Privacy Policy.
What we collect, why we collect it, and what we will never do with it.
Last updated 20 October 2026
Our promise, in short.
We collect what we need to serve you. We do not sell your data. We do not share it with advertisers.
1. Who we are
Rhythm & Motion Limited is a company registered in Kenya, with its registered office at P.O. Box 647, Sarit Centre, Nairobi 00606. We operate the DAMANFIT fitness division, R&M Studios, the DamanMziki music project, and the R&M Foundation.
2. What we collect
Information you give us directly (name, email, phone number, payment details, training or coaching records, correspondence). Technical information (IP address, device type, browser, pages viewed). Information from third parties where you have consented to it.
3. Why we collect it
To deliver the services you have asked for (coaching sessions, classes, studio bookings, event access), to process payments, to communicate with you, to meet our legal and tax obligations, and to improve our services.
4. What we never do
We do not sell your personal data. We do not share it with advertisers or data brokers. We do not send marketing email without your consent, and every message we send includes an unsubscribe route.
5. Social platform connections
Where you connect a social account (such as TikTok, Instagram, Facebook, YouTube or X) to our publishing tools, we store only the access token required to publish on your behalf, the account identifier, and your posting preferences. We can post content to that account only with your instruction. You may disconnect any account at any time, which revokes our access immediately.
6. How long we keep it
Client and transaction records are retained for seven years to meet Kenyan tax and accounting requirements. Coaching and fitness records are retained for two years after your last engagement. Marketing consent records are retained until you withdraw consent.
7. Your rights
Under the Kenya Data Protection Act 2019 you have the right to access your data, correct inaccuracies, request deletion, withdraw consent, object to processing, and lodge a complaint with the Office of the Data Protection Commissioner. Write to us and we will respond within 30 days.
8. Security
Access tokens for connected accounts are held encrypted and are never displayed in full. Access to personal data is limited to staff who need it. We use HTTPS on all our web properties. No system is perfectly secure, but we do not retain data we do not need.
9. Children
Our services are intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.
10. Changes to this policy
We update this policy when our practices change. The date at the top of this page always reflects the latest version. Material changes will be communicated to clients by email or by notice on this page.
11. Cookies
This website uses essential cookies for navigation and site security. We do not use advertising cookies or cross-site tracking cookies. If we introduce analytics, we will update this section first.
12. Contact us
Write to us at P.O. Box 647, Sarit Centre, Nairobi 00606, Kenya, or email privacy@rhythmandmotion.co.ke. If you are not satisfied with our response, you may complain to the Office of the Data Protection Commissioner, Nairobi.