Draft for SDS review. This text describes how the platform is designed to work. SDS and its legal adviser must confirm it before launch.
Privacy notice
SDS Consulting (“SDS”) operates this platform. This notice explains what information we collect, why, and who else handles it. It is written with the Kenya Data Protection Act, 2019 in mind.
What we collect
- Organisation name, your name, role and email address, and the email addresses of colleagues you invite.
- Your answers to the assessment questions, including any written answers.
- For paid packages: payment details are entered with our payment provider, not with us. We keep the order, amount, currency and a payment reference.
- Technical data needed to keep the service secure, such as your IP address in security logs.
- A count of visits that arrive from links on our website (which page they came from and which page they landed on). It holds nothing about you and sets no cookie.
Why we use it
- To run the assessment, calculate results and produce your report.
- To email you session codes, reminders, reports and receipts.
- To prevent abuse and keep the service secure.
- To contact you about a proposal if you ask for one.
Who handles it for us
- Cloudflare, which hosts the platform and stores the data.
- Google (Gemini), which receives your organisation’s name and assessment scores (and, if we later add written answers to reports, those answers) so that report text can be drafted. We do not send email addresses.
- Paystack, which processes card and mobile-money payments.
- Resend, which delivers our emails.
Your choices
You can ask to see, correct, export or delete your information by writing to info@sdsconsulting.org. We keep session data only as long as needed for the service and for legal and accounting records.
How long we keep it
- Diagnostic sessions and their reports: 24 months after the last activity, then deleted.
- Private-sector reporting sessions: 12 months, then access ends and the content is deleted 30 days later.
- Enquiries that did not lead to an engagement: 24 months.
- Copies of the emails we sent you: 90 days.
- Payment records and signed contracts: as long as the law requires us to keep accounts and contracts.
- Safety copies (backups) of our database: kept for 30 days, and the first copy of each month for a year. If you ask us to erase your data, it is removed from the live service at once and disappears from the copies as they expire.
The assessment and reports
Reports are readiness and support documents. They are not an assurance opinion, legal advice or a certification.