Biological solutions for a sustainable tomorrow
Last Updated: Sept 23, 2026
Mara Lifesciences Limited ("Mara", "we", "us") is a company registered in Kenya, based in Nairobi, that supplies biopesticides and crop-protection products directly to commercial growers. We are the data controller for the personal data described in this policy.
• Registered address: P.O. Box 40088-00100, Nairobi, Kenya
• Company registration number: PVT-EYUBR5RA
• ODPC registration number: INST-2809629C54B
• Privacy contact / Data Protection Officer: Collins Atai, office@maralifesciences.co.ke
This policy explains how we handle personal data collected through maralifesciences.co.ke, our enquiry and contact forms, email, phone and WhatsApp, and in the course of doing business with growers, suppliers and partners.
We process all personal data in line with the Kenya Data Protection Act, 2019 and the Data Protection Regulations, 2021.
Our website is aimed at businesses. It is not intended for children, and we do not sell products online.
We collect only what we need for the purposes in Section 3.
Category | Examples | Source |
|---|---|---|
| Contact and identity | Name, job title, company or farm name, phone, email, WhatsApp number | You, via forms, email, calls or meetings |
| Business and farm details | Farm location, crops grown, acreage, pest and disease problems, product interests | You, our agronomists during farm visits |
| Transaction and account data | Quotes, orders, invoices, delivery addresses, KRA PIN, payment records (M-Pesa or bank reference, not full card numbers) | You, our sales and accounts teams |
| Communications | Emails, messages, call notes, feedback and complaints | You |
| Technical data | IP address, browser and device type, pages visited, referring site, approximate location | Your device, via cookies and server logs |
| Marketing preferences | Whether you have agreed to receive product updates, and your choices | You |
| Supplier and partner data | Contact details of staff at suppliers, manufacturers and distributors | Those organisations and public sources |
| Job applicants | CV, qualifications, references | You and your referees |
We do not intentionally collect sensitive personal data (such as health, ethnicity, or religion) through the website. Please do not send it to us. If we need it for a specific purpose, such as a job application, we will ask for your explicit consent first.
We process personal data only where the law allows it. The lawful bases below come from Section 30 of the Kenya Data Protection Act.
Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing quotes | Steps before entering a contract; legitimate interests |
| Supplying products, deliveries and invoicing | Performance of a contract |
| Agronomic advice, farm visits and product stewardship | Performance of a contract; legitimate interests in safe, effective use of our products |
| Tax, accounting, PCPB and other regulatory records | Legal obligation |
| Product safety, recalls and adverse-effect reporting | Legal obligation; legitimate interests |
| Sending product updates and technical information | Consent, or legitimate interests for existing business customers (you can opt out at any time) |
| Running, securing and improving the website | Legitimate interests; consent for non-essential cookies |
| Managing suppliers and partners | Performance of a contract; legitimate interests |
| Recruitment | Steps before entering a contract; consent where required |
| Handling complaints and legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing already done.
Direct marketing: we send marketing only in line with Section 37 of the DPA. Every message includes a simple way to opt out, and we stop promptly when you do.
Automated decisions: we do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
Cookies are small files placed on your device when you visit a website. We use strictly necessary cookies without asking, and all other cookies only after you accept them in our cookie banner.
Type | What it does | Consent needed? |
|---|---|---|
| Strictly necessary | Keeps the site secure, remembers your cookie choices, makes forms work | No |
| Analytics | Counts visits and shows which pages are useful, e.g. [Google Analytics] | Yes |
| Functional | Remembers preferences such as language | Yes |
| Marketing | Measures ads or embedded content, e.g. [YouTube, LinkedIn] | Yes |
Cookies we use (replace with your scan results):
Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| CookieConsent | Cookiebot | Stores your cookie consent choices so the banner doesn't reappear | 12 months (confirm in your Cookiebot dashboard once configured) |
| fr, datr | Meta (Facebook & Instagram embeds) | Security and cross-site identification for the embedded Facebook/Instagram content in our footer | Up to ~90 days (approximate – confirm exact values when the consent tool is configured) |
| bcookie, lidc | LinkedIn (embed) | Browser identification and session routing for the embedded LinkedIn content in our footer | bcookie ~30 days; lidc ~24 hours (approximate – confirm via consent tool) |
Your choices: you can accept, reject or customise non-essential cookies in the banner, and change your mind at any time through the [Cookie settings] link in the website footer. You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working.
Where analytics providers are outside Kenya, see Section 6 on international transfers.
We do not sell or rent personal data. We share it only where needed for the purposes in Section 3.
• Service providers (data processors): Website hosting (Webflow); email and office software (Microsoft 365); accounting software (QuickBooks); IT support; couriers and transporters. We do not currently use a separate CRM tool or website analytics — if either is added, this policy will be updated. Providers act only on our written instructions, under contracts that require confidentiality and security, as Section 42 of the DPA requires.
• Manufacturers and principals: where needed for product stewardship, technical support, quality complaints or recalls, we may share limited details with the manufacturer of the product you bought.
• Payment providers and banks: to process and reconcile payments, e.g. Safaricom M-Pesa and our banks.
• Professional advisers: auditors, accountants, lawyers and insurers, under confidentiality duties.
• Authorities and regulators: the Kenya Revenue Authority, the Pest Control Products Board, the ODPC, courts or law enforcement, where the law requires it.
• Business transfers: a buyer or investor in the event of a merger, sale or restructuring, under confidentiality terms.
We share with anyone else only with your consent.
We are based in Kenya, and some of our service providers store data abroad, for example cloud hosting and email in [country]. We transfer personal data outside Kenya only in line with Sections 48 to 50 of the DPA.
We rely on one or more of these safeguards:
• The destination country has adequate data protection, or the transfer meets the ODPC's requirements.
• Written contracts that bind the recipient to appropriate data protection safeguards.
• Your consent, or necessity for a contract with you, where the law allows.
You can ask us for details of the safeguards that apply to your data.
We keep personal data only as long as the purpose requires, then delete or anonymise it, as Section 39 of the DPA require.
Data | Retention period |
|---|---|
| Enquiries that do not lead to business | 2 years after last contact |
| Customer, order and invoice records | 7 years after the transaction (Companies Act, 2015 minimum for accounting records — also covers the 5-year Tax Procedures Act requirement) |
| Product sale and stewardship records | 5 years after sale (confirmed with PCPB) |
| Marketing lists | Until you opt out, or 3 years without engagement |
| Website analytics | Not currently applicable (no analytics in use); 14 months if analytics is introduced |
| Unsuccessful job applications | 6 months, or longer with your consent |
| Security and server logs | 90 days |
We may keep data longer where needed to resolve a dispute, comply with a legal hold, or defend a legal claim.
We store data on secured servers operated by us and our service providers, in [Kenya / other].
We use technical and organisational measures suited to the risk, as Section 41 of the DPA require. They include:
• HTTPS encryption on our website and forms.
• Access controls, so staff see only the data their role needs.
• Strong passwords and multi-factor authentication on email and business systems.
• Encrypted, access-controlled backups.
• Confidentiality commitments and data protection training for staff.
• Written data protection terms with every service provider that handles personal data.
• Regular review of our security and of the processors we use.
Data breaches: if a breach is likely to put your rights at real risk, we notify the ODPC within 72 hours of becoming aware of it (DPA Section 43). Where the risk to you is high, we also tell you directly, without undue delay, with advice on steps you can take.
No internet transmission is completely secure. Please use the contact details below rather than public channels to send us anything confidential.
Under Section 26 of the Kenya DPA, you have the right to:
Right | What it means |
|---|---|
| Be informed | Know how your data is used — this policy does that |
| Access | Get a copy of the personal data we hold about you |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have data deleted when we no longer need it or have no lawful basis |
| Restriction | Ask us to pause use of your data while a concern is resolved |
| Object | Object to processing based on legitimate interests, and to direct marketing at any time |
| Data portability | Receive data you gave us in a common machine-readable format, or have it sent to another organisation |
| Withdraw consent | Withdraw consent at any time where we rely on it |
| Not be subject to automated decisions | Not face decisions made solely by automated means with significant effects |
How to exercise them: email office@maralifesciences.co.ke or write to us at the address in Section 1. We may need to verify your identity first.
We respond to access requests within [7 days, as the Data Protection (General) Regulations, 2021 require], and to other requests as soon as possible and within [the time the Regulations set]. Requests are free unless they are clearly unfounded or excessive.
Some rights have legal limits, for example where we must keep tax records. If we cannot fully meet a request, we will explain why.
Children: our website and services are for businesses. We do not knowingly collect data from anyone under 18. If you believe we have, contact us and we will delete it.
Other websites: our site may link to manufacturers, regulators or social media. Their privacy practices are their own; please read their policies.
Changes to this policy: we review this policy at least once a year. We post updates here with a new "last updated" date, and tell customers directly about significant changes.
Last updated: [date]
Contact us:
• Privacy contact / DPO: Collins Atai
• Email: office@maralifesciences.co.ke
• Phone: +254 717 347 580
• Post: Mara Lifesciences Limited, P.O. Box 40088-00100, Nairobi, Kenya
Complaints: please contact us first so we can try to resolve your concern. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
%201.svg){kind=icon}
