1.Introduction and scope

This Website Privacy Notice (“Notice”) is issued by Acculeap Analytics Ltd (trading as Acculeap Analytics) and sets out the manner in which Personal Data is collected, used, stored and disclosed when you access or use the Website.

This Notice applies exclusively to Personal Data processed through the public Website. It does not govern Personal Data processed in the course of client engagements, platform deployments or advisory mandates, which are subject to separate contractual terms and privacy arrangements.

By submitting a contact enquiry, continuing to browse the Website, or using the Astra assistant, you acknowledge that you have read this Notice. Where Processing is based on consent, consent is obtained at the point of submission or activation, as applicable.

2.Definitions

In this Notice, the following terms have the meanings set out below:

Personal Data

Any information relating to an identified or identifiable natural person, as defined under the Data Protection Act, 2019.

Processing

Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.

Controller

Acculeap Analytics Ltd, which determines the purposes and means of Processing Personal Data collected through this website.

Processor

A third party that Processes Personal Data on behalf of the Controller under written instructions.

Data Subject

An individual to whom Personal Data relates.

Website

The public website operated by the Controller at acculeap-analytics.com (and associated subdomains, where applicable).

3.Data controller

For the purposes of the Data Protection Act, 2019 (Kenya), the Controller of Personal Data processed through the Website is:

All enquiries relating to this Notice or the exercise of data subject rights should be directed to the email address above, marked for the attention of the Data Protection Officer or privacy team.

4.Categories of personal data

The Controller collects Personal Data through the channels described in the schedules below. The Controller does not knowingly collect Personal Data from children under the age of eighteen (18) years through the Website.

5.Purposes and lawful basis

Personal Data is Processed only for specified, explicit and legitimate purposes and is not further Processed in a manner incompatible with those purposes. The table below summarises the purpose and lawful basis for each category of Processing:

6.Cookies and similar technologies

The Website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit the Website. Google Analytics 4 may set first-party and third-party cookies to distinguish users and sessions.

1. Strictly necessary cookies — required for the Website to function (e.g. security, load balancing).
2. Analytics cookies — used to collect aggregated usage statistics via Google Analytics 4 (Schedule B).

You may refuse or delete cookies through your browser settings. To opt out of Google Analytics across websites, visit Google Analytics Opt-out Browser Add-on. Disabling cookies may affect certain Website functionality.

7.Disclosure and processors

The Controller does not sell, rent or trade Personal Data. Personal Data may be disclosed to Processors who Process data on the Controller's documented instructions and only to the extent necessary to provide the relevant service:

The Controller requires all Processors to implement appropriate technical and organisational measures and to Process Personal Data only in accordance with the Controller's instructions and applicable data protection law.

8.International transfers

Personal Data is primarily Processed within Kenya. Certain Processors (including Google LLC and, where configured, cloud infrastructure or language-model providers) may Process Personal Data in jurisdictions outside Kenya, including the United States of America and member states of the European Union.

Where Personal Data is transferred outside Kenya, the Controller implements appropriate safeguards as required under the Data Protection Act, 2019 (Kenya), including contractual clauses, processor due diligence and transfer impact assessments where applicable.

9.Retention

Personal Data is retained only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law:

1. Contact enquiries: For the duration necessary to respond to and manage the enquiry, and thereafter for up to seven (7) years where a client or commercial relationship arises, or as required by applicable legal, regulatory or professional obligations.
2. Analytics data: In accordance with the retention controls configured for the Controller’s Google Analytics 4 property, and in any event not longer than is necessary for the purposes set out in Schedule B.
3. Astra session data: For the duration of the browsing session and such further period as is strictly necessary to operate the assistant. Analytics events, where collected, are retained in aggregated or pseudonymised form and purged or anonymised on a rolling basis.

10.Security measures

The Controller maintains appropriate technical and organisational security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include, without limitation:

• Transport-layer encryption (HTTPS/TLS) for data in transit;
• Access controls and authentication for systems processing Personal Data;
• Contractual confidentiality and data protection obligations imposed on Processors;
• Monitoring and review of Website security on a periodic basis.

No method of transmission over the Internet or method of electronic storage is completely secure. While the Controller strives to protect Personal Data, absolute security cannot be guaranteed.

11.Data subject rights

Subject to the provisions of the Data Protection Act, 2019 (Kenya), Data Subjects have the following rights in relation to their Personal Data:

1. The right to be informed of the Processing of Personal Data concerning the Data Subject.
2. The right of access to Personal Data held by the Controller (Section 26, Data Protection Act, 2019).
3. The right to rectification of inaccurate or incomplete Personal Data (Section 27).
4. The right to erasure of Personal Data, where the statutory grounds are met (Section 28).
5. The right to restrict Processing in the circumstances prescribed by law (Section 29).
6. The right to object to Processing based on legitimate interests, on grounds relating to the Data Subject’s particular situation (Section 30(2)).
7. The right to data portability, where Processing is based on consent or contract and is carried out by automated means (Section 31).
8. The right to withdraw consent at any time, without affecting the lawfulness of Processing prior to withdrawal, where Processing is based on consent.

Requests to exercise any of the above rights should be submitted to inquiry@acculeap-analytics.com. The Controller will respond within the timeframe prescribed by applicable law and may request information reasonably necessary to verify the identity of the Data Subject.

12.Complaints

If you believe that the Processing of your Personal Data infringes the Data Protection Act, 2019 (Kenya), you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) (www.odpc.go.ke). The Controller encourages Data Subjects to contact it in the first instance so that concerns may be addressed promptly.

13.Changes to this notice

The Controller reserves the right to amend this Notice at any time. Material changes will be published on this page with an updated “Last revised” date. Continued use of the Website after publication of a revised Notice constitutes acknowledgement of the updated terms, to the extent permitted by law.

This Notice is governed by the Laws of the Republic of Kenya. The courts of Kenya shall have exclusive jurisdiction over any dispute arising from or relating to this Notice, subject to the Data Subject's right to complain to the ODPC.

14.Contact

For questions regarding this Notice, or to exercise your rights as a Data Subject, please contact:

Enquiries may also be submitted via the contact form on the Website.