LushBert

Privacy Policy

Last updated: 29 October 2026

Who we are

The controller for lushbert.com is LUSH BERT LTD, a private limited company in Kenya, at Lush Farms, Mau Mau Road, Lari, Kiambu County, P.O. Box 1369 – 00621 Village Market, Kenya. Email: [email protected].

We process personal data under Kenya's Data Protection Act 2019. For visitors from the EU, our legal basis is Art. 6(1)(f) GDPR: our legitimate interests in operating and securing this website, responding to enquiries and improving its content, balanced against visitors' rights.

Hosting and server logs

Cloudflare, Inc. hosts and delivers this website. When you request a page or file, Cloudflare processes technical connection data, including your IP address, request time, requested URL, browser information and response status, to deliver content, maintain security and diagnose faults. This is separate from our audience counter, which does not store IP addresses.

Email contact

If you email us, we process your email address, message and any information or attachments you provide to respond and handle your enquiry. Please send only the personal information needed for that purpose.

Anonymous audience measurement (own counter, no cookies)

To improve our website we record which pages and sections are viewed, how long they are visible, how far visitors scroll and which elements are used (e.g. downloads and contact links). We also process the referring site (domain only), campaign tags in the link (utm parameters), country (derived from the network connection), device type, browser, operating system and browser language.

We do not store IP addresses, do not set cookies and store nothing on your device. To group visits within one day we derive a non-reversible checksum from IP address and browser identifier combined with a random value that changes daily; this value is deleted no later than the day after next, after which no linkage is possible. If your browser sends an opt-out signal (Global Privacy Control or "Do Not Track"), your visit is not recorded; you may also object to this processing at any time (Art. 21 GDPR). Form contents or questions are never transmitted by this counter.

Processing takes place on servers of Cloudflare, Inc. (database in Western Europe) based on our legitimate interest in designing the website according to visitors' needs (Art. 6(1)(f) GDPR). A data processing agreement with Cloudflare is in place; transfers to the USA are covered by the EU-US Data Privacy Framework or standard contractual clauses. Raw data are deleted after 13 months; afterwards only aggregated monthly figures without personal reference remain.

YouTube links and thumbnails

Some pages display thumbnails loaded from img.youtube.com. Loading these images sends your IP address and technical request data to Google/YouTube, even before you click a video link. Videos open on YouTube when clicked; no YouTube player is embedded in our pages. YouTube then processes data under Google's privacy policy.

Fonts

Our shared stylesheet loads fonts from Google Fonts. Your browser connects to Google to retrieve them, transmitting your IP address and technical request data. See Google Fonts privacy information.

PDF downloads

PDFs are served from this website without registration. Download requests involve the hosting data described above, and download-link use may be counted by our audience measurement. If you complete a downloaded form and email it to us, we process the information you send as part of your enquiry.

Retention

Audience measurement raw data are deleted after 13 months; only aggregated monthly figures without personal reference remain. We keep email enquiries only as long as needed to handle them and meet applicable legal retention duties. Hosting logs are retained under Cloudflare's applicable service and security retention settings for delivery, security and troubleshooting.

Your rights

Subject to applicable law, you may request access to, rectification or erasure of your personal data and object to processing. EU visitors may also request restriction and, where applicable, data portability. You may object to processing based on legitimate interests, including our audience measurement, under Art. 21 GDPR.

You may complain to the Office of the Data Protection Commissioner, Kenya. EU visitors may also complain to a supervisory authority in their EU country of residence, work or the alleged infringement.

Contact

For privacy questions or to exercise your rights, email [email protected] or write to LUSH BERT LTD at the address above.