1. Introduction
Busu Natural Skincare ("Busu", "we", "us" or "our") is committed to protecting the privacy and security of your personal data. This Data Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our skin analyser tool, which is powered by HautAI's technology and available through our website or physical premises.
We process your personal data as a data controller in accordance with the Kenyan Data Protection Act, 2019 (the "Act") and other applicable data protection laws. Inference Beauty acts as our data processor, processing personal data on our behalf and according to our instructions.
Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.
2. Who We Are
Busu Natural Skincare is the data controller responsible for your personal data.
Contact Person: Relationship Manager
Email: info@bususkincare.co.ke
Phone: +254 795 130 793
Address: La Enzi Plaza, Plainsview road
3. The Personal Data We Collect
When you use our skin analyser, we may collect and process the following personal data about you:
Information You Provide to Us:
Identity and Contact Data: Your first and last name, email address, and phone number.
Demographic Data: Your age range and gender, which helps us provide more personalised skin insights.
Information We Collect Automatically When You Use the Skin Analyzer:
Images and Derived Data: Images of your face, hair, hand that you upload or capture using our tool. From these images, our technology analyzes and derives information about your skin, such as:
- Skin condition and potential concerns (e.g., wrinkles, pores, spots, hydration levels).
- Perceived age, skin type, and skin tone.
Technical and Usage Data: When you interact with the skin analyzer on our website, we may collect your IP address, browser type and version, device information, and how you use the tool (e.g., pages viewed, time spent). This is collected using cookies and similar technologies, as described in our Cookie Policy.
4. Special Categories of Personal Data
Under the Kenyan Data Protection Act, information about your health, and in some contexts, your biometric data, is considered "sensitive personal data." The images you provide and the derived analysis of your skin's condition (e.g., "shows signs of hyperpigmentation" or "high acne likelihood") may fall into this sensitive category.
By using the skin analyzer, you explicitly consent to our collection and processing of this sensitive personal data for the purposes outlined in this policy. Your consent is the legal basis for processing this sensitive data under Section 45 of the Kenyan Data Protection Act.
5. How and Why We Use Your Personal Data
We use your personal data for the following purposes and on the following legal bases under the Kenyan Data Protection Act:
| Purpose | Description of Processing | Legal Basis under Kenyan Law (Sections 26 & 30) |
|---|---|---|
| To Provide You with the Skin Analysis Service | To process your uploaded image through the AI algorithm to generate a personalized skin analysis report. This includes identifying skin concerns, recommending suitable Busu Natural Skincare products, and tracking your skin's progress over time if you use the tool repeatedly. | Performance of a Contract: Processing is necessary to provide you with the service you have requested. For the analysis of your image (sensitive data), we rely on your explicit consent (see Section 4). |
| To Improve and Enhance Our Services | We may use aggregated and anonymized data (which can no longer identify you) from skin analyses to understand trends, improve our product formulations, and develop new services. HautAI may also use anonymized images to train and improve its AI models, as described in their privacy notice. | Legitimate Interests: It is in our legitimate business interest to use anonymized data for research and development. This processing is anonymized and does not impact your privacy rights. |
| To Communicate with You | To send you your skin analysis report, respond to your inquiries, and provide customer support. With your separate consent, we may also send you marketing communications about our products, promotions, and skin care tips. | Performance of a Contract (to send analysis results). Consent (for direct marketing, as required by Kenyan law). |
| To Ensure Website and Service Security | To monitor and analyze usage of our website and the skin analyzer tool to prevent fraud, ensure IT security, and troubleshoot technical issues. | Legitimate Interests: It is in our legitimate interest to ensure our digital assets are secure and functioning properly. |
| To Comply with Legal Obligations | To retain records as required by applicable Kenyan laws and regulations, such as tax or consumer protection laws. | Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject. |
6. Our Relationship with Inference Beauty
As noted, our skin analyzer is powered by Inference beauty. In this context:
Busu Natural Skincare is the Data Controller. We decide how and why your personal data is processed and are responsible for providing you with this privacy notice.
Inference is our Data Processor. They process your personal data (specifically the images and derived data) only on our documented instructions and are contractually obligated to implement appropriate technical and organisational security measures.
Inference may process your personal data for its own legitimate interests as a separate controller in very limited ways, such as using anonymised data to improve its services.
7. Who We Share Your Personal Data With
We may share your personal data with the following categories of third parties:
Our Service Providers:
Inference Beauty: As our core technology provider for skin analysis.
-IT and Cloud Storage Providers: Companies that host our website and store data (e.g., servers located within or outside Kenya).
- Analytics Providers:Tools that help us understand how our website is used (e.g., Google Analytics).
- For Legal Reasons: We may disclose your information to public authorities (e.g., police, courts, ODPC) if we are required to do so by Kenyan law or to comply with a lawful request after following due process.
- Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our business, your personal data may be transferred to the new owner.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
8. International Data Transfers
The personal data we collect from you may be transferred to, and stored at, a destination outside Kenya.
Whenever we transfer your personal data out of Kenya, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:
- Transferring to countries that have been deemed to provide an adequate level of protection for personal data.
- Using specific contracts approved for use in Kenya, which give personal data the same protection it has in Kenya (e.g., incorporating standard data protection clauses).
By submitting your personal data, you agree to this transfer, storing, or processing. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this privacy policy.
9. Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. These include physical, electronic, and administrative safeguards, such as:
- Limiting access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know.
- Requiring Inference Beauty to implement robust security measures as detailed in their security documentation.
- Using anonymization techniques where possible.
While we take all reasonable steps to protect your information, we cannot guarantee the security of data transmitted over the internet; any transmission is at your own risk.
10. Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
- Analysis Images and Reports: We will retain your skin analysis report only for as long as necessary to provide you with the service. If you have an account with us, your analysis history may be stored to allow you to track your skin's progress. You may request deletion of this data at any time.
- Anonymised Data: Once images and data are fully anonymised (so that you can no longer be identified), Inference beauty and we may retain and use this data for research and development purposes indefinitely, as it is no longer considered personal data.
- Marketing Data: We will retain your contact information for marketing purposes until you withdraw your consent or unsubscribe.
To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.
11. Your Data Protection Rights Under Kenyan Law
Under the Kenyan Data Protection Act, you have the following rights regarding your personal data:
-Right to be Informed: To receive clear and transparent information about how we use your data (as provided in this policy).
- Right of Access: To request a copy of the personal data we hold about you.
- Right to Rectification: To request that we correct any incomplete or inaccurate data we hold about you.
- Right to Erasure (Right to be Forgotten):To request that we delete your personal data, subject to certain legal exceptions.
- Right to Restriction of Processing: To request that we suspend the processing of your personal data in certain circumstances.
- Right to Data Portability:To request that we transfer your personal data to you or a third party in a structured, commonly used, and machine-readable format.
- Right to Object: To object to our processing of your personal data where we are relying on a legitimate interest as our legal basis.
- Right to Withdraw Consent: Where we are relying on your consent to process your personal data (including for direct marketing and processing sensitive data), you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing we conducted before your withdrawal.
How to Exercise Your Rights: If you wish to exercise any of these rights, please contact us at info@bususkincare.co.ke. We will respond to all legitimate requests within 30 days. We may need to request specific information from you to help us confirm your identity and ensure your right to access the data (or to exercise any of your other rights).
12. Children's Privacy
Our skin analyzer is not intended for children under the age of 18. We do not knowingly collect personal data from children. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child without verification of parental consent, we take steps to remove that information.
13. Updates to This Policy
We may update this Data Privacy Policy from time to time in response to legal, technical, or business developments. Any updates will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically to stay informed about how we are protecting your information. In case of any material changes, we will notify you more prominently, such as by email.
14. Contact Us
If you have any questions, concerns, or complaints about this Data Privacy Policy or our data practices, please contact us at:
Busu Natural Skincare
Attention: Relationship manager
Email: info@bususkincare.co.ke
Phone: +254 795 130 793