Privacy Policy
Last updated: 3 October 2026
This policy explains how Rihla Reach collects, uses, and protects personal data, and your rights over that data.
1. Who we are
Rihla Reach is a sole trader business: Abdirahman Mohamud, trading as Rihla Reach (“we”, “us”, “our”), of Eastleigh First Avenue, Kamukunji, Nairobi, Kenya. We are the data controller for the personal data described below. Contact for privacy matters: [email protected].
2. Whose data we handle, and what we collect
Restaurant prospects & clients (and their owners/managers): name, role, restaurant name, email, phone, social handles, correspondence, and research/call notes, collected from you directly and public sources. Influencers/creators: name, social handles, contact details, follower/engagement metrics, audience-location data, content, and bank details for payment, collected from you directly and your public profiles. We also display your content, with credit to you, in our own ongoing portfolio and marketing, as agreed in your Influencer Agreement. Prospective influencers we're vetting (not yet booked): public handle, name, follower/engagement/audience metrics, brand-safety notes, collected from your public profiles, using research tools. Individuals named in a case study (e.g. a client owner or manager quoted or pictured): name, role, quote, photo/likeness, and campaign results attributed to you, collected from you directly, with your own separate consent. Website visitors & enquirers: anything you send us by email or enquiry, plus browsing data our analytics tools collect automatically — browser, device, and screen characteristics, pages viewed, and referrer; your IP address is processed only transiently to keep this cookieless, never stored against an identifier (see section 4 for which tools, section 8 for how). We do not intentionally collect special-category data; the halal focus concerns the businesses we work with, not any individual’s beliefs. Our service is for businesses, not children; any influencer must be 18 or over.
3. Why we use it, and our lawful basis
Contacting restaurant prospects with a relevant B2B offer relies on legitimate interests. Running campaigns and delivering our service relies on performance of a contract. Engaging, briefing and paying influencers relies on performance of a contract. Displaying your content in our own ongoing portfolio and marketing relies on consent, given by signing the Influencer Agreement, withdrawable at any time. Sourcing and vetting creators before we approach or book them relies on legitimate interests. Publishing testimonials and case studies naming or picturing an individual relies on consent (that individual's own). Bookkeeping, invoicing and tax records rely on legal obligation and legitimate interests. Responding to enquiries relies on legitimate interests. Where we rely on legitimate interests, we keep our outreach relevant, low-volume, and easy to opt out of.
4. Who we share it with
Trusted processors that act only on our instructions: Attio (CRM for our records of restaurant prospects, clients, creators and the people we exchange business email with, synced from our mailbox), Grey (payments), PandaDoc (contracts and e-signature), Google Workspace (email/documents), Netlify (website hosting/enquiry forms), Cloudflare (cookieless website analytics), PostHog (cookieless funnel analytics on our enquiry forms), Metricool (scheduling), KrispCall (calling), Zapier (connecting these), Bright Data (finding and vetting prospective creators from public profiles), Canva (preparing case studies and marketing materials). We do not sell personal data, and may disclose it only if required by law. We apply reasonable security measures and require our processors to do the same.
5. International transfers
We operate from Kenya, and some tools store data outside Kenya and the UK. For UK individuals’ data we rely on appropriate safeguards (UK IDTA/Addendum, or providers under an approved framework); data transferred out of Kenya relies on a lawful basis under section 48 of the Kenya Data Protection Act 2019.
6. How long we keep it
Prospect data: while you remain a live prospect, and for up to 12 months after our last contact if you don't become a client; deleted or anonymised sooner on request or once clearly not a fit. Client and influencer records: kept for the engagement, then correspondence and campaign data for up to 12 months after; financial and contractual records for at least 6 years, as UK tax and limitation-period rules require. Prospective creators we're vetting but haven't booked: kept while you remain a live bench candidate, and for up to 12 months after our last check or contact if we don't move forward. Case-study and testimonial data: kept until you withdraw consent or the case study is retired. Influencer content used in our portfolio: kept on an ongoing basis while it remains useful and credited to you, until you withdraw consent or ask us to take it down. Enquiries: kept for up to 12 months from our last response, unless it becomes a client relationship.
7. Your rights
You may access, correct, erase, restrict or object to the use of your data, request portability, and withdraw consent where we relied on it. Contact us at the address in section 1; we respond within one month. You have an absolute right to object to direct marketing at any time. We do not make solely-automated decisions with legal or similarly significant effects.
8. Cookies
The site uses only essential cookies needed for it to function. We use Cloudflare Web Analytics to understand aggregate visit numbers, and PostHog in cookieless mode to see where visitors drop off in our enquiry forms so we can improve them. Neither sets cookies, stores information on your device, or tracks you individually, so no cookie consent banner is required for either. If we ever add analytics or other tools that use cookies, we will update this policy and ask for your consent first.
9. Complaints
Contact us first. You may also complain to a regulator: in the UK, the ICO (ico.org.uk / 0303 123 1113); in Kenya, the ODPC (odpc.go.ke).
10. Changes
We may update this policy; the “Last updated” date shows the current version.