Privacy Notice

Nuraya Consulting ('we,' 'us,' 'our') is committed to protecting the privacy of individuals who visit our website and interact with our services. This notice explains what personal data we collect, how we use it, and your rights under the Kenya Data Protection Act, 2019.

1. Who we are

Nuraya Consulting is a management consulting firm based in Nairobi, Kenya. For the purposes of the Kenya Data Protection Act, 2019, we are the data controller responsible for your personal data.

2. What personal data we collect

We collect personal data in the following ways:

• Information you provide through our contact form: name, email address, company, role or title, country, and message content.
• Information you provide through our newsletter signup: email address.
• Information collected automatically: IP address, browser type, device information, pages visited, and referring URL.

We do not collect sensitive personal data, including health, biometric, genetic, or political affiliation information.

3. How we use your data

We use the personal data we collect for the following purposes:

• To respond to your inquiry or discovery session request.
• To send our newsletter, only if you have opted in. You can unsubscribe at any time.
• To improve our website's functionality and user experience.
• To comply with legal obligations.

We do not sell, rent, or trade your personal data to third parties.

4. Legal basis for processing

We process your personal data on the following legal bases:

• Consent: when you submit a contact form or subscribe to our newsletter.
• Legitimate interest: website analytics and improvement.
• Legal obligation: where required by Kenyan law.

5. Third-party services

We use the following third-party services that may process your data:

• Website hosting provider — to be confirmed by Nuraya.
• Zoho — email, CRM, and form processing. Data is processed on Zoho's servers, subject to Zoho's privacy policy.
• Fonts — self-hosted. No external font services are used.
• Analytics — if implemented, the specific provider will be named here.

We require all third-party processors to handle your data in accordance with the Kenya Data Protection Act, 2019.

6. Data retention

• Contact form submissions: retained for 24 months from the date of submission, then deleted unless an ongoing business relationship exists.
• Newsletter subscriptions: retained until you unsubscribe.
• Website analytics data: retained for 12 months in aggregated, anonymised form.

7. Your rights

Under the Kenya Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, subject to legal obligations.
• Object to processing of your data.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Office of the Data Protection Commissioner, Kenya.

To exercise any of these rights, contact us at hello@nuraya.consulting.

8. Cookies

• We use essential cookies required for the website to function.
• We may use analytics cookies to understand how visitors use our site, with your consent.
• You can manage cookie preferences through your browser settings.
• A cookie banner will be displayed on your first visit (implemented during a future phase).

9. International data transfers

Your data may be processed outside Kenya, for example on Zoho's servers. Where this occurs, we ensure appropriate safeguards are in place as required by the Kenya Data Protection Act, 2019.

10. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top reflects the most recent revision. We encourage you to review this notice periodically.

11. Contact