Privacy Policy

Last updated: 19 July 2026

Zircon Consultants ("we", "us" or "our") respects your privacy. This policy explains what personal data we collect through our website at zirconconsultants.org, why we collect it, who we share it with, and the rights you have over it.

We are a Kenyan company, so we process personal data in line with the Data Protection Act, Cap. 411C of the Laws of Kenya. Where visitors reach us from the European Economic Area or the United Kingdom, we also apply the principles of the EU General Data Protection Regulation (GDPR).

Who We Are

For the purposes of the Data Protection Act and the GDPR, the data controller is:

Information We Collect

Information you give us

You can browse this website without telling us who you are. We only receive personal data from you when you choose to send it:

  • Contact form: your name, email address, phone number, organization, organization type, how you heard about us, and your message.
  • Newsletter form: your email address.

Information collected automatically

When you submit one of our forms, our server also records the date and time, the page you submitted from, your IP address, and your browser's user agent string. We keep this alongside your submission to help us detect spam and abuse.

We also use Google Analytics to understand how the website is used, such as which pages are visited, for how long, from what kind of device and browser, and the approximate region a visit comes from. This information is aggregated and does not identify you personally. See our Cookie Policy for the cookies involved.

How We Use Your Information

We use personal data to:

  • respond to your enquiries and provide the services you ask us about;
  • send you our newsletter and related updates, where you have subscribed;
  • operate, secure, and improve the website, including filtering spam submissions;
  • understand how visitors use the website so we can improve our content; and
  • comply with legal obligations that apply to us.

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects about you.

Lawful Bases for Processing

Section 30 of the Data Protection Act, and Article 6 of the GDPR where it applies, require a lawful basis for every use of personal data. Ours are:

  • Consent: for the newsletter and for analytics cookies. You can withdraw consent at any time, for the newsletter by using the unsubscribe link in any email or writing to us, and for cookies as described in the Cookie Policy.
  • Steps prior to a contract: when you contact us about our programs and services, we process your details to respond and prepare a proposal.
  • Legitimate interests: keeping the website secure, preventing spam, and measuring how our content performs.
  • Legal obligation: where we must keep records to comply with Kenyan law.

Who We Share Your Information With

We share personal data only with service providers who process it on our instructions:

  • Brevo (Sendinblue GmbH, Germany): delivers our email and stores our newsletter subscriber list. Form submissions are relayed to our inbox through Brevo, and newsletter signups are stored as contacts there.
  • Google (Google Analytics): provides aggregated website usage statistics.
  • Our hosting provider: stores the website and processes server logs.

We may also disclose personal data where the law requires it, for example in response to a valid request from a court or public authority, or to protect our rights, our users, or the public.

International Transfers

Some of our service providers store data outside Kenya, for example Brevo in the European Union. Section 48 of the Data Protection Act allows transfers outside Kenya where there are adequate data protection safeguards. Our providers are subject to the GDPR or to equivalent data protection commitments, which we consider an adequate safeguard for these transfers.

How Long We Keep Your Information

We keep personal data only as long as we need it for the purposes described above:

  • Contact form submissions are kept for as long as needed to handle your enquiry and any follow-up business relationship.
  • Newsletter details are kept until you unsubscribe or ask us to delete them.
  • Technical logs and analytics data are kept for shorter periods and in aggregated form.

When data is no longer needed, we delete it or anonymize it.

Your Rights

Under Kenya's Data Protection Act

Section 26 of the Data Protection Act gives you the right to:

  • be informed of the use to which your personal data is put;
  • access your personal data in our custody;
  • object to the processing of all or part of your personal data;
  • correction of false or misleading data; and
  • deletion of false or misleading data about you.

Under the GDPR

If you are in the European Economic Area or the United Kingdom, you additionally have the right to erasure, to restriction of processing, to data portability, and to lodge a complaint with your local supervisory authority.

Exercising your rights and complaints

To exercise any of these rights, email us at zircon@zirconconsultants.org. We will respond within a reasonable time and at no cost to you.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the authority established under the Data Protection Act to enforce data protection in Kenya.

How We Protect Your Information

We use appropriate technical and organizational measures to protect personal data, including encrypted (HTTPS) connections across the website, spam filtering on our forms, and access to submissions restricted to the people who handle them. No method of transmission or storage is completely secure, but we work to protect your data against loss, misuse, and unauthorized access.

Children's Privacy

Our services are aimed at organizations and working professionals, and the website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

The website contains links to third-party sites, such as LinkedIn and the sites we cite in our articles. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of every site you visit.

Changes to This Policy

We may update this policy from time to time, for example when the law or our practices change. The current version is always published on this page, with the "Last updated" date at the top. Significant changes will be highlighted on the website.

Contact Us

Questions about this policy or about how we handle your personal data can be sent to zircon@zirconconsultants.org or posted to Zircon Consultants, The Watermark Business Park, Spring Court, Ndege Road, Karen, Nairobi, Kenya.