In short
We collect what you send us and a little technical data. We use it to reply, to prepare for and deliver our work, and to keep the site secure. We don't sell it, and we share it with advisory partners only with your agreement.
Who we are
Epiidosis Africa Limited (“Epiidosis Africa”, “we”, “us”) is the data controller for the personal data described in this notice. Where an advisory partner works on your engagement, it may also be responsible for the data it receives, and your engagement letter names that partner.
- Data controller
- Epiidosis Africa Limited
- Company
- A private limited company incorporated in Kenya
- Address
- Head Office, Applewood Adams, Ngong Road, Suite 312, P.O. Box 22251-00100, Nairobi, Kenya
- Telephone
- +254 746 333 333
- Data protection contact
- privacy@epiidosisafrica.com, with “Data protection” in the subject line
What we collect
- Enquiry forms
- Your name, business email, phone, company, the type of business and help you need, your country of operation, your message and your consent.
- Readiness pre-assessment
- Your answers about your business, what you need, the approximate size of the requirement and the documents you have ready, with your name, business email and phone.
- Updates
- Your business email, if you subscribe to our insights.
- Careers applications
- What you send us: your name and contact details, CV, cover letter, work history, qualifications and references.
- Engagements
- If you become a client: identity documents for directors, shareholders and signatories, company documents and the financial information you give us for the work.
- Analytics
- We use Vercel Web Analytics. It is cookieless and aggregate: it counts page views, referring sites, browser and device type and country, and doesn't build a profile of you.
- Server logs
- Our hosting provider records technical data when your browser requests a page: IP address, date and time, the page requested, browser type and any errors. When you send a form, your IP address is also used briefly to stop repeated automated submissions.
- Fonts
- Our typefaces load from Google Fonts, so Google receives your IP address and browser details when a page loads.
Please don't send us sensitive personal data, such as health information, unless we ask for it for a specific, lawful reason.
Purposes and lawful bases
We use personal data only for clear purposes, and each one has a lawful basis under the Act.
| Purpose | Data | Lawful basis |
|---|---|---|
| Reply to your enquiry and arrange a first meeting | Contact form details | Your consent, and steps you ask us to take before a contract |
| Review your readiness pre-assessment and suggest next steps | Your answers and contact details | Your consent, and steps before a contract |
| Send updates you subscribe to | Business email | Your consent |
| Plan and deliver an engagement | Engagement information | Performance of a contract |
| Carry out KYC and anti-money-laundering checks, and keep the records we must | Identity and company documents | Legal obligation |
| Consider you for a role | Your application | Your consent, and steps before an employment contract |
| Run, secure and improve this website, and stop misuse of its forms | Server logs and aggregate analytics | Legitimate interests |
| Respond to lawful requests, and establish or defend legal claims | The relevant records | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we weigh them against your rights, and you can object. We don't send marketing messages unless you ask for them.
International transfers
Some of our service providers, including our website host, store or process data on servers outside Kenya.
When personal data leaves Kenya, we transfer it only as the Data Protection Act, 2019 allows: with appropriate safeguards, such as contractual commitments to protect the data, or on another ground the Act recognises. You can ask us about the safeguards we use.
How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.
- Enquiries and pre-assessments
- As long as we need to reply and follow up. If no engagement follows, we delete or anonymise them.
- Updates
- Until you unsubscribe.
- Client and engagement records
- For the period the law requires, for example for tax and anti-money-laundering records. Then we delete them securely.
- Careers applications
- For the recruitment process. If you agree, for a limited time afterwards, so we can consider you for future roles.
- Server logs and analytics
- Logs for short periods set by our hosting provider. Analytics are aggregate and don't identify you.
Security
- Encrypted connections (HTTPS) for every page and form.
- Access limited to the people who need it for their work.
- Service providers bound by confidentiality and security terms.
- Limits on form submissions to prevent automated misuse.
No system is completely secure. If a breach is likely to put you at risk, we'll notify the Data Commissioner and, where the Act requires, you.
We will never ask for your passwords or PINs. Read our fraud awareness guidance to check that a message really comes from us.
Your rights
Under the Data Protection Act, 2019 you have the right to:
Be informed
Know how your personal data is used. This notice is part of that.
Access
Ask for a copy of the personal data we hold about you.
Correction
Ask us to correct data that is inaccurate, out of date or misleading.
Deletion
Ask us to delete data that is false or misleading, or that we no longer have a lawful reason to keep.
Objection
Object to our use of all or part of your data, including for direct marketing.
Portability
Receive data you gave us in a structured, machine-readable format, and have it sent to another organisation where technically possible.
Withdraw consent
Where we rely on consent, withdraw it at any time. This doesn’t affect our use of the data before you withdrew.
Automated decisions
Not be subject to decisions based only on automated processing. We don’t make them: our team reviews every pre-assessment.
To use any of these rights, email privacy@epiidosisafrica.com with “Data protection request” in the subject line, or write to us at Head Office, Applewood Adams, Ngong Road, Suite 312, P.O. Box 22251-00100, Nairobi, Kenya. We may ask you to confirm your identity first. We'll reply within the time the law allows and, if we can't meet a request, explain why.
Complaints
If you're unhappy with how we've handled your data, please contact us first so we can try to put it right.
You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya's data protection regulator, at odpc.go.ke.
Children
This website and our services are for businesses and professionals. They aren't directed at children, and we don't knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, contact us and we'll delete it.
Changes to this notice
We may update this notice as our services or the law change. The date at the top of this page shows when it was last updated. If we make significant changes, we'll say so clearly on this page.