Privacy Policy

This Privacy Policy explains how NairobiX handles personal data when you visit nairobix.com, use our forms, the Business Growth Assessment, consultation booking or Nia (our AI assistant), apply to the NairobiX Opportunities Network, respond to a Proposal, or work with us as a Client.

It is written to meet the duty to inform you under section 29 of Kenya's Data Protection Act, 2019 (the “Act”) and the regulations made under it. How cookies and similar browser technologies are used is covered in more detail in our Cookie Policy.

“Personal data” means information that relates to an identified or identifiable person — for example your name, email address or phone number. Information that only describes a business, such as its industry or website, is not personal data on its own, but we treat it with the same care when it is linked to a named person.

NairobiX is a growth and digital transformation partner based in Nairobi, Kenya. Its work spans growth strategy, digital marketing, CRM and sales systems, automation, AI implementation, websites and digital platforms.

When NairobiX is the data controller

For the website, our forms, bookings, Nia, Opportunities Network applications and our own relationships with prospective and existing Clients, NairobiX decides why and how your personal data is processed. In those cases we are the data controller under the Act and responsible for the processing described in this Policy.

When we process data on behalf of a Client

When we build or operate systems for a Client — for example configuring their CRM, running their campaigns or automating their customer communications — we may handle personal data about that Client's own customers and contacts. In that work the Client is normally the data controller and NairobiX acts as a data processor, following the Client's documented instructions under our agreement with them. If you are a customer of one of our Clients, please contact that business about how it uses your information.

Our service providers

We use established technology providers to run the website and our business systems. They process personal data on our behalf as our processors, or under their own terms where they act independently (see section 08).

We collect only what we need for the purpose you are using. Depending on how you interact with us, this may include:

• Identity and contact

  Examples

  First and last name, email address, phone or WhatsApp number

  When

  Any form, booking, Nia request, Proposal or direct contact

• Business information

  Examples

  Business name, industry, website, city, country

  When

  Growth Assessment, forms, bookings, Network applications

• Enquiry details

  Examples

  Your message, the topic or growth area you are interested in, desired timeline, investment readiness

  When

  Contact and Growth System Request forms, Nia

• Growth Assessment answers

  Examples

  Growth priorities, where your business is stuck, how customers find you, how enquiries are tracked and followed up

  When

  Business Growth Assessment

• Consultation details

  Examples

  Chosen date and time, focus area, what you would like to discuss

  When

  Consultation booking (website or Nia)

• Opportunities Network application

  Examples

  Organisation type, how you would like to participate, motivation

  When

  Network application

• Proposal responses

  Examples

  Whether you chose to proceed, discuss or request changes to a Proposal

  When

  Response links in a NairobiX Proposal

• Nia conversations

  Examples

  The messages you type to Nia

  When

  When you chat with Nia

• Communications

  Examples

  Emails and WhatsApp messages you exchange with us

  When

  When you contact us or we reply

• Client Engagement information

  Examples

  Contacts at the Client, scope and delivery records, Invoices and Payment records

  When

  When you become a Client

• Technical and usage

  Examples

  Pages viewed and general interaction events

  When

  When you enable Analytics, as you browse the Website

• Campaign attribution

  Examples

  The channel you arrived from, campaign tags in the link (such as utm_source), ad click IDs, landing page

  When

  When you enable Marketing; sent with any form you submit

We do not ask for sensitive personal data — such as health information, ethnic origin, biometric data or financial account details — through the website. Please do not include it in free-text fields or conversations with Nia. The website does not take payments and does not collect card details.

• Directly from you — when you complete a form, the Growth Assessment or a booking, apply to the Opportunities Network, respond to a Proposal, email or message us, or speak with us.
• Through Nia — when you chat with Nia, and when you confirm that Nia should submit an enquiry or booking for you.
• Automatically — through analytics and, where enabled, advertising measurement technologies described in the Cookie Policy.
• During an Engagement — from you and your colleagues as we deliver agreed work.
• From others — occasionally from a person who refers you to us, or from publicly available business sources such as your company website.

We use personal data to:

• respond to enquiries and follow up on requests you make;
• review your Growth Assessment and prepare the findings and next steps you asked for;
• arrange, confirm and hold consultations;
• assess, qualify and administer Opportunities Network applications and participation;
• prepare Proposals and Quotes and record your response to them;
• deliver Services and manage Client relationships and Engagements, including invoicing;
• operate and improve the website and Nia, and understand which pages and channels are useful;
• measure which of our advertising leads to enquiries and bookings;
• keep our systems secure and prevent abuse;
• meet legal, tax, accounting and regulatory obligations, and establish or defend legal claims.

Section 30 of the Act allows personal data to be processed only on specific grounds. We rely on the following:

• Responding to enquiries, Assessments, bookings and Nia requests you submit

  Lawful basis under the Act

  Your consent, given when you submit, and steps taken at your request before entering into a contract

• Reviewing Opportunities Network applications

  Lawful basis under the Act

  Steps taken at your request before entering into a participation arrangement

• Delivering Services and managing an Engagement

  Lawful basis under the Act

  Performance of a contract with the Client

• Website analytics and security

  Lawful basis under the Act

  Our legitimate interests in running a secure, useful website, balanced against your rights

• Advertising measurement

  Lawful basis under the Act

  Our legitimate interests in understanding which advertising works — you can opt out as described in the Cookie Policy

• Marketing messages

  Lawful basis under the Act

  Your consent, which you can withdraw at any time

• Tax, accounting and legal compliance

  Lawful basis under the Act

  Compliance with a legal obligation

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawal does not affect processing that took place before it.

The website does not sign you up to a mailing list. We send marketing messages — for example news about our Services or Insights — only where you have agreed to receive them, and every message tells you how to opt out at no cost. If you opt out, we stop using your personal data for direct marketing. Messages about an enquiry, booking, Proposal or Engagement you are involved in are not marketing and will continue while they are relevant.

NairobiX runs on the following technology. Each provider handles only the data needed for its part of the work:

• Zoho CRM

  What it does for NairobiX

  Our CRM: records enquiries, Assessments, applications, Proposals and Client relationships

  Data involved

  Contact, business, enquiry and Assessment details; campaign attribution

• Zoho Bookings

  What it does for NairobiX

  Consultation scheduling and confirmations

  Data involved

  Contact details, chosen time, consultation topic

• Zoho Mail

  What it does for NairobiX

  Email, including sending Proposals

  Data involved

  Email correspondence

• Anthropic (Claude API)

  What it does for NairobiX

  Generates Nia's replies

  Data involved

  The messages you send to Nia

• Vercel

  What it does for NairobiX

  Hosts the website and its server functions

  Data involved

  Technical data such as IP address and request logs

• Google Analytics

  What it does for NairobiX

  Website usage measurement

  Data involved

  Usage and device data, pseudonymous identifiers

• Meta (Pixel and Conversions API)

  What it does for NairobiX

  Advertising measurement

  Data involved

  Conversion events; email, phone and name in hashed form where provided

• WhatsApp (Meta)

  What it does for NairobiX

  Messaging, if you choose to contact us on WhatsApp

  Data involved

  Your number and messages

We may change providers as our business evolves. We will update this Policy when a change affects how your personal data is handled in a meaningful way.

Nia is an AI assistant on the website that answers questions about NairobiX and, if you ask, helps you submit an enquiry or book a consultation. Nia runs on Anthropic's Claude models.

• The messages you send are passed to Anthropic to generate Nia's replies, and are processed under Anthropic's commercial terms.
• Your conversation is held in your browser while the page is open. NairobiX does not save chat transcripts to a database; refreshing or closing the page ends the conversation.
• Nia only submits information to our CRM or booking system after you clearly confirm that you want it to. What is submitted is handled exactly as if you had used the matching form.
• To prevent abuse, the number of messages from a network address is limited for a short period. This is held briefly in server memory and is not linked to your identity.
• People at NairobiX review anything Nia submits for you before acting on it.

The website uses Google Analytics to understand how it is used when you enable Analytics, and advertising measurement tags to see which campaigns lead to enquiries when you enable Marketing. With Marketing consent, it also keeps a small attribution record in your browser so we know which channel brought you to us; this is sent with any form you submit and stored with your enquiry in our CRM. You can change these choices using Cookie preferences in the Website footer.

We do not send your name, email or phone number to Google Analytics. Where advertising measurement is enabled, any email or phone number shared with an advertising platform is hashed (turned into an irreversible code) first. If your browser sends a Global Privacy Control signal, advertising technologies are not loaded for your visit.

The full list of technologies, what they store and how to control them is in our Cookie Policy.

We do not sell personal data. We share it only:

• with the service providers described in section 08, to the extent they need it;
• within the Opportunities Network, where an approved Participant is involved in a specific opportunity — and then only the information needed for that opportunity, in line with the applicable participation terms;
• with professional advisers such as lawyers, auditors and accountants, under a duty of confidentiality;
• where required by law, a court order or a competent authority, or to protect our legal rights;
• with a successor business if NairobiX is involved in a merger, acquisition or transfer of assets, subject to equivalent protection.

Several of our providers — including Zoho, Anthropic, Vercel and Google, as well as Meta — operate infrastructure outside Kenya, so your personal data may be stored or processed in other countries.

Sections 48 to 50 of the Act allow such transfers where appropriate safeguards are in place or another condition in the Act applies. We work with established providers that set out their security and data-protection commitments in their contracts, and we transfer only what is needed for the purpose described in this Policy. You can contact us for more information about the safeguards that apply to a particular provider.

Under section 39 of the Act we keep personal data only for as long as it is needed for the purpose it was collected for, unless a longer period is required or allowed by law. In practice:

• Enquiries, Assessments and applications are kept while we are in active discussion with you and for a reasonable period afterwards, so we can follow up and keep an accurate record of our relationship.
• Client and Engagement records, including Invoices and Payment records, are kept for as long as Kenyan tax, accounting and limitation laws require.
• Nia conversations are not stored by NairobiX after you close the page.
• Browser storage used by the website is described, with its duration, in the Cookie Policy.

When data is no longer needed, we delete it or anonymise it so it no longer identifies you.

We use technical and organisational measures appropriate to the risk, including:

• encrypting connections to the website (HTTPS);
• keeping credentials for our CRM, booking, AI and other integrations on the server, never in your browser;
• limiting access to personal data to people who need it for their work;
• sending only hashed contact details to advertising platforms, where advertising measurement is used;
• relying on the security programmes of established providers for the systems they run.

No system is completely secure. If a breach of personal data creates a real risk of harm, we will notify the Data Commissioner and, where required, affected individuals, as section 43 of the Act requires.

Under the Act you have the right to:

• be informed of how your personal data is used;
• access the personal data we hold about you;
• object to all or part of the processing of your personal data, including — at any time — for direct marketing;
• have false or misleading data corrected, and deleted;
• ask us to restrict processing in the circumstances set out in the Act;
• receive data you provided in a structured, commonly used, machine-readable format, where data portability applies;
• withdraw consent where we rely on it;
• not be subject to a decision based solely on automated processing that significantly affects you.

To exercise a right, email hello@nairobix.com. We may need to confirm your identity first. We will respond within the periods set by the Data Protection (General) Regulations, 2021, and there is no charge for making a request. If we cannot meet a request — for example because the law requires us to keep certain records — we will explain why in writing.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya's data protection regulator.

Our website and Services are intended for businesses and the adults who run them. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

We review this Policy when our services, systems or the law change. The “Last updated” date above shows the current version. Where a change significantly affects how we use personal data you have already given us, we will tell you directly where we can.

For questions about this Policy or your personal data, contact NairobiX:

• Email: hello@nairobix.com
• WhatsApp: +254 105 426 364
• Location: Nairobi, Kenya

Use of the website is also governed by our Terms of Service.