Country of residence
Project Information
- Project location / county
- Type of construction
- Land ownership details
- Budget estimates provided
- Project timeline requirements
Communication Records
- Emails and messages sent to us
- Telephone call records
- Contact form submissions
- Enquiry content and attachments
Website Usage Data
- IP address
- Browser type and version
- Pages visited
- Time and date of visit
- Referring URLs
Client / Engagement Data
- ID / KRA PIN (for formal contracts)
- Payment and invoice records
- Signed agreements
- Project correspondence
Marketing Preferences
- Consent records
- Communication preferences
- Unsubscribe requests
- Content interaction data
6.1 How We Collect This Data
We collect your personal data through the following means:
- Directly from you: When you fill in a contact form, request a quotation, send us an email, call us, or engage our services
- Automatically: Through cookies and web analytics tools when you browse cadreatech.com (see Section 14 on Cookies)
- Through professional engagement: During the course of delivering agreed services, including site visits, meetings, and project correspondence
- From publicly available sources: For business development purposes only, such as from professional directories or publicly available contact information
6.2 Data Minimisation
In accordance with the data minimisation principle under Section 25(c) of the Data Protection Act, we only collect personal data that is adequate, relevant, and limited to what is necessary for the purpose for which it is being processed. We do not collect sensitive personal data (such as health information, ethnic origin, or biometric data) unless it is directly necessary for the services you have engaged us to provide.
6.3 Voluntary Provision
Providing your personal data to us is generally voluntary. However, if you choose not to provide certain information (such as your contact details or project details), we may not be able to respond to your enquiry or provide the services you are requesting.
How We Use Your Personal Data
We use the personal data we collect for the following specific purposes, each of which is carried out on a lawful basis as required by Section 30 of the Kenya Data Protection Act 2019:
7.1 Responding to Your Enquiries
When you contact us through our website, email, or phone, we use your name and contact details to respond to your enquiry and provide you with the information or quotation you have requested. Legal basis: Legitimate interest and/or pre-contractual steps at your request.
7.2 Providing Professional Services
When you engage Cadreatech for a professional project, we use your contact and project information to deliver the agreed scope of services, prepare drawings and documents, coordinate approvals, and manage the project. Legal basis: Performance of a contract.
7.3 Billing and Payments
We use your contact and financial information to issue invoices, process payments, and maintain accounting records as required by Kenyan law. Legal basis: Legal obligation and performance of a contract.
7.4 Regulatory and Legal Compliance
We may be required by law, court order, or regulatory authority (such as the Kenya Revenue Authority, EBK, or BORAQS) to process and disclose certain client information. Legal basis: Legal obligation.
7.5 Improving Our Website and Services
We use anonymised and aggregated website usage data to improve the performance, content, and usability of cadreatech.com. Legal basis: Legitimate interest.
7.6 Marketing and Educational Communications
Where you have given us your express consent, we use your contact information to send you marketing materials, construction guides, blog article updates, and educational content about engineering and construction in Kenya. This is described in full in Section 8 below. Legal basis: Consent.
7.7 Business Development and Portfolio
We may use anonymised and non-personally identifying project information for the purposes of our professional portfolio, case studies, and industry publications. We will never identify you or your project by name in public materials without your prior written consent. Legal basis: Legitimate interest, subject to your rights.
Marketing Communications and Your Consent
Cadreatech values your inbox. We use data collected from our website and service enquiries to keep our clients and interested parties informed with genuinely useful content related to construction, engineering, and property development in Kenya.
8.1 How We Obtain Consent
In compliance with Section 32 of the Kenya Data Protection Act 2019 and Regulation 14 of the Data Protection (General) Regulations 2021, we obtain your consent for marketing communications through:
- A clearly labelled, unticked checkbox on our website contact and enquiry forms — you must actively tick this box to consent. We do not use pre-ticked boxes, implied consent, or opt-out mechanisms as the basis for our initial marketing consent
- A clear statement next to the checkbox explaining exactly what types of communications you will receive
- Separate consent fields for email marketing and SMS marketing where applicable
8.2 Your Right to Withdraw Consent (Opt Out)
Your consent to receive marketing communications is entirely voluntary and can be withdrawn at any time, at no cost to you, in accordance with Section 32(2) of the Kenya Data Protection Act 2019. You may opt out by:
- Clicking the “Unsubscribe” link included at the bottom of every marketing email we send you
- Replying “STOP” to any marketing SMS we send you
- Emailing us at info@cadreatech.com with the subject line “Unsubscribe”
- Calling us on 0719 532 233 during business hours (Monday to Friday, 8:00 AM – 5:00 PM)
Upon receiving your opt-out request, we will process it within 7 business days in accordance with Regulation 17(3) of the Data Protection (General) Regulations 2021. You may continue to receive transactional or service-related communications (such as project updates, invoices, or approval notices) even after opting out of marketing communications, as these are not marketing in nature.
⚠ Important Distinction
Opting out of marketing communications does not cancel or affect your existing service agreement with Cadreatech. You will continue to receive all project-related and contractual communications that are necessary to fulfil the service you have engaged us to provide.
8.3 Record of Consent
We maintain a record of your consent, including the date, time, and method through which consent was obtained, in compliance with our obligations as a data controller under the Kenya Data Protection Act 2019. If you request to see your consent record, we will provide this to you within 21 days.
8.4 Frequency of Communications
We aim to send marketing communications no more frequently than:
- One to two email newsletters per month
- Occasional SMS notifications for significant updates or events
- Weekly blog post notifications if you subscribe to our blog updates
We do not sell or rent your contact information to any third party for their marketing purposes. You will only receive marketing communications from Cadreatech Engineering Services Ltd. directly.
Legal Basis for Processing Personal Data
Under Section 30 of the Kenya Data Protection Act 2019, we are required to process your personal data on a lawful basis at all times. The following table summarises the lawful bases we rely on for each category of processing:
| Processing Purpose | Lawful Basis | DPA Reference |
|---|---|---|
| Responding to your website enquiry | Legitimate interest; pre-contractual steps | S.30(b)(ii), S.30(b)(vii) |
| Delivering professional services under a contract | Performance of a contract | S.30(b)(ii) |
| Invoicing and payment processing | Performance of a contract; legal obligation | S.30(b)(ii), S.30(b)(iii) |
| Compliance with Kenyan law and regulations | Legal obligation | S.30(b)(iii) |
| Sending marketing and educational communications | Consent (express opt-in) | S.30(a), Reg. 14 |
| Website analytics and improvement | Legitimate interest (anonymised) | S.30(b)(vii) |
| Defending legal claims | Legal obligation; legitimate interest | S.30(b)(iii), S.30(b)(vii) |
We do not rely on consent as the basis for processing personal data that is strictly necessary for the delivery of contracted services. Where we rely on legitimate interest as our lawful basis, we have carried out a balancing assessment to ensure that our interest does not override your fundamental rights and freedoms.
Your Rights as a Data Subject
Under the Kenya Data Protection Act 2019, you have the following enforceable rights in respect of your personal data. These rights are yours by law and can be exercised at any time at no cost to you.
| Your Right | What This Means |
|---|---|
| Right to be Informed Section 26 |
You have the right to know what personal data we hold about you, why we hold it, how it is used, and who it is shared with. This Policy satisfies this obligation. |
| Right of Access Section 26(a) |
You may request a copy of the personal data we hold about you. We will respond within 21 days and provide it in a clear, readable format. |
| Right to Rectification Section 26(b) |
If any personal data we hold about you is inaccurate, incomplete, or outdated, you have the right to request that we correct it. We will act on your request within 14 days. |
| Right to Erasure Section 26(d) |
You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn consent, or where processing is unlawful. We will respond within 14 days. Note: We may be required to retain certain data under Kenyan law (e.g. tax and accounting records). |
| Right to Object Section 26(f) |
You may object to the processing of your personal data, including for direct marketing purposes. Where you object to direct marketing, we will cease processing for that purpose immediately. |
| Right to Restrict Processing Section 34 |
You may request that we restrict how we use your personal data in certain circumstances — for example, while we verify the accuracy of the data you have disputed. |
| Right to Data Portability Section 38 |
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another data controller where technically feasible. |
| Right to Withdraw Consent Section 32(2) |
Where processing is based on your consent (e.g. for marketing), you may withdraw that consent at any time without any negative consequences. Withdrawal does not affect the lawfulness of processing before the withdrawal. |
How to Exercise Your Rights
To exercise any of these rights, please contact us using the details in Section 21. We will not charge you for making a rights request. We will respond to all requests within 21 days of receipt, or sooner where required by the Data Protection Act. In complex cases, we may extend this period by a further 21 days but will notify you of any extension.
If we are unable to fulfil your request (for example, because of a legal obligation to retain the data), we will inform you of the reason in writing and advise you of your right to complain to the Office of the Data Protection Commissioner (ODPC).
Data Sharing and Third Parties
We treat your personal data with strict confidentiality. We do not sell, rent, or trade your personal data to third parties for commercial purposes.
11.1 When We May Share Your Data
We may share your personal data with the following categories of third parties only where necessary and only to the extent necessary:
- Service delivery partners: Sub-consultants (e.g. licensed EIA practitioners, surveyors, or specialist engineers) engaged to assist in delivering your specific project. These partners are bound by confidentiality obligations and may only use your data as directed by Cadreatech
- Regulatory bodies: Where we are required to submit your information to county governments, the National Construction Authority (NCA), the National Environment Management Authority (NEMA), or other statutory bodies as part of the approvals process for your project
- Technology service providers: Third-party tools we use to operate our website, email marketing, and client management systems (such as email hosting providers or website analytics platforms). These providers are contractually bound to handle your data securely and only as instructed by us
- Legal and accounting professionals: Our lawyers and accountants, where disclosure is necessary for professional advice, tax compliance, or legal proceedings
- Law enforcement and courts: Where we are required to disclose your information by Kenyan law, court order, or lawful government authority
11.2 What We Do Not Do
- We do not sell your personal data to any third party
- We do not share your personal data with other companies for their own marketing purposes
- We do not share your project information, financial details, or personal data with any third party without a specific, lawful basis for doing so
11.3 Third-Party Safeguards
Where we engage third-party service providers who process your personal data on our behalf, we ensure that appropriate data processing agreements are in place, as required by Regulation 22 of the Data Protection (General) Regulations 2021. These agreements require third-party processors to implement appropriate technical and organisational security measures and to process your data only on our instructions.
Data Retention
In accordance with Section 39 of the Kenya Data Protection Act 2019, we retain your personal data for no longer than is reasonably necessary for the purposes for which it was collected.
| Type of Data | Retention Period | Reason |
|---|---|---|
| Website enquiry / contact form data (not converted to a client) | 12 months | To follow up on your enquiry and for business records |
| Client project files and correspondence | 7 years after project completion | Professional liability and Kenyan tax / accounting law requirements |
| Invoices and financial records | 7 years | Kenya Revenue Authority requirements (Income Tax Act) |
| Marketing consent records | Duration of consent + 3 years after withdrawal | To demonstrate compliance with DPA consent requirements |
| Marketing communications (email subscribers) | Until you unsubscribe, plus 6 months | Legitimate interest in business communication |
| Website analytics data (anonymised) | 24 months | Website improvement and performance monitoring |
At the end of the applicable retention period, personal data is securely deleted or anonymised so that it can no longer be linked to you. If you request deletion of your data before the retention period has expired, we will inform you whether we are able to comply and the reason for any retention that must continue.
Data Security
Cadreatech takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, alteration, disclosure, or destruction, in accordance with Section 41 of the Kenya Data Protection Act 2019 and Section 42 on organisational measures.
Technical Measures
- Our website uses HTTPS (TLS encryption) to protect data transmitted between your browser and our servers
- Access to client data systems is restricted to authorised Cadreatech personnel only
- We use password-protected and access-controlled systems for storing client files and project documents
- Regular security assessments of our systems and platforms
Organisational Measures
- Internal data handling procedures and confidentiality obligations for all staff and associates
- Physical access controls for our office premises
- Contractual data protection obligations for third-party service providers
Limitations
No system is completely immune to security risks. While we take all reasonable precautions, we cannot guarantee absolute security of data transmitted over the internet. You submit data to us at your own risk. In the event of a data breach affecting your rights and freedoms, we will notify you within 72 hours of becoming aware of the breach, as required by the Kenya Data Protection Act.
Cookies and Website Tracking
Our website uses cookies and similar tracking technologies to improve your browsing experience and to understand how visitors use our website. In Kenya, cookies that collect personal data are subject to the Data Protection Act 2019, and where cookies are used for commercial or direct marketing purposes, the restrictions on commercial use of personal data under Regulation 13 and 14 of the Data Protection (General) Regulations 2021 apply.
Types of Cookies We Use
- Strictly necessary cookies: Essential for the website to function. These cannot be switched off. They do not collect personal data in a form that can be used for marketing.
- Analytics cookies: Used to understand how visitors interact with our website (e.g. Google Analytics). This data is aggregated and anonymised. You may opt out by adjusting your browser settings.
- Marketing / targeting cookies: Used only where you have given prior consent. These may track your browsing to serve relevant advertisements or personalise content.
- Functionality cookies: Allow the website to remember your preferences (e.g. language, form data) to improve your experience.
Managing Your Cookie Preferences
You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit www.aboutcookies.org.
Cross-Border Data Transfers
Some of the third-party tools and platforms we use to operate our business (such as email marketing platforms or cloud storage providers) may store or process data outside of Kenya. In accordance with Section 49 of the Kenya Data Protection Act 2019, we will only transfer your personal data outside Kenya where:
- The destination country has adequate data protection safeguards in place that are comparable to the Kenya Data Protection Act
- We have put in place appropriate safeguards such as data processing agreements with the recipient
- You have explicitly consented to the transfer and have been informed of any risks associated with it
- The transfer is necessary for the performance of our contract with you or for taking pre-contractual steps at your request
We do not transfer sensitive personal data outside of Kenya without your explicit prior consent.
Children’s Privacy
Our website and services are not directed at individuals under the age of 18 years. In accordance with Section 33 of the Kenya Data Protection Act 2019, we do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has submitted personal data to us without your consent, please contact us immediately at info@cadreatech.com and we will delete that information promptly.
Where a minor has an interest in a property development project (for example, as a beneficiary), all data collection and consent must be handled by a parent, guardian, or legally authorised representative with parental authority over the minor.
Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Cadreatech is obligated under the Kenya Data Protection Act 2019 to:
- Notify the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware of the breach
- Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms
Our breach notification to you will include:
- A description of the nature of the breach
- The categories and approximate number of data subjects and records affected
- The likely consequences of the breach
- The measures we have taken or propose to take to address the breach and mitigate its effects
- The contact details of our data protection contact for further information
Notifiable breaches include, but are not limited to, breaches involving your name, passwords, identification numbers, health information, or security codes.
Limitation of Liability
To the fullest extent permitted by Kenyan law:
- Cadreatech’s liability for any claims arising from the use of this website is limited to direct damages only and excludes any indirect, incidental, consequential, or special damages
- Cadreatech is not liable for any loss or damage resulting from your reliance on information published on this website without engaging our professional services under a formal written agreement
- Our liability to you in connection with any specific professional engagement is limited to the total fees paid by you to Cadreatech for that specific engagement, except in cases of gross negligence or wilful misconduct
- Nothing in these terms limits our liability for death or personal injury caused by our negligence, or for fraud or fraudulent misrepresentation
These limitations do not affect any of your statutory rights under Kenyan consumer protection law or any other rights that cannot be excluded by law.
Governing Law and Dispute Resolution
These Terms and Conditions and Privacy Policy are governed by and construed in accordance with the laws of Kenya, including:
- The Data Protection Act No. 24 of 2019
- The Data Protection (General) Regulations 2021
- The Constitution of Kenya 2010
- The Contract Act, Cap 23 of the Laws of Kenya
- The Computer Misuse and Cybercrimes Act No. 5 of 2018
Any dispute arising out of or in connection with these terms shall first be referred to negotiation between the parties in good faith. If the dispute cannot be resolved through negotiation within 30 days, it shall be referred to mediation or arbitration in Nairobi, Kenya, in accordance with applicable Kenyan law. The courts of Kenya shall have non-exclusive jurisdiction over any disputes that cannot be resolved through alternative dispute resolution.
Complaints to the ODPC
If you believe that Cadreatech has violated your data protection rights under the Kenya Data Protection Act 2019, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). You can contact the ODPC at:
- Website: www.odpc.go.ke
- Email: info@odpc.go.ke
- Telephone: +254 20 264 0000
We encourage you to contact us first to try to resolve any data protection concerns before escalating to the ODPC.
Changes to This Policy
We reserve the right to update, amend, or replace any part of these Terms and Conditions and Privacy Policy at any time to reflect changes in our services, legal requirements, or data protection obligations. The most current version will always be published at cadreatech.com/terms-and-conditions.
Where changes are material — particularly changes to how we use your personal data or your rights — we will notify you by:
- Posting a prominent notice on our website
- Sending an email notification to active subscribers or clients if we hold your email address
Continued use of our website or engagement of our services after the effective date of any changes constitutes your acceptance of the updated terms. The date of the most recent revision is shown in the header of this document.
Current Version: Version 1.0 | Effective Date: March 2026 | Next Scheduled Review: March 2027
Contact Us and Data Protection Enquiries
For all data protection enquiries, rights requests, consent withdrawals, or complaints, please contact us using the details below. We are committed to responding promptly and in full compliance with the Kenya Data Protection Act 2019.
Cadreatech Engineering Services Ltd.
Data Protection Contact
📍 Piedmont Plaza, Ngong Road, Nairobi, Kenya
Business Hours: Monday – Friday, 8:00 AM – 5:00 PM EAT
For complaints to the regulatory authority:
- Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke
