Privacy Policy

Last updated: 9 October 2026

Zircon Consultants ("we", "us" or "our") respects your privacy. This policy explains what personal data we collect through our website at zirconconsultants.org, why we collect it, who we share it with, and the rights you have over it.

We are a Kenyan company, so we process personal data in line with the Data Protection Act, Cap. 411C of the Laws of Kenya. Where visitors reach us from the European Economic Area or the United Kingdom, we also apply the principles of the EU General Data Protection Regulation (GDPR).

Who We Are

For the purposes of the Data Protection Act and the GDPR, the data controller is:

Information We Collect

Information you give us

You can browse this website without telling us who you are. We only receive personal data when you choose to send it through one of our forms, and depending on the form this can include:

  • your name, email address and phone number;
  • your organization, its type and size, and your job title;
  • the programs or courses you are interested in, with details such as team size, timeline and preferred delivery format;
  • how you heard about us; and
  • any message or notes you add.

We keep your contact details on a mailing list so we can follow up with you, and newsletter subscribers on a separate list. You can ask to be removed at any time, using the unsubscribe link in our emails or by writing to us.

Information collected automatically

When you open or submit one of our forms, our server records your IP address to limit repeated submissions. With each submission we also keep the date and time, the page it came from and your browser's user agent, to help us detect spam.

With your consent, Google Analytics tells us how the website is used: which pages are visited, for how long, on what kind of device and browser, and from roughly where. This data is aggregated and does not identify you. See our Cookie Policy for the cookies involved.

How We Use Your Information

We use personal data to:

  • respond to your enquiries and provide the services you ask us about;
  • send you our newsletter and related updates, where you have subscribed;
  • operate, secure, and improve the website, including filtering spam submissions;
  • understand how visitors use the website so we can improve our content; and
  • comply with legal obligations that apply to us.

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects about you.

Lawful Bases for Processing

Section 30 of the Data Protection Act, and Article 6 of the GDPR where it applies, require a lawful basis for every use of personal data. Ours are:

  • Consent: for the newsletter and for analytics cookies. You can withdraw consent at any time, for the newsletter by using the unsubscribe link in any email or writing to us, and for cookies as described in the Cookie Policy.
  • Steps prior to a contract: when you contact us about our programs and services, we process your details to respond and prepare a proposal.
  • Legitimate interests: keeping the website secure, preventing spam, and measuring how our content performs.
  • Legal obligation: where we must keep records to comply with Kenyan law.

Who We Share Your Information With

We share personal data only with service providers who process it on our instructions:

  • Brevo (Sendinblue SAS, France): delivers our email, including your form submissions, and stores our contact lists.
  • Google: provides website analytics, and the map on our contact page, which loads directly from Google.
  • Hostinger (Hostinger International Ltd, Lithuania): hosts the website and its server logs.

We may also disclose personal data where the law requires it, for example in response to a valid request from a court or public authority, or to protect our rights, our users, or the public.

International Transfers

Our service providers store data outside Kenya: Brevo in France, Hostinger in the European Union, and Google in the countries where it operates its infrastructure. Section 48 of the Data Protection Act permits transfers out of Kenya where the data controller can show the Data Commissioner that appropriate safeguards protect the data, or where the transfer is necessary to perform a contract with you or to take steps you have asked for before entering one. Each of these providers is subject to the GDPR or to equivalent contractual data protection commitments.

How Long We Keep Your Information

We keep personal data only as long as we need it for the purposes described above:

  • Enquiries are kept as long as needed to handle them and any business relationship that follows.
  • Newsletter details are kept until you unsubscribe or ask us to delete them.
  • Technical logs and analytics data are kept for shorter periods and in aggregated form.

When data is no longer needed, we delete it or anonymize it.

Your Rights

Under Kenya's Data Protection Act

Section 26 of the Data Protection Act gives you the right to:

  • be informed of the use to which your personal data is put;
  • access your personal data in our custody;
  • object to the processing of all or part of your personal data;
  • correction of false or misleading data; and
  • deletion of false or misleading data about you.

Under the GDPR

If you are in the European Economic Area or the United Kingdom, you additionally have the right to erasure, to restriction of processing, to data portability, and to lodge a complaint with your local supervisory authority.

Exercising your rights and complaints

To exercise any of these rights, email us at zircon@zirconconsultants.org. We will respond within a reasonable time and at no cost to you.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC), the authority established under the Data Protection Act to enforce data protection in Kenya.

How We Protect Your Information

We use appropriate technical and organizational measures to protect personal data, including encrypted (HTTPS) connections across the website, spam filtering on our forms, and access to submissions restricted to the people who handle them. No method of transmission or storage is completely secure, but we work to protect your data against loss, misuse, and unauthorized access.

Children's Privacy

Our services are aimed at organizations and working professionals, and the website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

The website contains links to third-party sites, such as LinkedIn and the sites we cite in our articles. We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of every site you visit.

Changes to This Policy

We may update this policy from time to time, for example when the law or our practices change. The current version is always published on this page, with the "Last updated" date at the top. Significant changes will be highlighted on the website.

Contact Us

Questions about this policy or about how we handle your personal data can be sent to zircon@zirconconsultants.org or posted to Zircon Consultants, The Watermark Business Park, Spring Court, Ndege Road, Karen, Nairobi, Kenya.