Privacy Policy
Last updated: 19 August 2026
This policy explains how Rihla Reach collects, uses, and protects personal data, and your rights over that data.
1. Who we are
Rihla Reach is a sole trader business: Abdirahman Mohamud, trading as Rihla Reach (“we”, “us”, “our”), of Eastleigh First Avenue, Kamukunji, Nairobi, Kenya. We are the data controller for the personal data described below. Contact for privacy matters: contact@rihlareach.com.
2. Whose data we handle, and what we collect
Restaurant prospects & clients (and their owners/managers): name, role, restaurant name, email, phone, social handles, correspondence, and research/call notes, collected from you directly and public sources. Influencers/creators: name, social handles, contact details, follower/engagement metrics, audience-location data, content, and bank details for payment, collected from you directly and your public profiles. Prospective influencers we're vetting (not yet booked): public handle, name, follower/engagement/audience metrics, brand-safety notes, collected from your public profiles, using research tools. Individuals named in a case study (e.g. a client owner or manager quoted or pictured): name, role, quote, photo/likeness, and campaign results attributed to you, collected from you directly, with your own separate consent. Website visitors & enquirers: anything you send us by email or enquiry. We do not intentionally collect special-category data; the halal focus concerns the businesses we work with, not any individual’s beliefs. Our service is for businesses, not children; any influencer must be 18 or over.
3. Why we use it, and our lawful basis
Contacting restaurant prospects with a relevant B2B offer relies on legitimate interests. Running campaigns and delivering our service relies on performance of a contract. Engaging, briefing and paying influencers relies on performance of a contract. Sourcing and vetting creators before we approach or book them relies on legitimate interests. Publishing testimonials and case studies naming or picturing an individual relies on consent (that individual's own). Bookkeeping, invoicing and tax records rely on legal obligation and legitimate interests. Responding to enquiries relies on legitimate interests. Where we rely on legitimate interests, we keep our outreach relevant, low-volume, and easy to opt out of.
4. Who we share it with
Trusted processors that act only on our instructions: Pipedrive (CRM), Zoho Books (invoicing), Grey (payments), Zoho Sign / PandaDoc (contracts), Google Workspace (email/documents), Netlify (website hosting/enquiry forms), Cloudflare (cookieless website analytics), Metricool (scheduling), KrispCall (calling), Zapier (connecting these), Bright Data (finding and vetting prospective creators from public profiles), Canva (preparing case studies and marketing materials). We do not sell personal data, and may disclose it only if required by law. We apply reasonable security measures and require our processors to do the same.
5. International transfers
We operate from Kenya, and some tools store data outside Kenya and the UK. For UK individuals’ data we rely on appropriate safeguards (UK IDTA/Addendum, or providers under an approved framework); data transferred out of Kenya relies on a lawful basis under section 48 of the Kenya Data Protection Act 2019.
6. How long we keep it
Prospect data: while you remain a live prospect, and for up to 12 months after our last contact if you don't become a client; deleted or anonymised sooner on request or once clearly not a fit. Client and influencer records: kept for the engagement, then correspondence and campaign data for up to 12 months after; financial and contractual records for at least 6 years, as UK tax and limitation-period rules require. Prospective creators we're vetting but haven't booked: kept while you remain a live bench candidate, and for up to 12 months after our last check or contact if we don't move forward. Case-study and testimonial data: kept until you withdraw consent or the case study is retired. Enquiries: kept for up to 12 months from our last response, unless it becomes a client relationship.
7. Your rights
You may access, correct, erase, restrict or object to the use of your data, request portability, and withdraw consent where we relied on it. Contact us at the address in section 1; we respond within one month. You have an absolute right to object to direct marketing at any time. We do not make solely-automated decisions with legal or similarly significant effects.
8. Cookies
The site uses only essential cookies needed for it to function. We use Cloudflare Web Analytics to understand aggregate visit numbers. It sets no cookies, stores no information on your device, and does not track you individually, so no cookie consent banner is required for it. If we ever add analytics or other tools that use cookies, we will update this policy and ask for your consent first.
9. Complaints
Contact us first. You may also complain to a regulator: in the UK, the ICO (ico.org.uk / 0303 123 1113); in Kenya, the ODPC (odpc.go.ke).
10. Changes
We may update this policy; the “Last updated” date shows the current version.