This Privacy Policy explains how Stelcha Dealers K Ltd ("SDL K LTD", "we", "us", "our") handles personal data. It applies to our website, client accounts, and the gold trading, assay testing, safekeeping and logistics services we provide. We process personal data in accordance with the Data Protection Act, 2019 of Kenya and its regulations.
1. Who we are
Stelcha Dealers K Ltd is a private limited company incorporated in Kenya under the Companies Act, 2015 (company number PVT-L51MQB5L), with its registered office at Kipro Centre, Sports Road, Westlands, Nairobi. For the purposes of the Data Protection Act, we are the data controller of the personal data described in this policy, and in some cases also a data processor.
You can contact us about anything in this policy at info@ssckenya.co.ke (subject line: "Data Protection") or on +254 118 789 679.
2. Data we collect
Information you give us
- Identity and contact details: name, email address, phone number, company name, job title and postal address.
- Verification (KYC) documents: national ID or passport, KRA PIN, proof of address, and for companies the certificate of incorporation, CR12 or equivalent, and details of directors and beneficial owners.
- Source-of-funds and source-of-gold information: documents showing where money or gold comes from, such as mining permits, dealer licences and purchase records.
- Transaction details: quote requests, orders, payments, delivery instructions, and the items you submit for testing or storage.
- Account details: login email and password (stored only in encrypted, hashed form) and one-time verification codes.
- Communications: messages you send through our forms, by email or by phone.
Information we generate
- Assay and test results, certificates, TVR (Test Verification Record) and SKR (Safe Keeping Receipt) records.
- Records of the checks we carry out under anti-money laundering law.
Information collected automatically
- IP address, browser type, device information, pages visited and the date and time of visits, recorded in our server logs.
- Information kept in your browser's local storage to keep you signed in (see section 10).
3. How we use your data
- To respond to enquiries and prepare quotes.
- To create and manage your client account.
- To verify your identity and the source of funds or gold, and to meet our obligations under the Proceeds of Crime and Anti-Money Laundering Act, 2009.
- To carry out testing, issue certificates, provide safekeeping, and arrange delivery and insurance.
- To process payments and keep financial and tax records.
- To prepare export and customs documentation under the Mining Act, 2016 and customs law, where you ask us to.
- To send service messages, such as order updates and changes to our terms.
- To keep our website and systems secure, and to detect and prevent fraud.
- To send you news about our products, only where you have agreed to receive it. You can opt out at any time.
4. Legal bases for processing
We only process personal data where the Data Protection Act allows it. Depending on the activity, we rely on:
- Contract — to provide the services you request and take steps before entering into a contract, such as preparing a quote.
- Legal obligation — for identity checks, record keeping, suspicious transaction reporting, tax and export compliance.
- Legitimate interests — for security, fraud prevention, improving our services and defending legal claims, where these interests are not overridden by your rights.
- Consent — for marketing messages and any other use where we ask for it. You may withdraw consent at any time without affecting earlier processing.
Some KYC documents contain sensitive personal data. We process these only as required by law and with additional safeguards.
5. Who we share your data with
We do not sell personal data. We share it only where necessary, with:
- Service providers who host our website and systems, send email, and provide IT support, under contracts that require them to protect it.
- Logistics, security and insurance partners who transport, insure or store gold on your behalf.
- Refiners and partner laboratories where a lot is sent for refining or independent testing.
- Banks and payment providers handling your payments.
- Regulators and authorities — including the Financial Reporting Centre, the ministry responsible for mining, the Kenya Revenue Authority, and law enforcement — where the law requires it.
- Professional advisers such as auditors and lawyers, under a duty of confidentiality.
- A buyer or successor of our business, if it is reorganised or sold, subject to this policy.
Under anti-money laundering law we may be prohibited from telling you that a report has been made about a transaction.
6. International transfers
Some of our service providers, and some logistics and refining partners, are located outside Kenya. When personal data is transferred abroad, we do so only as permitted by the Data Protection Act — for example where the recipient country provides adequate protection, where appropriate contractual safeguards are in place, or where the transfer is necessary to perform a contract with you, such as delivering an international shipment.
7. How long we keep your data
- KYC and transaction records: for the period required by anti-money laundering law — generally at least seven years after the end of the business relationship or transaction.
- Accounting and tax records: for the period required by Kenyan tax law.
- Assay certificates, TVR and SKR records: for as long as the related item is held or traded, and afterwards for the periods above.
- Enquiries that do not lead to a transaction: up to 24 months, unless you ask us to delete them sooner.
- Server logs: up to 12 months.
When data is no longer needed, we delete or anonymise it securely.
8. Security
We use technical and organisational measures appropriate to the sensitivity of the data, including encrypted connections, hashed passwords, access controls limited to staff who need the data, one-time codes for account verification, and physical security for paper records. No system is completely secure; if a breach occurs that is likely to put your rights at risk, we will notify the Office of the Data Protection Commissioner and, where required, you.
9. Your rights
Under the Data Protection Act, you have the right to:
- Be informed about how your data is used.
- Access the personal data we hold about you.
- Have inaccurate or misleading data corrected.
- Have data deleted where we no longer have a lawful reason to keep it.
- Object to processing, including for direct marketing.
- Receive your data in a portable format where applicable.
- Not be subject to decisions based solely on automated processing that significantly affect you.
To exercise a right, email info@ssckenya.co.ke. We will need to confirm your identity and will respond within the time set by law. Some rights are limited where we must keep data to comply with the law — for example, we cannot delete KYC records before the legal retention period ends.
If you are unhappy with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). We would appreciate the chance to resolve your concern first.
10. Cookies and local storage
We do not use advertising or cross-site tracking cookies. Our website uses:
- Local storage in your browser to keep you signed in to your client account. It is removed when you log out.
- A session cookie set by our server to keep requests secure while you use the site.
Our pages load scripts and images from third-party content delivery networks. When your browser requests these files, the provider receives your IP address and browser details as part of the normal operation of the internet. These providers do not receive the information you enter into our forms.
11. Children
Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it was last changed. If we make significant changes, we will notify account holders by email or on the website.
Stelcha Dealers K Ltd
Kipro Centre, Sports Road, Westlands
P.O. Box 17311-00100, Nairobi, Kenya
Email: info@ssckenya.co.ke
Phone: +254 118 789 679