1. Introduction
Zestech Associates Limited (“Zestech”, “we”, “us”, or “our”) is committed to respecting your privacy and protecting personal data collected in the course of our operations. This Privacy Policy outlines the principles and practices governing the collection, processing, storage, and transfer of personal data obtained through this website (zestechassociates.co.ke) and related electronic communications.
We conduct our data processing activities in compliance with Article 31 of the Constitution of Kenya (which guarantees the fundamental right to privacy), the Data Protection Act, 2019 (Act No. 24 of 2019), the Data Protection (General) Regulations, 2021, and directives issued by the Office of the Data Protection Commissioner (ODPC) of Kenya.
2. About Zestech Associates Limited
Zestech Associates Limited is a corporate training and management consultancy company based in Nairobi, Kenya, specializing in productivity enhancement, performance management, ICT accessibility, constitutional governance (Article 10), and human resource development.
Data Controller Identity: Zestech Associates Limited
Principal Operational Location: Nairobi, Kenya
Official General Contact: info@zestechassociates.co.ke | +254 118 090 515
Registered Physical Address: [Physical Address to be confirmed by Zestech Management prior to publication]
Designated Privacy / Data Protection Contact: [Designation / Official Email to be confirmed - e.g., privacy@zestechassociates.co.ke]
3. Personal Information We May Collect
Depending on how you interact with our website and communications, we may collect the following categories of information:
A. Information You Voluntarily Provide
- Contact Details: Full name, official email address, telephone number, and postal or physical location.
- Institutional Background: Employer or organization name, departmental unit, and job title.
- Enquiry Details: Areas of interest (Productivity, Performance Management, ICT Accessibility, Governance, HR Training), subject line, and narrative description of your organizational requirements.
- Direct Correspondence: Records of communications, questions, or requests for proposal (RFP) submitted via our contact channels.
B. Technical and System Information (Where Enabled)
- Network Logs: IP address, device type, browser specifications, and server request timestamps (collected routinely by underlying web hosting infrastructure for cybersecurity, firewall defense, and service reliability).
C. Sensitive Personal Data
Zestech Associates Limited does not actively solicit or collect sensitive personal data (such as race, health status, biometric data, religious beliefs, or financial card details) through this public website. We request that you avoid transmitting sensitive personal details via contact forms.
4. How We Collect Information
We collect personal information through the following mechanisms:
- Interactive Web Forms: When you complete the enquiry or consultation form on our Contact page.
- Direct Communications: When you contact us via our official email (
info@zestechassociates.co.ke) or official telephone (+254 118 090 515). - Contractual & Training Onboarding: When your organization engages Zestech for in-house training cohorts, workshops, or management advisory reviews.
- Automated Infrastructure Logging: Standard server logs generated by our hosting infrastructure.
5. How We Use Personal Information
Personal information collected by Zestech Associates is processed strictly for legitimate operational purposes, including:
- Responding to inquiries, questions, and requests for training outlines or consulting quotes.
- Structuring, customizing, and administering training programs, curriculum modules, and participant materials.
- Fulfilling institutional contractual agreements entered into with your employer or sponsoring organization.
- Maintaining the technical security, integrity, and operational availability of our website.
- Complying with statutory reporting, accounting, tax, and regulatory compliance obligations in Kenya.
No Commercial Sale of Data: Zestech Associates Limited does not sell, rent, lease, or trade personal information to marketing brokers, third-party advertisers, or data aggregators.
6. Legal Basis for Processing under Kenyan Law
In accordance with Section 30 of the Kenya Data Protection Act, 2019, our processing of personal data relies on one or more of the following lawful grounds:
A. Consent
Where you have voluntarily submitted your information through our web form or requested information from us.
B. Contractual Necessity & Pre-Contractual Steps
Where processing is required to prepare a training proposal, formulate an advisory agreement, or perform our obligations under an institutional contract.
C. Legitimate Interests
Where processing is necessary for our legitimate institutional interests, such as securing our network, managing business communications, and improving our professional service offerings, provided such interests do not override your fundamental rights.
D. Legal Obligation
Where compliance with statutory mandates under Kenyan law, such as taxation, financial auditing, or lawful regulatory directives, necessitates data processing.
8. Accessibility Tools & UserWay Integration
As part of our organizational commitment to inclusive digital design, the website is intended to support enhanced accessibility utilities, including a prospective integration of the UserWay accessibility widget.
Current Verification Status: The UserWay script is currently not installed in the active codebase. Zestech designs all website components natively to conform with the Web Content Accessibility Guidelines (WCAG 2.2 AA) through semantic HTML, high-contrast tokens, and keyboard accessibility.
When the UserWay widget is formally integrated, its function will be to assist visitors in customizing visual display settings (such as text spacing, font contrast, and cursor sizing). If and when enabled, any technical data processed by the widget will be audited and disclosed in this section, in strict compliance with ODPC standards.
10. International Data Transfers
Under Sections 48 and 49 of the Kenya Data Protection Act, 2019, transferring personal data outside Kenya requires proof of appropriate safeguards, an adequacy decision, or explicit consent.
Where cloud service providers (such as hosting platforms or database infrastructure) utilize server facilities located outside the Republic of Kenya, Zestech Associates ensures that such providers maintain recognized organizational and technical security measures (such as ISO/IEC 27001 certifications or standard contractual clauses) that provide an equivalent level of data protection.
11. Data Security
We implement reasonable technical and organizational measures designed to protect personal information against accidental loss, unauthorized access, alteration, or disclosure. These measures include:
- Enforcing HTTPS/TLS encryption across all web traffic and submission endpoints.
- Applying server-side input validation and sanitization to prevent injection vulnerabilities.
- Restricting administrative access to authorized personnel with a legitimate business need.
Note on Internet Security: While we strive to maintain robust safeguards, no method of transmission over the Internet or electronic storage is entirely invulnerable. Consequently, we cannot guarantee absolute security, and users provide information with an understanding of these inherent risks.
12. Data Retention
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, statutory, accounting, or reporting requirements.
- General Inquiries: Inquiries that do not lead to an institutional engagement are retained for a standard administrative period
[Retention period to be confirmed by Zestech Management - recommended 12 to 24 months]before being securely purged. - Contractual & Training Records: Records relating to executed training contracts, consultancy reports, and invoices are retained in accordance with Kenyan commercial and tax laws (typically 7 years).
13. Your Data Protection Rights under Kenyan Law
Subject to statutory exemptions set out in the Data Protection Act, 2019, you possess the following rights regarding your personal data:
Right to be Informed
To be notified of the purposes for which your data is processed.
Right of Access
To request a copy of personal information we hold concerning you.
Right to Rectification
To request correction of inaccurate, outdated, or incomplete data.
Right to Erasure
To request deletion of data held without continuing lawful basis.
Right to Object
To object to data processing carried out under legitimate interests.
Right to Data Portability
To receive your personal data in a structured, standard format.
Exercising Your Rights: To submit a data subject request, email us at info@zestechassociates.co.ke with the subject line “Data Subject Request”. We will respond to verified requests within the statutory timeline provided by Kenyan law (typically 30 calendar days).
Regulatory Authority: You also have the right to lodge a complaint directly with the Office of the Data Protection Commissioner (ODPC) of Kenya.
14. Marketing Communications
Zestech Associates Limited does not currently operate an automated promotional newsletter or bulk marketing mailing list. Any future direct marketing communications will be conducted strictly on an opt-in basis, and recipients will be provided an immediate, accessible mechanism to unsubscribe or opt out at any time.
15. Third-Party Websites
Our website may contain hyperlinks to third-party web portals, such as government agencies, regulatory bodies, or statutory legal documentation. Zestech Associates Limited exercises no control over external platforms, and we encourage you to review their independent privacy notices when visiting their sites.
16. Children's Privacy
Our services, professional consultancy, and training programs are intended exclusively for corporate, institutional, and adult professional audiences. We do not knowingly collect or solicit personal information from individuals under the age of 18. If you believe a child has provided us with personal information, please contact us so we may promptly take corrective action.
17. Changes to This Privacy Policy
We may periodically revise this Privacy Policy to reflect modifications in our business practices, technological capabilities, or evolving regulatory mandates. Material revisions will be posted on this page along with an updated “Last Updated” date at the top of the policy.
18. Contact Us & Data Protection Inquiries
If you have questions, feedback, or requests concerning this Privacy Policy or our personal data handling practices, please contact us using the official channels below: