Strativa Advisory Limited ("Strativa," "we," "us") respects your privacy and is committed to protecting your personal data. This policy explains what personal data we collect, why we collect it, how we protect it and the rights you have. It is written to comply with Kenya's Data Protection Act, 2019 and its regulations, and reflects international best practice.
1. Who we are
Strativa Advisory Limited is a technology, cybersecurity and digital advisory firm based in Nairobi, Kenya. For personal data collected through this website and in the course of our business relationships, we are the data controller.
When we process personal data on behalf of a client during an engagement (for example, during a security assessment), we act as a data processor under that client's instructions and the terms of our contract.
2. Personal data we collect
We collect only what we need:
- Contact details you give us through our contact form, email, phone or WhatsApp, such as your name, organization, job title, email address and phone number.
- The content of your messages and any information you choose to share about your needs.
- Business relationship information, such as records of meetings, proposals, contracts and invoices.
- Technical website data, such as browser type and connection information, where processed by our hosting provider to deliver and secure the website. We do not currently use analytics or advertising trackers.
We do not knowingly collect sensitive personal data through this website, and we ask you not to send it to us.
3. How we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your inquiries and requests | Your consent, or steps taken at your request before entering a contract |
| Delivering services under a contract | Performance of a contract |
| Managing our business, billing and records | Legal obligation and legitimate interests |
| Sending insights or event invitations | Your consent, which you can withdraw at any time |
| Improving and securing our website | Legitimate interests |
We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.
4. Who we share it with
We do not sell or rent personal data. We share it only when necessary:
- Service providers that host our website, email and communications, under contracts requiring them to protect your data.
- Vetted delivery partners, such as specialist testing firms, only where needed for an engagement you have agreed to, and under confidentiality and data protection obligations.
- Professional advisers, such as auditors and lawyers, under duties of confidentiality.
- Authorities, where required by law or to protect our legal rights.
5. International transfers
Some of our service providers may store or process data outside Kenya. When this happens, we transfer data only where the Data Protection Act permits it, including where appropriate safeguards are in place, such as contractual protections, or where you have given your consent.
6. How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as required by law. Inquiry records are deleted when no longer needed. Contract and financial records are retained for the periods required by Kenyan tax and company law. Data processed for clients is returned or securely deleted at the end of an engagement, as agreed in the contract.
7. How we protect it
As a cybersecurity firm, we apply the same standards we recommend to our clients. These include access controls, multi-factor authentication, encryption, secure configurations, staff confidentiality obligations and supplier due diligence. If a personal data breach occurs that is likely to affect you, we will notify the Office of the Data Protection Commissioner and, where required, you, within the timelines set by law.
8. Your rights
Under the Data Protection Act, you have the right to:
- Be informed about how your personal data is used
- Access your personal data
- Object to the processing of all or part of your personal data
- Correct false or misleading data
- Delete false, misleading or unlawfully held data
- Request that your data be provided in a portable format
- Withdraw your consent at any time, without affecting earlier processing
To exercise any of these rights, contact us using the details below. We may need to verify your identity, and we will respond within the timelines set by the Act and its regulations.
9. Complaints
If you have a concern, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya through www.odpc.go.ke.
10. Cookies
This website does not currently set cookies or use analytics or advertising trackers. If this changes, we will update this policy and provide any required choices.
11. Children
Our services are intended for organizations and professionals. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
13. Contact us
Strativa Advisory Limited, Nairobi, Kenya
Email:
[email protected]
Phone and WhatsApp: +254 700 455 226