Privacy Policy

Privacy Policy

At RKCO East Africa Consulting, we recognise the importance of protecting your personal information and respecting your privacy. This Privacy Policy outlines how we obtain, handle, use, store, and protect personal information when you visit our website, communicate with us, or make use of our professional services.

Our approach to personal data is guided by the Constitution of Kenya, 2010, the Data Protection Act, 2019 (Cap. 411C), the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, the Data Protection (Complaints Handling and Enforcement) Regulations, 2021, and other applicable laws and regulations in Kenya.

1. Information We May Obtain

The type of information we collect depends on the nature of your interaction with RKCO. This may include:

1. Personal Details: Your name, email address, telephone number, address, position, organisation, and other information you provide when making an enquiry or engaging our services.
2. Corporate and Business Information: Details concerning your organisation, business activities, registration information, professional information, and other corporate information required in connection with our engagements.
3. Engagement Information: Information contained in proposals, contracts, requests for quotations, audit assignments, consulting engagements, training registrations, and other documents or communications relating to our services.
4. Technical Data: Information generated when you access our website, such as your IP address, browser type, device information, operating system, pages viewed, and general website usage.
5. Communication Records: Information contained in emails, telephone conversations, WhatsApp communications, online forms, feedback, and other correspondence exchanged with us.
6. Financial and Transaction Information: Where relevant, information necessary to facilitate invoicing, payments, accounting, and other legitimate financial administration.

RKCO seeks to collect information that is relevant and reasonably necessary for the specific purpose for which it is required, consistent with the principles established under Kenyan data protection legislation.

2. How We Use Personal Information

Information provided to RKCO may be used for legitimate business and professional purposes, including:

1. Delivering our professional services, including Internal Audit, Governance, Risk and Compliance, Information Systems Audit, Cybersecurity and Penetration Testing, Forensic Audit and Investigation, Fraud Risk Management, Digital Forensics, Management Consulting, Policy Development, ISO Advisory and Certification Services, Business Continuity Management, and Professional Training.
2. Responding to enquiries, requests for information, proposals, and quotations.
3. Establishing and maintaining relationships with clients, prospective clients, business partners, and other stakeholders.
4. Preparing contracts, engagement documentation, proposals, invoices, reports, and other business records.
5. Administering training programmes, workshops, seminars, and related activities.
6. Understanding and improving the performance and functionality of our website.
7. Enhancing the quality and effectiveness of our services.
8. Providing newsletters, professional publications, training updates, and information about our services where permitted by law.
9. Fulfilling statutory, regulatory, contractual, professional, and accounting obligations.
10. Protecting our systems, business operations, clients, and stakeholders from fraud, unauthorised access, misuse, and other security risks.
11. Exercising or protecting our legal rights, including establishing or defending legal claims.
12. Carrying out any other purpose that is lawful and appropriately communicated to the relevant individual.

We process personal information only where a lawful basis exists under applicable Kenyan data protection requirements.

3. When We May Disclose Information

RKCO may disclose or provide access to personal information where this is necessary for legitimate business, contractual, legal, or professional purposes.

Information may be made available to:

1. Our Personnel: Employees, consultants, contractors, and authorised representatives who require the information in order to perform their responsibilities.
2. Service Providers: External providers supporting functions such as website hosting, information technology, cloud services, communications, payment processing, document management, and other business operations.
3. Professional Advisers: Accountants, lawyers, auditors, consultants, and other professional advisers where their involvement is necessary.
4. Clients or Engagement Parties: Where information is required to perform a particular assignment and such disclosure is lawful and authorised.
5. Public Authorities and Regulators: Government institutions, regulatory bodies, courts, tribunals, or law enforcement agencies where disclosure is required or permitted under Kenyan law.
6. Other Authorised Parties: Any other party where disclosure is authorised by you or otherwise permitted by applicable law.

RKCO does not sell, lease, or commercially trade personal information belonging to individuals or corporate institution including our clients.

Where third parties process information on our behalf, we take reasonable steps to ensure that appropriate confidentiality, security, and data protection obligations are maintained.

4. Protection of Personal Information

RKCO applies reasonable technical and organisational safeguards to reduce the risk of personal information being accessed, altered, disclosed, lost, destroyed, or otherwise misused without authorisation.

Our safeguards may include:

1. Controlled access to information;
2. Authentication and password controls;
3. Secure information-storage systems;
4. Confidentiality requirements for personnel;
5. Data backup and recovery arrangements;
6. Information security controls;
7. Physical security measures;
8. Secure disposal of information; and
9. Procedures for responding to information-security incidents.

These measures are implemented with reference to the requirements of the Data Protection Act, 2019 and applicable Kenyan regulations.

While we take appropriate precautions to protect personal information, no internet connection, electronic system, or method of storing information can be guaranteed to be completely secure.

5. Cookies and Website Analytics

Our website may make use of cookies and related technologies to support website functionality and understand how visitors interact with our online services.

Information obtained through these technologies may include:

1. Pages visited;
2. General browsing behaviour;
3. Device and browser information;
4. Website performance information; and
5. Other technical information.

Cookies may assist us in improving website functionality, security, performance, and user experience.

You may manage or restrict cookies through the settings of your web browser. Please note that restricting certain cookies may affect some website features.

Where applicable law requires consent for the use of particular cookies or tracking technologies, we will obtain the appropriate consent.

6. Your Data Protection Rights

The Data Protection Act, 2019 provides individuals with various rights concerning their personal information.

Subject to applicable legal limitations, you may have the right to:

1. Know How Your Information Is Used: Request information about how and why your personal data is being processed.
2. Access Your Information: Ask for access to personal data held by RKCO about you.
3. Request Correction: Ask us to amend personal information that is inaccurate, incomplete, or misleading.
4. Request Removal: Ask for deletion of personal information where the law permits such deletion.
5. Object to Processing: Raise an objection to particular forms of processing where you have a lawful right to do so.
6. Withdraw Consent: Where we rely on your consent, you may withdraw that consent.
7. Data Portability: Where applicable, request your personal information in a format that allows it to be transferred in accordance with the law.

These rights are subject to the conditions and exemptions provided under Kenyan data protection legislation.

7. External Websites and Links

Our website may provide links to websites, applications, social-media platforms, or other online services operated by third parties.

These external platforms are outside RKCO’s control and may operate under different privacy policies and data-handling practices.

RKCO therefore does not assume responsibility for the privacy, security, or content of third-party websites. We recommend that you review their respective privacy policies before submitting personal information.

8. Retention of Personal Information

RKCO retains personal information only for the period reasonably necessary to fulfil the purpose for which it was obtained or to meet applicable legal, contractual, regulatory, professional, or business requirements.

Information may also be retained where necessary to resolve disputes, maintain appropriate business records, or establish, exercise, or defend legal rights.

Once information is no longer required, we will take reasonable steps to securely delete, destroy, anonymise, or otherwise dispose of it.

9. Transfer of Information Outside Kenya

Some of the technology and service providers used by RKCO may operate systems or infrastructure outside Kenya.

Where personal information is transferred or processed outside Kenya, we will take reasonable steps to ensure that the transfer complies with the requirements of the Data Protection Act, 2019 and applicable regulations.

Where necessary, appropriate safeguards, contractual arrangements, or other lawful mechanisms will be used to protect the information.

10. Complaints and Privacy Concerns

If you believe that your personal information has not been handled appropriately, we encourage you to contact RKCO so that we can review and address your concern.

Where you are not satisfied with the outcome, or where you wish to exercise your statutory rights, you may also raise a complaint with the Office of the Data Protection Commissioner (ODPC) in accordance with Kenyan data protection law.

11. Updates to This Policy

We may revise this Privacy Policy from time to time to reflect changes in our business activities, website functionality, technology, data-processing practices, legislation, regulatory requirements, or guidance issued by the relevant authorities.

Any revised version will be published on this page and will include an updated Last Updated date.

We encourage you to periodically review this page so that you remain informed about how RKCO handles personal information.

12. Contact Information

For questions concerning this Privacy Policy, requests relating to your personal data, or privacy concerns, you may contact us through:

RKCO East Africa Consulting

Email: info@rkcoeastafricaconsulting.co.ke
Telephone: +254 742 601 400
Website: rkcoeastafricaconsulting.co.ke

When making a data protection request, please provide sufficient information to enable us to understand and appropriately respond to your request.

13. Applicable Law

This Privacy Policy is governed by the laws of the Republic of Kenya.

In particular, it is informed by the Constitution of Kenya, 2010, the Data Protection Act, 2019 (Cap. 411C), the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, the Data Protection (Complaints Handling and Enforcement) Regulations, 2021, and other applicable Kenyan legislation and regulatory requirements.