Privacy Policy

1. Who we are and what this notice covers

This notice is issued by EL ASHIB Global Integrated Projects Limited, trading as EL ASHIB Global (the full name is a working name pending registration confirmation). It applies to this website at https://elashibglobal.com and its www variant, including the enquiry form, the Project Advisor, the published project and property pages and the signed-in client portal.

We are responsible for the personal information the website collects for our own enquiry and client-management purposes. The notice covers visitors, prospective clients and account holders, and is guided by the Kenya Data Protection Act, 2019 together with any other data protection requirements that apply to you. A separate engagement may come with additional privacy information.

The quickest way to reach us about privacy is info@elashibglobal.com. Phone and office details are not published on this website at present, so written contact is the reliable route.

2. Information we collect

• Enquiries: the name, email address, phone number, country, selected service, project location, project type, budget range, timeline and message you type into the enquiry form, plus confirmation that you consented to us using the details to reply. The form also carries a hidden field left blank by people and filled in by most automated scripts; we use it only to reject bot submissions.
• Accounts: your sign-in email address, account identifier, authentication details and, where you choose Google or Lovable sign-in, the account information those services pass to confirm who you are. Passwords are processed by the authentication service and are not shown to company staff.
• Client records: email-based access assignments made by an administrator, your enquiries, and the project, property, photo, status and follow-up records attached to an engagement.
• Project Advisor: the project description and any location, budget or timeline you enter, together with the service suggestions and enquiry draft generated from it.
• Portfolio photos: images uploaded for a project or property record, stored privately until that record is published.
• Technical information: our hosting, authentication and storage providers may process IP addresses, browser and device details, request times, session identifiers and diagnostic information needed to deliver and secure the website.

Please do not send identity documents, bank details, title deeds, passwords, sensitive employee records or unnecessary information about other people. Obtain appropriate permission before sharing another person's information or identifiable photographs.

3. Purposes and lawful grounds

We use your information to answer enquiries, discuss the services you ask about, take steps towards an engagement, administer agreed work, authenticate accounts and show clients the records assigned to them. We also use relevant information to block spam and abusive submissions, prevent unauthorized access, resolve disputes and meet legal obligations.

Depending on the purpose, processing relies on your consent, on steps taken at your request before entering a contract or the performance of a contract, on applicable legal obligations, or on legitimate interests such as securing the site and managing communications, balanced against your rights and expectations. Where we rely on consent you may withdraw it without affecting processing that already happened lawfully. If you do not provide the information an enquiry or account needs, that function will not work.

4. Project Advisor and AI processing

Using the Project Advisor sends what you type to Lovable AI Gateway and its model provider so the service can suggest relevant services and produce an editable enquiry draft. Do not include confidential or sensitive material. AI providers process request information under their own service terms; we do not promise zero provider retention or that prompts are never logged.

The advisor never submits an enquiry for you. When you choose to continue to the enquiry form, the draft is placed temporarily in your browser's session storage under the name elashib-advisor-draft and removed once the form reads it. You decide whether to edit and send it. Recommendations are informational, can be wrong and are not decisions that determine your eligibility, contractual rights or pricing.

5. Sharing and access

Enquiries, accounts and portfolio records are supported by Lovable Cloud. Hosting, authentication, storage and AI providers handle the information needed to deliver those services. Google and Lovable also process information when you pick their sign-in options, under their own privacy notices.

Authorized company administrators can review enquiries and internal follow-up notes. Signed-in clients see only the records assigned to their confirmed email address, and the client enquiry view deliberately excludes contact fields and internal notes. Public project and property pages show only published entries and their photos, and each photo is served through a short-lived private link that stops working about an hour after the page loads, so published images are not permanently addressable. Do not supply images or descriptions for publication without permission.

Information may also be shared with qualified providers where necessary for work you ask for, with professional advisers, or with authorities where the law requires it. We do not sell personal information. Submitting an enquiry stores it for follow-up; it does not automatically send you an email confirmation or an invitation to the client portal.

6. How we secure information and handle incidents

Enquiry submission runs through a database function that validates the entry, rejects bot submissions and limits each email address to three enquiries in any hour. Records are held in a private database with row-level access rules, so a signed-in client can read only what an administrator assigned to their confirmed email. Portfolio photos sit in a private store and are reached through short-lived signed links rather than public addresses. Staff tools are limited to confirmed administrator accounts, and public pages read only published entries through a restricted service path.

No online service is completely secure. If an incident occurs that is likely to result in a risk to your rights and freedoms, we commit to notifying affected individuals and, where required, Kenya's Office of the Data Protection Commissioner without undue delay, describing the nature of the incident, the information involved, the likely consequences and the steps we are taking. Keep your sign-in details private, sign out on shared devices, and tell us promptly if you think your account or an enquiry you sent may have been exposed.

7. Communication preferences

We use the contact details you give us to reply to your enquiry, discuss the work you ask about and, where you hold an account, to tell you about access to your records. If you provide a phone number we may call or message you about the enquiry; WhatsApp is used only where you share a number for it and it is the practical way to reach you.

We do not currently run a marketing newsletter or promotional mailing list from this website, and we do not add you to anything by accepting an enquiry. If you would rather be reached by one method, or not contacted except when you write to us first, tell us in the enquiry or in a later email and we will record and respect that. You can ask us to stop any follow-up at any time; that does not remove records we need to keep for an engagement or the law.

8. International processing

Our service providers may process information outside Kenya. Transfers must comply with applicable Kenyan requirements, including appropriate safeguards or another legally permitted basis where required. Ask us about the safeguards relevant to your information; this notice does not assert a particular hosting country or a certification we do not hold.

9. How long information is kept

There is no single fixed retention period for website records and no automatic expiry is currently configured for enquiries, accounts or portfolio entries. Retention depends on the enquiry or engagement, account administration, legal record-keeping requirements and the need to resolve disputes. We aim to keep personal information only as long as those purposes need and to delete or anonymize it when it is no longer required.

You can request deletion or ask how long a particular record is held. Legal obligations or an outstanding claim may require some records to be kept. Removing a record from active use may not immediately remove provider logs or backups, which follow the provider's own arrangements.

10. Your rights and complaints

Subject to applicable law, you may ask what we process, request access, ask for inaccurate information to be corrected, ask for false or misleading information to be deleted, and object to processing. Where applicable you may also request erasure, restriction or a portable copy, and withdraw consent where consent is the basis.

Write to the email below and describe your request. We may verify your identity proportionately before disclosing or changing data; please do not email identity documents unless a secure verification arrangement has been agreed. We will respond within the timeframes the applicable law allows.

You can raise a concern with us first or lodge a complaint with Kenya's Office of the Data Protection Commissioner (ODPC).

11. Children, browser storage and updates

The enquiry and account services are intended for adults and are not directed at children. Contact us if a child has provided personal information without an appropriate basis so we can deal with it.

We do not add advertising or optional analytics trackers to this website. Essential sign-in storage, the short-lived photo links and the temporary advisor draft are listed in our Cookies Policy. We update this notice when our services or legal requirements change; the date above identifies the current version.